HP T5135 - Compaq Thin Client Handbuch

Administrator Instructions for Configuring Smart Cards for Use

with HP Compaq t5000 Thin Clients

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

Installing a Certificate Authority (CA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

Creating a Smartcard Logon Certificate Template . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

Issuing the Certificate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Forcing a Smartcard Logon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9

For more information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10

Introduction

Smart cards can provide additional security to a thin client network. This paper provides instructions for

configuring a smart card with your HP Compaq t5000 thin client.

Prerequisites

The following items are required to use a smart card with HP Compaq t5000 thin clients:

•Reflex USB V2 Smart Card Reader from Schlumberger.

•Certification Authority (CA): You must prepare smart cards before using them. Each smart card

requires a certificate. To get that certificate on each smart card, you need a certification authority

(CA).

•An Enterprise CA server: To issue smart card certificates, you need an Enterprise CA server.

NOTE: The configuration of the CA is not significant with regard to

simply issuing the smart card logon certificates. However, the

configuration may be important depending on the other uses you plan

for your CA.

Installing a Certificate Authority (CA)

To install a CA, perform the following steps:

1. Log on as a member of the Enterprise Admins group.

2. Select Start > Control Panel > Add/Remove Programs and click Add/Remove Windows

Components.

3. From the list of Windows components, select the Certificate Services option and follow the wizard to

install. A message warns that after installing, a machine name or domain membership cannot be

changed due to the binding of the machine name to the CA information stored in the Active Direc-

tory. After you ensure that the proper machine name and domain membership are configured click

Yes, and click Next.

4. From the CA Type selection box ensure that you are installing an Enterprise root CA and click Next.

5. From the CA Identifying Information box, enter a name for your CA and click Next.

6. From the Certificate Database Settings dialog box, leave the default settings (unless you know that

you want to change them) and click Next. You'll need the CD-ROM or installation files.

7. If Internal Information Services is currently running, you will be prompted to stop the service tempo-

rarily. Click Yes.

8. If you don't have Internet Information Services (IIS) installed, you'll be prompted to install IIS to get

web enrollment working. If you don't plan to do any web enrollment, click OK and ignore the prompt.

NOTE: Active Server Pages must be enabled to allow Certificate

Services to provide web enrollment service. Enabling ASPs is a

potential security risk. If you do not plan web enrollment services, click

No when prompted. If you click No, IIS must be manually reconfigured

later to enable this functionality.

9. Click Finish.

Creating a Smart Card Logon Certificate Template

You will need to create a smart card logon certificate template. To create the certificate template, perform

the following steps:

1. Create an MMC with the following snap-ins:

• Active Directory Users and Computers

• Certification Authority

• Certificate Templates

2. Click Certificate Templates and look for the Smartcard Logon certificate in the right-hand pane.

3. Right click Certificate Templates and click Manage.

4. Right-click the Smartcard Logon template and select Duplicate Template.

5. A Properties of New Template dialog box will appear. Give the new template a name. Be sure to

select Publish Certificate in Active Directory if the box isn't already checked.

6. Click the Request Handling tab and then select Signature and Smartcard Logon in the Purpose drop-

down list. If you want the user to be prompted to insert a smart card during logon, select the option

Prompt the User During Enrollment.

7. From the Properties of New Templates dialog box, click the CSPs button near the bottom to open the

CSP Selection dialog box, where you can select the appropriate cryptographic service provider

(CSP).

NOTE: You cannot randomly select a CSP. What you select affects

what the user sees on the other end. For example, if selecting the

Schlumberger Cryptographic Service Provider, the user is prompted to

insert a Schlumberger smart card on the client side. Select only the

applicable CSP(s) for your smart cards. This process is easier if you

have only one type of smart card and reader. If you have more than

one smart card type, you'll have to select multiple CSPs.

8. From the Properties of the New Template box, click the Security tab. If you want to allow all users in

your Domain Users group to receive certificates during logon, you must add them to the Access Con-

trol List (ACL) for this template. Be sure to give them the rights to Read and Enroll.

9. Click OK. The template is ready.

Issuing the Certificate

Now that you have the smart card logon template duplicated, you need to issue it from the CA. To issue

the certificate perform the following steps:

1. Expand the Certification Authority object in your MMC.

2. Expand your CA name.

3. Right-click Certificate Templates.

4. Click New, and then click Certificate Template to Issue.

5. Locate and select your newly created and configured certificate and click OK. The new certificate

appears in the right-hand pane.

Forcing a Smart Card Logon

Administrators can modify users’ account properties to require smart cards for interactive logons. With

this feature, users cannot log onto a thin client in your network without a smart card. To configure this

option, perform the following steps:

1. From the Group Policy Editor window, select Group Policy Editor > Software Settings >

Account Policies > Local Policies > Security Options.

2. Locate the “Interactive Logon: Require smartcard” policy.

3. Right-click the ”Require smartcard” policy and click Enable.

If you require smart card logon for all your network users, you can scour your domain for any remaining

passwords that cannot be replaced. For example, some service accounts (those for Internet Information

Server, Exchange Server, backup programs, etc.) still require passwords, so you still need a good

password policy to secure those accounts. Because you can control these passwords, you can create a

strong password policy to further secure your network.

For more information

For additional HP Compaq t5000 thin clients information, please refer to the following:

http://h18004.www1.hp.com/products/thinclients/index_t5000.html

Company, L.P.The information in this document is subject to change without notice.The only

warranties for HP products and services are set forth in the express warranty statements

accompanying such products and services. Nothing herein should be construed as

constituting an additional warranty. HP shall not be liable for technical or editorial errors or

omissions contained herein.

394836-001, 4/2005

Andere Handbücher für T5135 - Compaq Thin Client

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere HP Server Handbücher

HP ProLiant ML10 Bedienungsanleitung

HP Disk Carrier Blade for bh3710 Bedienungsanleitung

HP ProLiant DL120 G7 Bedienungsanleitung

HP D7171A - NetServer - LPr Bedienungsanleitung

HP Integrity BL860c i4 Bedienungsanleitung

HP T5145 - Thin Client - Tower Bedienungs- und Wartungshandbuch

HP 1850R - ProLiant - 128 MB RAM Bedienungsanleitung

HP ProLiant DL320 Generation 4 Handbuch

HP ProLiant BL465c Gen8 Handbuch

HP DesignJet T610 Bedienungsanleitung

HP t5740 - Thin Client Gebrauchsanweisung

HP ProLiant ML110 - G2 Server Bedienungsanleitung

HP 124708-001 - ProLiant Cluster - 1850 Bedienungsanleitung

HP PROLIANT BL45P Gebrauchsanweisung

HP Integrity BL860c Gebrauchsanweisung

HP HP DL360 G7 Montageanleitung

HP NetServer AA 4000 Bedienungsanleitung

HP AB500A - Integrated Lights-Out Advanced Bedienungsanleitung

HP Integrity rx2660 Bedienungsanleitung

HP ProLiant DL180 G5 Gebrauchsanweisung

HP ProLiant DL388 Bedienungsanleitung

HP T5540 - Thin Client - 512 MB RAM Gebrauchsanweisung

HP Itanium RX7620-16 Bedienungsanleitung

HP ProLiant SL230s Bedienungsanleitung

Beliebte Server Handbücher anderer Marken

Dell

Dell PowerEdge R410 Bedienungsanleitung

PowerNAS

PowerNAS CMA Bedienungsanleitung

Supero

Supero FatTwin F617R3-FT Bedienungsanleitung

MSI

MSI P1-109N-L70 Bedienungsanleitung

Dell

Dell PowerEdge XE9640 Handbuch

Dell

Dell PS4100 Montageanleitung

EtroVISION

EtroVISION EV3151 Bedienungsanleitung

NEC

NEC Express5800/T110j Bedienungsanleitung

Compaq

Compaq ProLiant 3000 Handbuch

Dell

Dell PowerEdge 3YPMN Bedienungsanleitung

iRobo

iRobo IPC2U Bedienungsanleitung

Nortel

Nortel 1000 Con?guration guide Bedienungsanleitung

Asus

Asus AP7500 Bedienungs- und Wartungshandbuch

Avid Technology

Avid Technology AirSpeed 5000 Bedienungsanleitung

Milestone

Milestone Husky IVO 350T Bedienungsanleitung

Planet

Planet NAS-7410 Bedienungsanleitung

Lenovo

Lenovo ThinkSystem SR635 V3 Bedienungsanleitung

Dell

Dell PowerEdge HS5610 Handbuch