ManageEngine Self Service Password Pelco DVR C2619M Admin Guide

User Manual: Pelco DVR C2619M

Open the PDF directly: View PDF .
Page Count: 126

Download
Open PDF In Browser	View PDF

ManageEngine ADSelfSerivce Plus – Admin Guide

Table of Contents
WELCOME TO ADSELFSERVICE PLUS ............................................................4
SELF-SERVICE FEATURES ................................................................................5
GETTING STARTED ............................................................................................6
System Requirements for ADSelfService Plus ............................................................. 7
Installing ADSelfService Plus ....................................................................................... 8
Working with ADSelfService Plus................................................................................. 9
Licensing ................................................................................................................... 11

DOMAIN CONFIGURATION ..............................................................................12
ROLLING OUT ADSELFSERVICE PLUS ..........................................................14
Password Self-Service Deployment ........................................................................... 15
Policy Configuration: ............................................................................................................... 17
Identity Verification.................................................................................................................. 18
Enrollment & Invitation ............................................................................................................ 19
Security Settings: (Features Under Advance Tab) ................................................................. 20
Taking The Features To The End-Users ................................................................................ 21
Implementing Password Reset/ Account Unlock process:.................................................. 22
Implementing Self-Update Feature ..................................................................................... 23
Implementing Change Password Feature ........................................................................... 24

Employee Search Deployment ................................................................................... 25
Password Notification Deployment............................................................................. 26

KNOW YOUR PRODUCT ...................................................................................27
Dashboard ................................................................................................................. 28
Reports ...................................................................................................................... 30
User Reports ........................................................................................................................... 31
Enrollment Reports ................................................................................................................. 33
Audit Reports .......................................................................................................................... 35

Configuration ............................................................................................................. 36
Self-Service ............................................................................................................................. 37
Policy Configuration ............................................................................................................ 38
Identity Verification .......................................................................................................... 39
Configuring Security Question and Answers ............................................................... 40
Verification Codes ........................................................................................................ 42

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Advanced Configuration .................................................................................................. 44
BLOCK USERS............................................................................................................ 45
RESET AND UNLOCK ................................................................................................ 46
Q & A SETTINGS......................................................................................................... 47
ENROLLMENT............................................................................................................. 49
Notification ................................................................................................................... 50
GENERAL .................................................................................................................... 51
Automatic Rest and Unlock .......................................................................................... 52
Password / Account Expiry Notification............................................................................... 54
Employee Search ................................................................................................................ 56
Administrative Tools................................................................................................................ 57
Quick Enrollment ................................................................................................................. 58
Enrollment Notification ..................................................................................................... 59
Auto Enrollment ............................................................................................................... 60
Enrollment Reminder ....................................................................................................... 62
Self-Update Layout.............................................................................................................. 63
Field Customization ......................................................................................................... 65
Attribute List ..................................................................................................................... 66
How To ............................................................................................................................ 70
Gina Installation................................................................................................................... 79
Client Software Installation From The ADSelfService Plus Console ............................... 80
Client Software Installation via GPO (Group Policy Object) ............................................ 82
Client Software Installation Via System Center Configuration Manager ......................... 83
Manual Installation Of Client Software ............................................................................ 86
Gina/CP Customization ....................................................................................................... 87
Gina/CP Schedulers ............................................................................................................ 88
Technician ........................................................................................................................... 89
External Data Sources ........................................................................................................ 90
Security Center ....................................................................................................................... 92
Password Strengtheners ..................................................................................................... 93
Security Q & A Strengtheners ............................................................................................. 94
Anti-Hacking System ........................................................................................................... 95
Brute Force/Dictionary Attack Preventers ....................................................................... 96
Man-In-The-Middle Attack Preventers ............................................................................. 97
Safe-Guard Inactive Account Loopholes ......................................................................... 98

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Admin ........................................................................................................................ 99
Customize ............................................................................................................................. 100
Logon Settings .................................................................................................................. 101
Customize User Logon Page ......................................................................................... 102
Rebranding ........................................................................................................................ 104
Personalize ........................................................................................................................ 106
System Utilities ..................................................................................................................... 107
Dashboard Updater ........................................................................................................... 108
Automatic DB Backup ....................................................................................................... 110
Product Settings .................................................................................................................... 111
Connection ........................................................................................................................ 112
Entrusting 'SSL Certification' with SSL Certification Tool .............................................. 113
Server Settings .................................................................................................................. 115
Windows Service ............................................................................................................... 116
License Management............................................................................................................ 117
Restrict Users .................................................................................................................... 118

SUPPORT .........................................................................................................120
TROUBLESHOOTING TIPS .............................................................................121

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Welcome to ADSelfService Plus
ADSelfService Plus is a web based product which allows end users to reset forgotten passwords
securely, allowing administrators to implement stronger password policies while reducing help-desk
workload. It provides a simple, secure web based solution that allows end users to reset forgotten
passwords and unlock their user accounts themselves by answering configured preset question and
answers.
It helps to generate comprehensive reports on Locked Out Users, Soon-to-Expire-Password-Users,
Password Expired Users which provides a clear picture on the status of users and accounts present
in the Domain. Also the above reports can be scheduled on a monthly, weekly, daily or hourly basis
providing administrators control and end-users with the most needed notification on soon to expire
passwords.
It also provides a detailed audit feature on when, by whom and which user password or accounts
was modified. Further a Self Update feature where a user can update his/her own personal
information from the web based console is bundled with the product. The Administrator can give
controlled access to users for updating their personal contact details by themselves which may
include available attributes present in the Active Directory like given name, sAM Account name etc.,
as well as custom Attributes based on LDAP attribute value as employeeid etc.,
The Admin Function of ADSelfService Plus allows the users with privileges to General Attributes,
Exchange Attributes, Account Attributes, Terminal Attributes and Custom Attributes. The end user can
have one or more of these privileges to be modified by himself as it is delegated by the Administrator.
The Following Sections will help you get familiar with the product:
Getting Started: Provides you the details of system requirements, product installation and startup
.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Self-Service Features
ADSelfService Plus offers the end-users with four Self-Service features: Self-Password Reset, SelfAccount Unlock, Change Password & Self-Update.


Self-Password Reset: The highlight of this application which ensures that the helpdesk
officials no longer attend to password reset calls.



Self-Account Unlock: Allows the end-users to self-unlock their locked down accounts.



Change Password: Grants end-users the permission to change their logon passwords.



Self-Update: Allows the end-users to self-update their profile.

Other Add-On Features:


Employee Search: Provides the end-users with the facility of performing quick search for
fellow employees (along with Organizational Chart)



Password Notification: Notify the end-users about their expiring passwords so that they can
change it.

The services offered by ADSelfService Plus can be split into two categories:


Enrollment Requiring Services



Non-Enrollment Services

Enrollment Requiring Services:
A user has to enroll with ADSelfService Plus in order to avail himself of the 'Self-Password Reset' &
'Self-Account Unlock' features.
Non-Enrollment Services:
These services do not require 'User Enrollment'.
The various services that fall under this category are:
 Change Password


Self-Update



Employee Search



Password Notification

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Getting Started
The following sections describes how to get started with ADSelfService Plus.
 System Requirements


Installing ADSelfService Plus



Working with ADSelfService Plus



Licensing of ADSelfService Plus

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

System Requirements for ADSelfService Plus


Hardware Requirements



Software Requirements

Hardware Requirements
Hardware
Processor
RAM
Disk Space

Recommended
P4 - 1.0 GHz
512 MB
1 GB

Software Requirements
Supported Platforms
ManageEngine ADSelfService Plus supports the following Microsoft Windows operating system
versions:
 Windows Server 2000


Windows Server 2003



Windows Server 2008



Windows Server 2008 R2



Windows Server 2012



Windows XP



Windows Vista



Windows 7



Windows 8

Supported Browsers
ManageEngine ADSelfService Plus requires one of the following browsers to be installed in the
system for working with the client.


Internet Explorer 5.5 and above



Netscape 7.0 and above



Mozilla 1.5 and above



Firefox 1.5 and above

Preferred screen resolution 1024 x 768 pixels or higher.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Installing ADSelfService Plus
ManageEngine ADSelfService Plus can be installed on any machine in the domain, if the computer
meets the desired system requirements for the installation of ADSelfService Plus.
To install ManageEngine ADSelfService Plus,


Download the executable from the website http://www.adselfserviceplus.com.



Click on the Downloaded file "ManageEngine_ADSelfService_Plus.exe"



Follow the install shield wizard to complete the installation of ADSelfService Plus.

ADSelfService Plus can be run as:


An Application



A Windows Service

To run ADSelfService Plus as an Application
By Default ADSelfService Plus will be installed as an application, run the self-extracting
EXE(ManageEngine_ADSelfService_Plus.exe) downloaded from the website and follow the wizard to
completion. This will install the ADSelfService Plus application.
The application can be launched on a web browser by clicking on the Desktop Icon of ADSelfService
Plus
ADSelfService Plus runs with the privileges of the user who has logged on to the computer .
To run ADSelfService Plus as a Windows Service
To run ADSelfService Plus as a service, install ADSelfService Plus as Service. To install
ADSelfService Plus as Service.


Go to Start Menu -->>All Programs



Select "ADSelfService Plus"-->>"NT Service"



Click on "Install ADSelfService Plus as Service"

Once the "ADSelfService Plus Service" is installed you can start the product as "Windows
service".ADSelfService Plus runs with the privileges of the system account.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Working with ADSelfService Plus




Starting ADSelfService Plus
Launching ADSelfService Plus Client
Stopping ADSelfService Plus

Starting ADSelfService Plus
ADSelfService Plus can be started either in the system account (when run as service) or in user
account (when run as application).
When ADSelfService Plus is installed as a Service




Option to install ADSelfService Plus as a service is available in the installation wizard.
To start ADSelfService Plus in the system account, select Start --> Programs -->
ADSelfService Plus--> Start ADSelfService Plus
To start ADSelfService Plus in the user account, double-click the ADSelfService Plus desktop
icon.

When ADSelfService Plus is not installed as a Service
In this case, ADSelfService Plus can only be started in the user account. To start the product, select
Start --> Programs --> ADSelfService Plus --> Start ADSelfService Plus
On starting the ADSelfService Plus, the client is automatically launched in the default browser.
When ADSelfService Plus is started in Windows XP / Windows 2003 machines with firewall enabled,
Windows may pop up security alerts asking whether to block or unblock the following programs as
shown in the images below:



mysqld-nt - Database server.
Java(TM) 2 Platform Standard Edition binary - Java.

You should Unblock these programs to start ADSelfService Plus

Fig: MySQL Alert

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Fig: Java Alert
Launching ADSelfService Plus Client
To launch the ADSelfService Plus client, open a Web browser and type http://hostname:8888 in the
address bar. Here the hostname refers to the DNS name of the machine where ADSelfService Plus is
running.
Specify the user name and password as admin (for first time users) in the respective fields and click
Login. If you have changed the password, you should use the changed password to login.
Stopping ADSelfService Plus
To stop ADSelfService Plus, select Start --> Programs --> ADSelfService Plus--> Stop ADSelfService
Plus

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Licensing
ADSelfService Plus is available in 3 editions - Free, Standard and Professional Editions.
The Free, Standard and Professional Edition, all come packaged as a single download. During the
evaluation phase, the Professional Edition is installed and can be evaluated for 30 days. After 30
days, it is automatically converted to the Free Edition, unless the Standard or Professional Edition
license is purchased.
For purchasing the license or any queries, please contact sales@manageengine.com.The license file
will be sent through e-mail.
To upgrade from a Trial Edition or Free Edition to Standard or Professional Edition
1. Click the License link available in the top right corner of the ADSelfService Plus client. This
opens the License details of the product.
2. Click the Upgrade Now link and select the license file received from ZOHO Corp using the
Browse button.
3. Click Upgrade button to upgrade from Trial or Free Edition to Standard or Professional
Edition.
Trial Version of ADSelfService Plus


The Trial edition of ADSelfService Plus provides access to 50 users to be enrolled with
ADSelfService Plus.



The 50 users will be able to have complete functionality the trial version is valid for a period of
30 days after which it becomes a free edition.



During the evaluation period ADSelfService Plus will provide mail and phone support.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Domain Configuration
Using the 'Domain Settings' feature,you can configure 'New Domains' as well as 'Revamp' various
settings of the 'Existing Domain(s)'.
During startup,ADSelfService Plus adds all the domains that could be discovered.If you wish to 'add
more domains' (or) incase of 'domains not being discovered',you would have to 'add them manually'
with the help of this feature.
Steps To Be Followed Inorder 'To Add A Domain' Using The 'Domain Settings' Feature:
1 Click on the 'Domain Settings' tab (available on the top right corner of the application)
2 To add a 'New Domain',click on the 'Click here to add a new domain' button
3 The 'Add Domain Details' pop-up box appears on screen
4 In the 'Add Domain Details' pop-up box,you would have to specify the various 'Domain Details'
'Adding A Domain' is a three-step process:
1. Provide the 'Domain Name'
2. Specify the 'Domain Controller(s)'
Adding Domain Controllers:
To add 'Domain Controllers',click on the 'Discover' button which is available in the 'Add
Domain Details' pop-up box.


Select the 'domain controller' from the list of available choices(which are discovered from
the DNS)

In case of 'Domain Controller not being found' ('Domain Controller(s) cannot be
discovered.Please specify the Domain Controller(s) below' message will be displayed)


You would have to add the 'Domain Controller' manually (specify the 'Domain Controller
Name' in the respective textbox provided)

Click on 'ADD' to add the 'Domain Controller'.
3. Follow it up with the 'Domain Username & Password'
4. Authentication:
When a user is included in the 'Domain Admin' group,then he/she will be given the rights to
'Query the Active Directory' & 'Perform Various Self-Service Operations' in ADSelfService
Plus.The users who are not included in the 'Domain Admin' group, require the following
'Permission(s)' to perform the corrosponding actions.
1 To perform the 'Reset Password' action,a user should have 'Reset Password' permission
2 To perform the 'Unlock Account' action, a user should have 'Read & Write LockOut time '
permission
3 To perform the 'Self Update' action, a user should have 'Read & Write' permission for the
corresponding attributes
4 To install GINA client software,a user should belong to 'Domain Admin' group.
5 Click on 'ADD' to add the 'Newly Configured Domain'

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Various Actions That Can Be Performed On The 'Configured Domains':
Make It Default Option:
Clicking on this option would make that particular domain as the 'Default Domain' in the Domain User
Login Page( of the ADSelfService Plus application).
Edit Domain Details Option:
To 'Reconfigure the existing domain details',click on the 'Edit Domain Details Option'.You can bring
about the changes through the 'Edit Domain Details' pop-up box (which appears on clicking the 'Edit'
icon)
Update Domain Objects Option:
Clicking on this option would update the 'Domain Objects' of that particular domain.This 'Update
Action' brings about synchronization between ADSelfService Plus & the Active Directory(in case of a
lag existing between the two).
'Update Details Of XYZ Domain' dialog box would appear when you click on the 'Update Domain
Objects' icon.
You can update the 'Domain Objects' with respect to the fields - present in the 'Update Domain
Objects' pop-up box - that are mentioned below:






Exchange Servers & Domain Policies
Organizational Units(OUs)
Groups
Users
Computers

Select the 'Desired Options' and click on 'OK'.The 'Domain Objects' would get updated.
Delete Domain Option:
To delete a 'domain from the available list',click on the 'Delete Domain Option' of that respective
domain.
Other Attributes Of The Domain Settings Layout:
Domain Display Name:
This is the 'Name of the Domain' given by you for 'display purpose'.It has no connection to the
'Configured Domain Name'.It's sole purpose is to 'display the domain name' - on the User Logon Page
- in a way which would be 'easy for the user to comprehend'.
Status:
This 'Status' feature sheds light on the 'Rights Associated with the Users of a Domain'.
A 'Success' status indicates that the Domain Users have the 'Admin' privilege.
'The User/System has no Admin Privilege' status would be displayed incase of 'Domain Users' not
being granted with the 'Admin' rights.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Rolling out ADSelfService Plus
ADSelfServide Plus has a plethora of services to offer to its users.Of the many services that it
has,the ones that hog the limelight are:


Self-Service Options (Password Reset,Account Unlock,Self-Update & Change Password)



Employee Search



Password Expiry Notification

This part of the guide deals with the mechanism involved in deploying the above mentioned features.

Deploying The Features: ( General Info)

Self-Service Options: A very easy task.All you have to do is select the features that you want to
provide to a particular domain (or OU).Give a name to this setting (policy) & save it.
Read Policy Configuration for further details
Employee Search: Enable the Employee Search feature (under the Configuration tab) to scout for
fellow employees.
For more info, read on Employee Search
Password Expiry Notification: Select this feature (under the Configuration tab) to notify users about
their expiring passwords.
For more info, reaad on Password Expiry Notification

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Password Self-Service Deployment
Learn how to implement the Password Resettask onto end-users.
Requirements For Deploying The Password Self-Service Task:
1 Install & Register Your Click on " Domain Configuration " for further details.
Domains
2 Self-Service Policy
Click on Policy Configuration ' for further details.
Configuration:
Tell ADSelfService
Plus what self-service
feature should be
made available to a
domain (or OU).
Very simple! Just
enable the feature you
want to award to a
domain (or OU), give a
name to this setting
(policy) and save it.
That’s it!
3 Configure Identity
For More Details: Click on 'Identity Verification '
Verification Info and its
depth
* Determine how users
of this policy should
authenticate
themselves while
requesting for
password self-service.
Eg: Whether user
should answer
Security question, or
enter verification code,
or do both to establish
identity.
* Decide the depth of
users’
Note: This setting will be applied uniformly to the entire domain or OU as covered by
authentication info
the self-service policy. You can set separate Identity Verification settings for every
Eg: Configure details self-service policy you create.
such as the number of
questions a user
should answer, length
of the answer, etc.
4 Password Reset
ADSelfService Plus offers 3 modes.
Modality:
 Via A Web Portal
Determine the mode
 Gina/CP
through which users of
 Gina Free
a selected domain or Click on Password Reset Modality for further details.
OU should reset their
passwords.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

5 Configure AD Self
Configuring a "Self Update" layout
Update portal:
Why a customized layout is better than the default? What is the advantage of a
If you had enabled
customized layout?
“Self
The layout that we provide is very basic. On the other hand, when you customize it,
Update” for a
you have the full potential to make the user update directory info just as you desired!
domain or OU, then it For more details follow the link "Configuring Self Update Layout".
would do good to
choose a layout
through which users
can update their
information. If you
don’t choose,
the default layout
would be assigned.
6 Post-Installation
Security Settings
Click on " Security Settings " for further details
Make use of the
security settings
offered by
ADSelfService Plus
and reinforce your
password self-service
implementation against
any threats.
7 Publish ADSelfService The url would follow the naming pattern mentioned below:
Plus Web Port
http://servername:port
Make ADSelfService
Plus accessible to the
end-users.
8 Enrollment Invitation & Enrollment Notification
Product Adoption
Auto Enrollment
Now, tell the users
External Data Source
about ADSelfService Enrollment Reminder
Plus. Send a mail right Click on Enrollment & Invitation for further details
from ADSelfService
Plus!
Ask them to enroll for
password self-service.
Or rather MAKE them
enroll! Check out your
options on the right!

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Policy Configuration:
ADSelfService Plus offers 4 self-service functions to domain users: ability to self reset passwords, self
unlock account, self update information into Active Directory and change password. As an
administrator, you can decide whether users of a domain or selected organizations unit(s) (OU) will
avail themselves of any or all of these functions. In other words, you set a "self-service policy" for the
users and define the extent they can use ADSelfService Plus.
The "Policy Configuration" tab provides all the functionalities for you to define/edit/delete policies.
ADSelfService Plus allows you to define any number of "self-service policies" in a given domain,
provided there is no OU duplication in the policies; that is, an OU which is already a part of a policy
cannot be subjected to another policy.
By default, ADSelfService Plus sets a policy for the entire domain, when it discovers DCs of a
domain. Thus when you log in for the first time (as an administrator) this default policy will be shown
to you. Conventionally, every self-service feature is selected. If it fits your requirement, you can retain
it; else, you can edit it.
Click on ‘Steps To Create A Policy ’ for further details.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Identity Verification
ADSelfService Plus screens for privileged users (aka enrolled users) via an authentication method by
name Identity Verification.
Privileged users of this application have the rights to perform the self-password reset & self-account
unlock operations.
Identity Verification has two modes:
 Security Ques & Ans
 Verification Code
Security Ques & Ans: Authenticate users by forcing them to answer to a set of security questions.
Verification Code:Authenticate users by forcing them to reproduce a code sent by ADSelfService
Plus.
You can send the Verification Code to:



E-mail address of the user
Mobile number of the user

Choose the option that suits your requirement.
Note:
I You are provided with the rights to configure both modes of Identity Verification simultaneously.
II The details that a user provides via Security Ques & Ans should match his/her enrollment
information, only then he/she would be granted the rights to access the privilege services.
Click on 'Steps Involved In Configuring Identity Verification' for further details.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Enrollment & Invitation
ADSelfService Plus allows you to perform the task of ‘inviting’ & ‘enrolling’ in unison.
It offers you with a feature known as ‘Enrollment Notification’ using which you can perform the above
mentioned task.
Enrollment Notification:
ADSelfService Plus allows you to send automated mails to the users requesting them to enroll with
this application. These notification mails that you send would contain a link that directs the end-users
to the logon page of this application, thus enticing them to enroll.
Click on Enrollment Notification for further details.
Enrollment:
ADSelfService Plus provides you with following methods for enrolling users:




Identity Verification
Auto Enrollment
External Data Sources

Identity Verification:
It is a simple process. There are two ways to bring about Enrollment via this process.
Security Question & Answer: Configure a set of security questions that will be put forth to the endusers. Users can get themselves enrolled by answering to these security questions.
Verification Code: Send a code to the end-user’s mobile/e-mail address. Enrollment happens when
users reproduce this verification code.
Read Identity Verification for further details.
Auto Enrollment:
This process is employed in the case of ‘bulk-user enrollment’, since it becomes a tedious task to
configure the Security Questions (or) the Verification Code for each & every user when the number is
more.
Auto Enrollment allows the admin to ‘feed the system’ with the ‘data to build user profiles’. Thus the
enrollment data of all the domain users can be built in a few minutes.
Read ‘Auto Enrollment’ for further details.
External Data Sources:
\Another way of bulk user enrollment. Using this method, you can enroll users by connecting to other
databases & importing their enrollment details.
Read External Data Sources for further details.
Enrollment Reminder:
As the name suggests, this feature helps you to display a reminder to end-users incase they haven't
heeded to the notification mails. This reminder is brought about via a ‘Logon Script’ which pops up
automatically when a non-enrolled user logs onto the machine.
Read Enrollment Reminder for further details.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Security Settings: (Features Under Advance Tab)
Once you configure a policy, the next step would be to secure the user accounts of that policy by
enforcing the security features available under the Advanced tab(available to you on successfully
completing the Policy Configuration process)
Under the Advance tab, you are provided with the following options using which you can enhance the
security of the end-user account.


Block User



Reset & Unlock



Question & Answer Settings



Enrollment



Notification



General

 Automation
Click on Advanced Policy Configuration Options for further details.
For more details on Security Options in ADSelfService Plus - Check the Security Center.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Taking The Features To The End-Users
Preparing The Features
This is a part of the policy configuration process - preparing the features that you desire to implement
onto the end-users.
Since ADSelfService Plus is an entirely customizable application,you have the choice of selecting the
features from the 'default list' that
ADSelfService Plus has to offer.
By default,ADSelfService Plus provides you with the following features:


Password Reset / Account Unlock



Self-Update



Change Password

You have the choice of selecting all the above mentioned features (or) can go for specific feature
selection.
Feature Selection:
A very simple task! All you have to do is enable the feature that you wish to provide to the end-users
while carrying out the Policy Configuration process.
Methodology Involved In Preparing The Features
Read Password Reset/Account Unlock for further details
Read on Self-Update for further details
Read Change Password for further details.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Implementing Password Reset/ Account Unlock process:
The privilege services â€“ Password Reset & Account Unlock â€“ of ADSelfService Plus can be
implemented onto the end-users in the following ways:




Via a Web Portal
Via Gina/CP
Via Gina Free

Via A Web Portal:
Allow users to perform the password reset/account unlock operation by accessing ADSelfService Plus
via a web portal.
Via Gina/CP:
Let the users to perform password reset/account unlock operation by accessing ADSelfService from
the logon prompt of their respective systems.
Requisite: Installation of Gina/CP on the user machines.
For further info, read Gina/CP Installation
Via Gina Free:
Similar to Gina/CP method, that is, lets user to perform password reset/account unlock operation from
their respective systems. Unlike Gina/CP, this method does not require Gina installation onto the user
systems.
For further info, read on Gina Free.
Password Reset / Account Unlock Task:
For all the above mentioned methods, the methodology involved in performing 'password
reset/account unlock' task is the same - that is - Identity Verification.
Read Identity Verification for further details.
Note:
Once the user logs into ADSelfService Plus, he can reset password (or) unlock his account by clicking
on the respective button & responding to a series of steps laid down by ADSelfService Plus.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Implementing Self-Update Feature
Imposing the Self-Update feature onto the end-users can be done as follows:
To begin with, you would have to select the Self-Update option while performing Policy Configuration.
As aforementioned, ADSelfService Plus lets you to customize its features.

Customizing Self-Update:
Decide the fields that you wish to provide to the users. Select them & save the new self-update layout.
Highlights:


Lets you configure new fields as per your specifications



Allows you to declare important fields (like address, phone no) as mandatory for users



Facilitates easy updation of data for users by allowing you to configure drop-down boxes,
check boxes & radio buttons



Assists you in setting up help cards - for better understanding of user â€“ beside substantial
fields

Click on Steps to configure Self-Update for further details.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Implementing Change Password Feature
Enforcing the Change Password feature onto the users can be done as follows:


Select the Change Password option while performing the Policy Configuration process.



By doing so, you provide users - of the specified policy â€“ the rights to change their logon
passwords whenever desired.



Finally, click on Save to store the configured policy.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Employee Search Deployment
Learn how to implement the employee search feature onto the end-users.
Steps Involved: (At A Glance)


Domain Selection: Select the domains (or OUs) on which this feature is to be implemented.



Search Specifications: Specify what exactly you are searching for.

Available Options:


Users (To search for Users)



Contacts (To search for Contacts)



Groups (To search for Groups)

Enable the options that you desire.
You have the right to select all three options simultaneously.



Refining The Search Process: Select the elements which will aid the user to narrow down
the scope of the search operation.
Example: "Full Name", "E-mail address" & "Telephone Number" of a user



Configuring The Layout: Decide the fields that would appear when the user carries out the
search operation.

Click on Steps to Configure Employee Search for further details.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Password Notification Deployment
Learn how to deploy the "password notification" feature onto the end-users.
Steps Involved: (At A Glance)


Domain Selection: Select the domains (or OUs) on which this feature is to be implemented.



Specify Supplementary Features like
 Notification Frequency
 Scheduling Time For Sending Notifications
 Receiving Status Mails Concerning ‘Delivery Of Notifications To Users’
 Mail Server Configuration (for receiving Status Mails)

Configure the feature as per your requirements & save it.
Read Steps Involved In Configuring Password Notifications for further details

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Know Your Product
This section helps you to get acquainted with various features that ADSelfService Plus has to offer.
It do so by providing you with answers to the following questions:






What are the features of this application?
How can they be implemented?
What are your rights as an administrator?
How can you ensure the safety of user accounts?
And many more.......

'Know Your Product' comprises of the following features:






Dashboard
Reports
Configuration
Admin
Support

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Dashboard
This presents an overview of "what ADSelfService Plus application is all about". It highlights each &
every important aspect of this application
The dashboard comprises of the following features:
Reports:
The dashboard is replenished with new set of reports at regular intervals.These reports provide a
comprehensive study of user actions within the ADSelfService Plus application.
The Reports listed under the Dashboard are:
 User Reports


Enrollment Reports



Audit Reports

User Reports:
These are reports that focus on the 'status of the user account'.It puts light on the issue of
'Account Lockout' & 'Password Expiry'.
The various reports available under this category are:


Locked Out Users Report



Soon-to-expire User Password Report



Password Expired Users Report

Enrollment Reports:
As the name suggests,these reports - besides providing information on the enrolled users focus on the various features that accompany the 'Enrollment' process of this application.
It lists the following reports:


Non-Enrolled Users Report



Enrolled Users Report

Audit Reports:
The Audit reports provide an account of the 'user actions within this application' which serve
for the auditing purpose.
The reports listed under this category are:


Reset Password Audit Report



Unlock Account Audit Report



Self-Update Audit Report



Failed Attempts At Security Questions Report



Change Password Audit Report

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Click on 'Reports' for further details.
Highlights Of The ADSelfService Plus Application:
Besides providing you with "reports", the dashboard offers you with 'links to the services' that this
application has to offer.
The dashboard provides you with links to the following features:


Self-Service Features (Password Reset, Account Unlock, Self-Update & Change Password)



Identity Verification (User Authentication Process)



Add On Features (Employee Search & Password Expiry Notification)



Gina ( Installation, Customization & Scheduling)
Dashboard provides you with information on all the domains that are configured in the
ADSelfService Plus application.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Reports
The ADSelfService Plus feature generates several reports all of which are placed under the "Reports"
tab.
These reports are classified into three different categories:


User Reports



Audit Reports



Enrollment Reports

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

User Reports
These are reports that focus on the 'User Details' that provide you with information on the 'Status of
the User's Password & Account'.Issues like 'Locked Out Accounts','Password Expired Accounts' are
brought into light under these reports. The ultimate goal of these reports is to allow the users to
successfully carry out the Self Password Reset & Self Account Unlock operations.


Types Of User Reports.



User Reports Generation.



Other Available Options.

Types Of User Reports:
1. Locked Out Users.
2. Soon-To-Expire User Passwords.
3. Password Expired Users.
I Locked-Out Users:
This report provides a survey of those users who failed to logon owing to typing incorrect
passwords.A user's account gets locked out when he/she exceeds the "threshold set for incorrect
logins" based on the domain policy. This report helps you to identify such 'Locked Out Users'.
II Soon-To-Expire User Passwords:
"Soon-To-Expire User Passwords" report puts light on the list of users whose passwords are "about to
expire" in a few days. This report helps you to take "proactive measures" while dealing with the
"expiry of the user's password" issue.
III Password-Expired Users:
A user's password expires after a certain period of time due to the regulations imposed by the
'Domain Policy' onto the user's 'password settings' process. This report contains the list of such
password expired users.
User Reports Generation:
1. Select "Reports" tab (Reports --> User Reports)
2. Select the "Desired Domain" from the drop down box
3. For "OU" based selection, click on "ADD OUs" link (Select the "Desired OUs" & click "ok")
4. In the case of 'Soon -To-Expire User Password' reports, specify the "Number of Days" in
which the 'User's Password is Going to Expire'
5. Click on "Generate" button.
The 'Specified List of Users' would be generated.
You can re-frame the Report Layout Template - By clicking on Add/Remove Columns link
(to add or remove columns)

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Other Available Options:


Quick Search.



Export & Printable.

Quick Search:
As the name suggests,this option is used to perform 'Quick Search' for users (by using their names)
instead of executing the tedious task of going through the entire user list.
Export & Printable:
Using this 'Export' option, you can export the 'list of users in bulk' in various formats like
'CSV,HTML,PDF & XLS'.This process is usually carried out for auditing purposes,while the 'Printable'
option is used to view the printable version of the 'list of users'.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Enrollment Reports
These are reports that are concerned with the 'Enrollment of the Users'.The 'Enrollment Reports' are
classified into three different categories. These reports help you to bring about 'effective enrollment of
end-users' by providing you with information about the 'non-enrolled users'
 Types Of Enrollment Reports.


Enrollment Report Generation.



Other Available Options.

Types Of Enrollment Reports:
1. Enrolled Users Report.
2. Non-Enrolled Users Report.
3. Licensed Users Report.
4. Security Ques & Ans Report.
I Enrolled Users Report:
This report provides you with the list of users who have enrolled themselves by undertaking the
'Identity Verification' process (Security Q & A (or) Authentication via E-mail/SMS).The 'Enrolled Users'
are provided with the rights to the 'Reset/Unlock' self-service feature.
II Non-Enrolled Users Report:
The Non-Enrolled Users’ report highlights the list of users who are yet to enroll with the
ADSelfService Plus application (users who have not undertaken the 'Identity Verification'
feature).These users are not provided with the rights to the 'Reset/Unlock' self-service feature.
III Licensed Users Report:
This report lists the users who have been allotted with the licenses provided by the ADSelfService
Plus application. The information provided by this report is helpful for the 'effective management of the
users licenses'.
This report keeps track of the 'Licenses-In-Use' in the form of the 'License Count Feature'.It provides
various statistics - regarding license - like the 'Total,Used & Free' licenses.
Users who are taken into consideration for the 'License Count' feature are 'Enrolled Users','NonEnrolled Users'(users who have logged into the application but are yet to enroll) & the 'Technicians'
It also provides you with the option of 'Deleting Users'(who no longer are in need of the license) from
the 'Licensed Users List'.This process is accomplished by generating the 'Inactive Users List' &
'deleting their licenses' with the help of the 'Restrict Users' feature.
You can also 'Filter Out The List Of Licensed Users'(Enrolled/Non-Enrolled/Technician) using the
'Filter' option.
IV Security Ques & Ans Report:
This report generates the list of enrolled users along with their respective security question(s) &
answer(s).It helps you to keep track of the details provided by the users via the 'security que & ans'
process.
The information provided by these reports serve for assisting the helpdesk officials and also for
auditing purposes.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Enrollment Report Generation:
1. Select the "Reports" tab (Reports --> Enrollment Reports)
2. Select the "Domain" from the drop down box
3. For "OU" based selection, click on "ADD OUs" link (Select the "Desired OUs" & click "ok")
4. Click on "Generate" button.
The "Specified List Of Users" would be generated
Other Available Options:


Quick Search



Export & Printable

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Audit Reports
Under this tab,you would find a plethora of reports that centralize on the 'Self-Service operations
carried out by the end-users'.
Besides auditing the self-service operations,these reports provide you with an account of various
'Notification Deliveries' & the 'Security Que & Ans' process.
It lists the following reports:
1. Self-Service Audit Reports.
2. Notification Delivery Reports.
3. Failed Attempts At Security Questions Report.
4. Audit Report Generation.
Self-Service Audit Reports:
As the name suggests,these are reports that generate the list of users who availed themselves of the
'self-service features'(Reset Password,Account Unlock,Self-Update & Change Password) over a
specified period of time.
Notification Delivery Reports:
These reports focus on the 'Delivery Status' of the various notifications that this application has to
offer.
The notifications offered by this application are:


Enrollment Notification



Password Expiry Notification



Notifications Sent On Execution Of Self-Service Operations

As mentioned earlier,you have to specify the time period for generating these Notification Delivery
reports.
Failed Attempts At Security Questions Report:
This report provides you with the account of the 'number of unsuccessful attempts' produced by the
end-users while undertaking the 'Security Que & Ans' process.Again,you would have to specify the
time period for generating these reports.
Audit Report Generation:
1. Select the 'Reports' tab ( Reports --> Audit Reports)
2. Specify the 'Start Date'
3. Follow it up with the End Date'
4. Click on 'Generate'

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Configuration
The 'Configuration' tab allows you to configure the various services - of the ADSelfService Plus
application - that you wish to provide to the end-users.
The Configuration tab is further classified into three different fields:


Self-Service



Administrative Tools &



Security Center

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Self-Service
The "Self-Service" section of allows an administrator to configure all features that ADSelfService Plus
has to offer. This includes
1. Self Service features delegated to end-users like Password Reset, Account Unlock, Self
Update Active Directory and Change Password.
2. Email Notification features that allow administrators to alert users of Password Expiry.
3. Employee Search capabilities.
The below links provide detailed walk-through on how to configure various features that
ADSelfService Plus has to offer.
1. Configuring Self Service Policies




Configuring Identity verification techniques.
Security Questions and Answers.
Email and SMS Verification codes.

2. Configuring Password Expiry Notification.
3. Configuring Employee Search.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Policy Configuration
ADSelfService Plus offers 4 self-service features to domain users:
1. Self Reset Passwords.
2. Self Unlock Accounts.
3. Update Personal Info / Self Update of AD Accounts.
4. Change Passwords.
As an administrator, you can decide whether users of a domain or selected organizations unit(s) (OU)
will avail themselves of any or all of these functions. In other words, you set a "self-service policy" for
the users and define the extent they can use ADSelfService Plus.
The "Policy Configuration" section provides all the functionalities for you to define/edit/delete policies.
To Configure a Self Service Policy
By default, ADSelfService Plus sets a policy for the entire domain, when it discovers DCs of a
domain. Thus when you log in for the first time (as an administrator) this default policy will be shown
to you. Conventionally, every self-service feature is selected. If it fits your requirement, you can retain
it; else, you can edit it. Furthermore, you can configure the 4 self-service features too.
1. Click on the "Configuration" Tab.
2. Enter a Policy Name in the Text box provided.
3. Provide a check against one or all self service features that you wish to delegate to users.
 Reset Password
 Unlock Account
 Self Update (Change the default layout)
 Change Password
4. Click on "Select OUs" button.
5. This will "Pop-up" the list of all OUs in the configured Domains in a "Tree View" or "List View".
6. Select "Domain" from the dropdown this will list OUs in the selected Domain.
7. Provide a check against one or all OUs to select OUs for policy application.
8. Click on "OK" button.
9. Click on "Save" button this will save the configured settings.
This will allow users in the selected OUs to enjoy the Self Service features that are checked in the
policy.
ADSelfService Plus allows you to define any number of "self-service policies" in a given
domain, provided there is no OU duplication in the policies.( i.e an OU which is already a part
of a policy cannot be subjected to another policy).

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Identity Verification
The identity verification options provided by ADSelfService Plus allows you to determine what and
how end-users' authentication info (used to reset password or unlock account) should be.
1. The Identity verification techniques can be configured from the "Configuration" Tab of
ADSelfService Plus
2. Choose the Policy from the drop down.
3. You have two Tabs to choose from to configure Identity Verification techniques for your EndUsers.
4. Security Question & Answers.
5. Verification Code.
It is essential to select at-least one of the two tabs (Security Q & A (or) Verification
Code) for configuring the Identity Verification process.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Configuring Security Question and Answers
To Configure Security Question and Answers for identity verification follow the steps provided below.
This page also provides information on various options ADSelfService Plus provides for for an
administrator to configure while security questions and answers are defined.
1. Click on "Configuration" Tab -->>"Security Ques & Ans" (from the "Self-Service" section)
2. Check the "Enable Security Q & A" option (for enabling "Security Q & A" feature)
3. The "Question & Answer Settings" would get enabled
The "Question Settings" will allow you to define the following:


Number of Administrator-Defined Questions



Number of user-defined questions



Number of characters for user-defined questions

The "Answer Settings" will allow you to define the following:


Number of characters for answers

Number of Administrator-defined questions:
These are the questions that you, as an administrator, wish to ask the user during the Identity
Verification Process.


Enter the number of questions you desire to force on the users in the text box.



Click the link "Edit Questions" beside the text box to define a new question or edit an existing
one.


Adding a question: In this pop-up, just besides "Add a new question", you will find a text
box. Type in the question that you want to ask the user and then click the button "Add".



Once you are done with this, your question will be listed below.



Modifying/deleting an existing question



icon to edit a question - You can modify an existing question or create a
Click the edit
new question of your own.



icon to make a question mandatory - Making a question mandatory will
Click the star
force the user to provide an answer for this question.



Click the delete icon to delete a question - Deleting a question here will remove the
question from the end-users selection list while enrollment. In other words, mandatory
question does not give the user the freedom to choose from a set of questions; instead he
has to answer what he is asked.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Number of user-defined questions:
User-defined questions are questions that users will set themselves during enrollment process. You
can set a number limit on this.
Number of characters for user-defined questions:
Through this option, you can set the limit on number of characters for user-defined questions. Enter
the minimum and maximum values.
Number of characters for answers:
Set limits for an 'answer the user can give' during enrollment process. Enter minimum and maximum
values as desired.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Verification Codes
Identity Verification codes provide additional security, when Users Reset their Password / Unlock
Locked out accounts. The identity of a user is verified through verification codes sent as a notification
to the users Configured Communication Medium - "Email address" or "Mobile Number".
The selected communication medium would receive a code from ADSelfService Plus server, which
the user should reproduce in-order to establish his identity at the time of password reset / account
unlock.
 Configure Email Verification Codes


Configure Mobile Number Verification Codes



Configure both "Email" and "Mobile Number" Verification Codes


Configuration of mail server is a must for both e-mail notification & mail
notification. If not configured, then click the "click here" link to go to the "Mail
Server" configuration page.

To Configure Notification of Verification Code to a user Email address:
1. Click on the "Configuration" Tab -->>Verification Code (Under "Self Service" section)
2. Select the "Policy" for which Verification Code is to be configured.
3. Click on the "Verification Code" Tab
4. Provide a Check against Enable Verification Code and a Check against "E-mail Address"
checkbox
5. Enter the Subject in the text box provided
6. Enter the "Message".
7. Click on "Save" to Save the settings.


ADSelfService Plus stores user's email addresses in its database. The email address
is collected at the time of user enrollment.



The existing message can be modified to provide any user defined message.



%username% is a custom attribute used to send a customized message to the enduser. You can also provide other LDAP attributes to address a user %givenName%,
%sn%, %initials%, %displayName%, %userPrincipalName%,
%sAMAccountName%, %mail%, %distinguishedName% or any other naming format.



%confirmCode% is the Custom Attribute for the code generated by ADSelfService
Plus at the time of notification. We recommend not to modify the attribute when
editing the message.

To Configure Notification of Verification Code to a user Mobile Number:
1. Click on the "Configuration" Tab -->>Verification Code (Under "Self Service" section)
2. Select the "Policy" for which Verification Code is to be configured.
3. Click on the "Verification Code" Tab
4. Provide a Check against Enable Verification Code and a Check against "Mobile Number"
checkbox
5. Enter the "Message" in the text box provided.
6. Click on "Save" to Save the settings.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide



ADSelfService Plus stores user's mobile numbers in Active Directory's "otherMobile"
attribute.



%confirmCode% is the Custom Attribute for the code generated by ADSelfService
Plus at the time of notification. We recommend not to modify the attribute when
editing the message.



Click on the "Macros" link to view supported LDAP and Custom Attributes when
sending Notification to a mobile numbers.

Configure both "Email" and "Mobile Number" Verification Codes
When you check both "Email" and "Mobile Number" check boxes. The user is provided a choice of
medium to get notified of the confirmation / verification code.
1. Click on the "Configuration" Tab -->>Verification Code (Under "Self Service" section)
2. Select the "Policy" for which Verification Code is to be configured.
3. Click on the "Verification Code" Tab
4. Provide a Check against Enable Verification Code and a Check against "Mobile Number" and
"E-mail Address" checkboxes.
5. Enter the Message.
6. Click on "Save" to Save the settings.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Advanced Configuration
The Advanced configuration options in ADSelfService Plus provides additional features for an
administrator. These features enhances the security of enrolled users and also allows the
administrator to have better control over users who access self service features.
The Advanced Policy Configurations enhances the Self Service Policy.
To configure Advanced features in a Self Service Policy
1. Click on "Configuration" tab -->> Self Service
2. Edit the Desired Policy
3. Click on the "Advanced" button
This will Pop-Up the Advanced Configuration options.
The various tabs available under the Advance Policy Configuration feature are listed below:


Block User



Enrollment





General
Automation
Q & A Settings



Notification



Reset & Unlock

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

BLOCK USERS
The "Block Users" feature is available as a Tab on clicking the "Advanced" configuration button
against each Self Service Policy. This Advanced option in ADSelfService Plus enhances the security
of an end-user's Active Directory account by blocking illegitimate users.
Using this feature,the administrator can block end-users from accessing the software for a defined
time interval, when they do not satisfy conditions set here (fail the "security question" authentication) .
What limits can be set to Block Users
A blocked user does not have the access to "Reset Password" or "Unlock Account" features
of this application.

Illustration: If you set the following limits


Maximum invalid attempts '3' within '5' minutes



Block user for '30' minutes

The above illustration implies - if a user fails to answer security questions 3 times in a 5-minute
interval,then he would be prevented (blocked) from using ADSelfService Plus for 30 minutes.
This feature helps to "Block Users" who


Are not enrolled with ADSelfService Plus.



Are not pertinent to the corresponding domain.



Guess security answers by using scripts.(Automated guessing attacks).

It allows an administrator to block user (s) who fail the "security question" authentication.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

RESET AND UNLOCK
The Reset & Unlock tab provides you with the following features:





Unlock Account during Password Reset
Upon Password Reset, Force Users To Change Password At Next Logon
Password Reset/Unlock Account Session Should Last For _ Mins
Enable Password Strength Analyzer

Unlock Account During Password Reset
Selecting this option would automatically unlock 'the locked-down user accounts'.This event takes
place simultaneously as the end-users perform the 'Password Reset' task.
Upon Password Reset,Force Users To Change Password At Next Logon
This option,when selected,would force the end-users to 'change their passwords' as they try to login
to ADSelfService Plus after undertaking the 'Password Reset' operation.
Password Reset/Unlock Account Session Should Last For _ Mins
You - the admin- are provided with the rights to 'configure the time period' for the 'Password
Reset/Unlock Account' sessions.
Enable Password Strength Analyzer:
As the name suggests,this option,when selected,will enable the 'Password Strength Analyzer' feature.
Password Strength Analyzer: A feature that assists the end-users to view the strength of the
password as they are configure the same. Enabling the 'Password Strength Analyzer' would bring to
light, 'a set of standards' that can be imposed onto the passwords that the end-users configure.
The various standards listed under the this feature are: Provide a check against "Enforce Password
Strength Level" to enforce desired Password Strength.





Strong
Good
Weak
Too Short
'Strong' & 'Good' are the two ideal standards that can be imposed onto the passwords that the
end-users configure..

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Q & A SETTINGS
Under the 'Q & A Settings' tab,you can configure the display settings of the 'Security Q & A'
feature,which serves for the purpose of 'User Authentication'.
The Q & A Settings tab has two sections
1. Question Settings
2. Answer Settings
Question Settings:
From the "Question Settings" section you can define the number of questions displayed to the EndUser. And also the format in which the questions are to be displayed.
Options available under the 'Question Settings' are listed below:
 Display a finite number of questions out of the Available list


Display Security Questions One by One

 Display all Security Questions
An administrator can select any of these options based on the level of security or convenience that he
likes to provide his users.

Display a finite number of questions out of the Available list:


Display _ Questions Out Of (Available list of Security Questions) at Random

With this option,you can define the number of questions to be displayed to the End-User. The
questions will be randomly selected by the application from the 'available list of security questions'
configured under Security Question and Answer Settings.
Display Security Questions One by One
Checking this option will display the security questions one by one (ie., one question per page).
Display all Security Questions
Selecting this option will display all the security questions on a single page. The questions are listed
parallel.
Display of Security Questions One by One or All in a Single Page is based on
1. 'Available list of security questions' configured under Security Question and Answer
Settings.
2. Questions selected to be displayed.

Answer Settings:
An administrator can select any of these 'Answer Settings' options based on the level of security or
convenience that he likes to provide his users.
Under the 'Answer Settings' option,you are provided with the following 'Self-Explanatory' settings.
 Prevent an User From Providing The Same Answer To Multiple Questions.


Prevent an User From Using any Word of a Question in his Answers.



Verify whether the Security Question (s) are Case Sensitive.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Other Settings for Securing The User-Account:
In addition to various "Answer Settings" features, ADSelfService Plus also provides other settings that
aid in securing an User account by not letting the security answers be compromised.
 Store Security Answers Using Reversible Encryption.


Hide Security Answers During Reset / Unlock Operations.

Store Security Answers Using Reversible Encryption:
When an administrator checks this option, the answers provided by End-Users to validate Security
Questions at Enrollment are stored in the product database using a Reversible Encryption. This
information can be viewed as a report "Security Questions and Answers Report".




By default answers are stored using irreversible encryption. The administrator can
view the questions Enrolled but answers will remain encrypted in the report.
Only the Answers of users who Enroll after this option is checked can be viewed.
Only Security answers can be viewed and ADSelfService Plus does not show endusers passwords.

Hide Security Answers During Reset / Unlock Operations:
When an administrator checks this option, Answers to Security Questions are hidden to the End-users
when they use the application to attempt a Password Reset / Account Unlock operation.


This lets a user reset his password even when a colleague is besides him.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

ENROLLMENT
The check boxes available under Enrollment Tab are advanced configuration options of
ADSelfService Plus during and after User Enrollment.
This feature presents two check boxes::
1. Force Users to Enroll.
2. Hide "Enrollment" tab from end-users page once they enrolled.
Force Users to Enroll
This feature allows an administrator to make enrollment mandatory for End-users. In other
words,whenever a non-enrolled user logs into ADSelfService Plus. A message which 'prompts the
user to enroll' will be displayed.
Once the user enrolls himself with ADSelfService Plus ,he would be granted with the rights to access
other features of this application.
Hide "Enrollment" tab from end-users page once they enrolled
This feature will prevent users from modifying the security questions. Prominently used in a scenario
where an administrator "Auto Enrolls" users with pre-configured security Question and Answers. He
denies users the privileges to change Security Question and Answers.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Notification
The feature allows you to send acknowledgements to users, once they manage to successfully reset
or change password or unlock account.
How to use:
1. Click on the desired tab : Reset Password (or) Unlock Account (or) Change Password
2. Check the "Enable" check box. You will be able to enter text into the "subject" and "message"
fields
3. Type in the desired acknowledgement & click "OK" to save them.


Configuration of a mail server/modem is a must in order to access this service. If not
configured , click the "click here" link available in this feature.



Messages provided in the text boxes can be modified as desired. Users can be send
a notification by addressing them with any of the listed LDAP attributes. This list
can be viewed on clicking on the "Macros" link.
 %givenName%,
 %sn%,
 %initials%,
 %displayName%,
 %userPrincipalName%,
 %sAMAccountName%,
 %mail%,
 %distinguishedName%

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

GENERAL
Under the General tab,you are provided with the following options:


Hide CAPTCHA (Word Verification Image) Checkbox



Hide Personalize tab from End-Users Page Checkbox

Hide CAPTCHA (Word Verification Image)
As the name suggests,by enabling this checkbox,you can hide the CAPTCHA feature from the
following pages:


Verification Code Page



Reset Password & Unlock Account Page



Security Question(s) Page

The above mentioned options come into focus when you enable the 'Hide CAPTCHA' checkbox..
You - as the administrator - are provided with the option of 'selecting the pages' from which
the 'CAPTCHA' feature would be removed.

Hide Personalize tab from End-Users Page:
By enabling this checkbox,you can hide the 'Personalize' tab from the end-user page.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Automatic Rest and Unlock
The "Automation" tab provides you with the following features:
1. Automatic Reset & Unlock
2. Run Custom Script Upon Successful Password Reset/Change
3. Update Reset Passwords and Account Unlock status on all Domain Controllers
Automatic Reset & Unlock:
The Automatic Reset & Unlock feature provides three options to choose from. You can either choose
one or all of the options provided here.
 Automatically Reset Domain Users' Passwords When They Expire
 Automatically Unlock Locked-Down Accounts In Your Domain
 Text/Mail Auto Generated Password to End-User
Automatically Reset Domain Users' Passwords When They Expire
Choosing this option will bring into focus several other underlying options which assist you(admin) to
create a scheduler to automatically 'reset the passwords' of the end-users'
Steps Involved In Resetting A Domain User's Password :
1. Enable the "Automatically resets domain users' passwords when they expire" checkbox.
2. Select the type of "Password Reset Scheduler" from the available options.
3. The available options are : DAILY, WEEKLY, MONTHLY, HOURLY
Choose the option that suits your requirement.
Click 'Password Reset Scheduler Features' to view the configuration of the above mentioned
options..
4. Set the "Reset The Password To" an entity that will serve as the "New Password"
5. Click on "OK" to save the settings
Password Reset Scheduler Features:
Daily - using this option, a user's password can be reset on "daily basis".You (admin) would have to
mention the "time"(using the AT drop-down box) at which this password reset process will take place.
The "new password" which is to be assigned to the user should be specified in the "Reset The
Password To" textbox. The usual practice is to reset the password to the user's logon name.
Weekly - This feature provides you the option of resetting the user's password on "weekly basis".You
have to 'choose the day' at which the password would be reset.
As mentioned above,the 'time and the new password' also have to be specified for this feature to be
deployed onto the end-users.
Monthly - To reset a user's password on monthly basis,you can use the "MONTHLY" option. Here
you have to 'specify the date at which the password would be changed,along with the time & the new
password'.
Hourly - Choosing this option would enable you (admin) to reset the user's password on "hourly
basis".The time intervals at which the password would be reset has to be specified in "Once In Every"
drop-down box. Along with this,you would have to 'specify the new password' which is going to be
assigned to the user.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Automatically Unlock Locked-Down Accounts In Your Domain
Choosing this option would automatically unlock the 'locked down user accounts'.Therefore,by
checking this option,you would prevent the user from going through the hassle of 'remembering the
date at which his/her account would get locked up'.
Steps Involved In Unlocking A User's Account In A Domain:
1. Enable the "Automatically Unlocks Locked Down Accounts In Your Domain" checkbox.
2. Select the type of "Account Unlock Scheduler" from the options available.
3. The available options as shown below:
4. DAILY, WEEKLY, MONTHLY,HOURLY
Configuring the above mentioned options involves the same steps as in configuring the "reset
password scheduler"; the only difference is that there is no need for specifying the "new
password" as you are dealing with unlocking of the user accounts.
4. Choose the appropriate fields required for the respective option chosen.
5. Click on "OK" to save the settings
Text/Mail Auto Generated Password to End-User:
You have to enable this checkbox in order to dispatch the newly created passwords ( via.
Automatically Reset Password feature) to the end-user accounts.
II Run Custom Script Upon Successful Password Reset/change:
As the name suggests,this feature,when enabled,would run a script relevant to 'successful password
reset/change operation'.
You - as the administrator - are provided with the rights to configure the Script that would be displayed
when the user 'resets/changes' his password.
III Update Reset Passwords and Account Unlock status on all Domain Controllers:
Enabling this option would update the current status of the user 'passwords & accounts' on all domain
controller machines.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Password / Account Expiry Notification
Notify End-Users of Password / Account Expiry via an email. This tab allows you to configure
Password Expiry notification for


Soon to Expire Password Users



Account Expired Users

Steps to Configure a Account Expiry / Soon-to-Expire Password Notification:
With ADSelfService Plus the administrator will be able to schedule reports for Soon to Expire
Password Users in his Domain.
In-order to Schedule Reports for Soon to Expire Password Users the administrator has to configure
settings on when the reports are to be scheduled and preset a time when the LockedOut Users report
is to be scheduled.
1. Select "Configuration" tab --->> "Self-Service" -->> "Password Expiry Notification"
2. Click on "Add New Notification"
3. Enter the "Scheduler Name" and "Description" for the schedule.
4. Select the desired Domain(s) or OU(s).
5. Enable the "Notify Enrolled Users Only"
6. Select the "Notification Type" from the Drop Down List box ( "Password Expiry Notification" or
"Account Expiry Notification")
7.
8.
9.
10.

Set the "Notification Frequency"
Daily AT - Specify time of Day
Weekly ON and AT - Specify the day of week and time of the day
On Specific Days - Multiple days can be entered.

11. 'Enter the date / day (s)' based on which the user will be notified of his/her password/account
expiry.
12. Type the "Subject" of the mail in their respective box.
13. Then type the "Mail Content" in the space provided for it.
14. Click on "Schedule Time" to specify the time at which the mail will be delivered.
15. Click on "Mail Admin The Notification Status" to enable the administrator to view the status of
notification reports.
16. Click 'Save' to store the configure settings.
Enable Password Expiry Notification:


ADSelfService will be able to send e-mail notification to all members enrolled in
ADSelfService Plus to notify them on a Soon To Expire Password.



ADSelfService Plus sends a message on password expiry notification with a preset Subject
and Message that is configured by the administrator.
While sending a password expiry notification to Domain Users. The notification message can be
changed as desired by the administrator. Also the administrator can email a user either by his
"initials", "displayName" or any of the below supported attributes.
This can be done by Replacing the variable held within the % symbol with a desired variable.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Eg: %user% can be replaced by %sn%
Also multiple instances of supported attributes in the message, is supported while notifying users.
Eg: FirstName_LastName can be specified as %initial%_%sn%
The list of LDAP attributes and Custom Attributes supported can be viewed by clicking on the
Macros link.
Supported Attributes while notifying users
{"givenName", "sn", "initials", "displayName", "userPrincipalName",
"sAMAccountName", "name", "mail", "distinguishedName" }

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Employee Search
Summary:
With the Employee Search feature, you can do the following:
1. Provide end users with an option to search and view information about themselves as well as
other domain users
2. Help yourself (administrator) to search and locate users or retrieve any information about
them
How to configure the AD search:
1. Click on "Configuration --> Self-Service --> Employee Search".
2. Select the "Enable Employee Search" checkbox
3. Select the "Domain"
1. Click on the "Add OUs" link to perform "OU based Selection"
2. Select the OU's from the Pop-Up and Click on OK
4. You would be provided with 3 tabs:
1. Users
2. Contacts
3. Groups
Employee Search is a 'criteria based search'.You enable anyone or all of the above
mentioned options.

5. Enabling the "Users/Contacts/Groups" check boxes
 Select the desired "Display Columns'
 You can 'Configure the Order' in which the Display Columns appear by clicking on the
'UP' & 'DOWN' buttons
 Configure the "Search Criteria"
 Choose the desired "Search Criteria Options"
 You can "Configure the Order" of the "Search Criteria Options" using the "Up" & "Down"
buttons
6. Select the "Enable Organization Chart" checkbox (in-order to view the "Searched Account"s
Position" in the Organizational Hierarchy)
7. Check the "Show On Login Page Also" checkbox (in-order to place the "Employee Search"
feature on the login page of this application)
8. Click on "Save" button to store the configured settings

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Administrative Tools
Under this tab, you are allowed to configure the following features:
 Quick Enrollment


Self-Update Layout



Gina (CTRL + ALT + DEL)



Technician



External Data Sources

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Quick Enrollment
As the name suggests, under this tab, you are allowed to configure various features with the help of
which the 'user enrollment process' can be brought about effectively.
The features available under this tab are:


Enrollment Notification.



Auto Enrollment.



Enrollment Reminder.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Enrollment Notification
On configuring Enrollment Notification an administration can "Notify domain users via email to enroll
with ADSelfService Plus to avail themselves of password self-service" features.
1. Click on Configuration -->>Administrative Tools -->> Quick Enrollment -->>Enrollment
Notification.
2. Select the "Domain / OU","Policies" or "Manual" from the drop-down box.
3. In the "Mail Server" textbox, the "Mail Server" that has been configured in the "Server
Settings" would be available.
 To modify the Mail Server or Configure a new server, click on the "Configure Mail Server".
4. Provide the "Subject" for the "Mail" ( Eg. Enrollment Invitation).
5. Follow it up with the "Mail Content".
6. Click on "Send Mail".
Selecting Manual will allow the administrator to send email to all users entered in the text box
provided.
(or)
Selecting Domain / OU will allow the administrator to notify via. email all the users that fall in
the selected container (Domain/OU).
(or)
Selecting the Policy will allow the administrator to notify via email to all users who are part of
the Policy.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Auto Enrollment


Auto Enrollment Through "Importing Answers" Option



Auto Enrollment Through "Import Question & Answers" Option



CSV File with Security Answers



CSV file (with Security Question and Answer)

Auto Enrollment Through "Importing Answers" Option:
1. Click on Configuration Tab --->>Administrative Tools --> Quick Enrollment -->Auto Enrollment
2. Choose the desired Policy
3. Select the 'Import Type' as 'Answer'
4. Choose the 'Security Question'
5. Click on 'Browse' and 'import the CSV file'(Format should be "SamAccountName,Answer".
View the sampleÂ CSV file for reference)
6. Enable the "Overwrite Answer, If Already Enrolled" checkbox, inorder to overwrite the existing
answer (in the case of same question)
7. Click on Enroll button.
The first line of the CSV file will be taken as the header.

Auto Enrollment Through "Import Question & Answers" Option:
1. Click on Configuration Tab --->>Administrative Tools --> Quick Enrollment -->Auto Enrollment
2. Choose the desired Policy
3. Select the 'Import type' as 'Question & Answer'
4. User gets to frame his\her own 'Question & Answer'
5. Click on browse and import the CSV file(Format should be
"SamAccountName,Question,Answer". View the sample CSV file for reference)
6. Enable the "Overwrite Answer, If Already Enrolled" checkbox,Â inorder to overwrite the
existing answer (in the case ofÂ same question)
7. Click on Enroll button.
The imported question from the CSV file, if different from the existing ones, will get added to
the Security Question list

CSV File:
It is a file via which the administrators import the user details (Security Question and Answer).During
the auto enrollment of the users, the administrator has to specify the header for these CSV files.
The first line of the CSV file will be taken as the header.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Creating A CSV File:
Creating a CSV file is a very easy task. Open any text editor, type the text and save it with the .CSV
extension.
An administrator can choose between two different types of CSV files:
CSV file (with Security Answer):
This file will contain the "Username" and "his \ her answer" to the Security Question put forth by the
administrator.
CSV file (with Security Question and Answer):
This file will contain the "Username", along with the "Security Question and Answer", which is framed
by the user himself.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Enrollment Reminder
An administrator can configure Enrollment Reminders to users in the domain, or Users who are part
of the Password Policy. Configuring Enrollment reminder allows ADSelfService Plus to Search for
non-enrolled users and associate their accounts with a Logon Script, which prompts them to enroll
whenever they log in to the network
1. Click on Configuration -->>Administrative Tools -->> Quick Enrollment -->>Enrollment
Reminder.
2. Provide a check against the "Enable Enrollment Reminder" option
3. In the "Message To Be Conveyed" textbox, specify the message for the 'Non-Enrolled Users'
4. Specify the "Server Access URL For Enrollment" - URL configured for accessing the server in the respective textbox
5. Select the 'Desired Policy (s)' (Policies to which these reminders would be sent)
6. Configure the Scheduler (in order to search for the non-enrolled users & assign their
accounts with the "Logon Script" )
7.
8.
9.
10.
11.

Options available for Scheduling are:
Daily
Weekly (specify the Day)
Monthly (specify the Date)
Hourly

Select any one of the above mentioned options
8. Select the "Time" - at which the notification would be displayed - from the drop-down list box
9. Click on "Save" to store the configured setting.
The default location for the 'Logon Script'(ADSelfService_Enroll.vbs) is the 'SYSVOL' folder.
In some cases, the 'ADSelfService_Enroll.vbs' might not be stored in the 'SYSVOL', owing to
some permission issues concerning the Domain Controller. Under such circumstances, make
sure to 'copy & paste' the 'ADSelfService_Enroll.vbs' ( located at \Bin ) onto the 'SYSVOL' folder.

Already Using A Logon Script ?
Incase of running some other logon script, you have to call CheckEnrollment.vbs ( located at
\Bin ) from your script to ensure that the script functions
the way it has been programmed.
Steps To Be Followed:
(i) If the logon script is a batch file
Add the following line at the end of your logon script
start CheckEnrollment.vbs
(ii) If the logon script is vb script
Copy the content of CheckEnrollment.vbs ( located at \Bin)
Append it at the end of your logon script

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Self-Update Layout
Customized Interface
An administrator can create self update layouts with the simple "drag & drop" approach and choose
from multiple field types for an end user to self update. The administrator can provide controlled
access to one or more of all the attributes from the available fields for an end user to self update.
By default, ADSelfService Plus sets a policy for the entire domain, when it discovers DCs of a
domain. Thus when you log in for the first time (as an administrator) this default policy will be shown
to you. Conventionally, every self-service feature is selected. If it fits your requirement, you can retain
it; else, you can edit it. Furthermore, you can configure the 4 self-service features too.
Creating a Layout
1. Click on Configuration -->>Administrative Tools -->> Self Update Layout
2. Click on "Create New Layout" Link.
3. Enter the Layout name in the text box and Click Save.
4. Click on the Drop-Down menu and select "General Attributes" or "Custom Attributes".
5. Choose any/all of the fields displayed below the selected attribute.
6. Click on any field on the left and drag & drop in to the layout page on the right.

7. Instantly a "Field Selection" popup will appear. Administrator can work on Field Customization
of the field properties.
8. Optional : Click on "Add New Group" to create new groups.
9. Click on Save.
Modifying a Layout
1. Click on Configuration -->>Administrative Tools -->> Self Update Layout
2. Click the

Modify Icon next to the desired layout.

3. To rename the "Layout" / "Group", move the mouse pointer over the layout name / group
name. Click on the Edit Icon and enter the desired layout name / group name.
4. Make your changes and Click on "Save".
5. "Successfully Saved" message is displayed. Note: The Modified Layout will be displayed
under "Available Layouts" and the changed details are listed.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Deleting a Layout
1. Click on Configuration -->>Administrative Tools -->> Self Update Layout
2. Click the

Delete Icon next to the layout to be deleted.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Field Customization
An administrator can customize the fields for the end user self update layout. Administrator can now
not only select from the various fields under General Attributes but also create custom fields under
Custom Attributes with the LDAP name of choice and choose from the various data types.



Single Line Text (Field type is suitable for character entry below 255.)



Multi Line Text (Field type is suitable for manifold character entry.)



Drop-Down Box (Field type is suitable, when an end user has to select from the available
options.)



Check Box (Field type is suitable, when an end user has to select any/all of the available
options.)



Radio Button (Field type is suitable, when an end user has to select from the available
options.)

Options
Administrator can click on the "Options" link within the field selection window and configure the
Security and Appearance of the field.

Security
The administrator can make the field entry mandatory or as a read only (administrator to fill-in the
information). Ex: Employee number.
Appearance



Initial Value: Administrator can set the initial value for the field. Ex: For mobile field the initial
value can be +91.
Help Card: Text entered acts as a tool-tip when the end user moves the mouse on the
Help Card Icon.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Attribute List
The Attributes list contains the various fields under various fields with different field types for the
broadest assortment of end user self update layout creation. With Custom Attributes, an administrator
can create custom fields and add in to the layout along with the General Attributes.
The Self Update layout configured with



General Attributes
Custom Attributes

Let us list the default fields under each attribute:
General Attributes
User Profile:

Ex:
Display name:
Enter the desired profile name to be displayed.
User logon name (pre-Windows 2000):
The name must be within 20 characters and the following characters are not allowed for usage: \ / [
] : ; | = , + * ?
@ "
Display name; Full name; Logon name; User logon name (pre-Windows 2000); Telephone number;
E-mail; Web page; Description; Office; First name; Last name; Initials; Employee Id; Employee
Number

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Contact:

Home Phone; Pager; Mobile; Fax; IP phone; Notes
Address:

Street; P.O.Box; City; State/Province; Zip/Postal Code; Country/Region
Organization:

Title; Department; Company; Manager

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Custom Attributes
Administrator can create custom fields under "Custom Attributes" along with the available fields under
"General Attributes" with the LDAP name of choice and choose from the following Data Types:





Unicode String
Integer
Boolean
Large Integer

How to create a custom field with custom attributes?
Creating a Field
1. Click on Configuration -->>Administrative Tools -->> Self Update Layout
2. Click the

Edit Icon next to the desired layout to add a custom field.

3. Select "Custom Attributes" from the "Attribute List" Drop-Down menu.
4. Enter the "Display Name" of the attribute in the Display Name box.
5. Enter the "LDAP Name" of the attribute in LDAP Name box.
6. Select the "Data Type" from the drop down menu.
7. Click on Add.
8. The custom field is displayed under Custom Attributes.
9. Click the custom field on the left and drag & drop in to the layout page on the right.

10. Instantly a "Field Selection" popup will appear. Administrator can customize the field
properties.
11. Click on Save.
Modifying a Field
1. Click on Configuration -->>Administrative Tools -->> Self Update Layout
2. Click the

Edit Icon next to the desired layout to modify a custom field.

3. Select "Custom Attributes" from the "Attribute List" Drop-Down menu.
4. Click the

Modify Icon next to the desired custom field.

5. Make your changes and Click on "Update".

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Deleting a Field
1. Click on Configuration -->>Administrative Tools -->> Self Update Layout
2. Click the

Edit Icon next to the desired layout to delete a custom field.

3. Select "Custom Attributes" from the "Attribute List" Drop-Down menu.
4. Click the

Delete Icon next to the custom field to be deleted.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

How To
Examples
How to set a field as Single Line Text?

1. "Drag and Drop" the desired field into the layout creation area.
2. Select "Single Line Text" field type from the Drop-Down menu.
3. To set Security, check against "Mandatory" or "Read only".
4. Set Character Length.
5. Set Appearance
 Initial Value (Provide input that will appear as default text).
 Help Card(Text you enter acts as a tooltip, when the end user moves the mouse on the
icon).
6. Click on Done.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

How to set a field as Multi Line Text?

1. "Drag and Drop" the desired field into the layout creation area.
2. Select "Multi Line Text" field type from the Drop-Down menu.
3. To set Security, check against "Mandatory" or "Read only".
4. Set Appearance
 Initial Value (Provide input that will appear as default text).
 Help Card(Text you enter acts as a tooltip, when the end user moves the mouse on the
icon).
5. Click on Done.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

How to set a field as Drop-Down Box?

1. "Drag and Drop" the desired field into the layout creation area.
2. Select "Drop-Down Box" field type from the Drop-Down box.
3. Enter your options in "Enter Choices" field.
4. To set Security, check against "Mandatory" or "Read only".
5. Set Appearance
 Help Card(Text you enter acts as a tooltip, when the end user moves the mouse on the
icon).
6. Click on Done.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

How to set a field as Check Box?

1. "Drag and Drop" the desired field into the layout creation area.
2. Select "Check Box" field type from the Drop-Down menu.
3. Enter your options in "Enter Choices" field.
4. To set Security, check against "Mandatory" or "Read only".
5. Set Appearance
 Help Card(Text you enter acts as a tooltip, when the end user moves the mouse on the
icon).
6. Click on Done.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

How to set a field as Radio Button?

1. "Drag and Drop" the desired field into the layout creation area.
2. Select "Radio Button" field type from the Drop-Down menu.
3. Enter your options in "Enter Choices" field.
4. To set Security, check against "Mandatory" or "Read only".
5. Set Appearance
 Help Card(Text you enter acts as a tooltip, when the end user moves the mouse on the
icon).
6. Click on Done.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Example to Customize the Title Attribute:

1. "Drag and Drop" the Title attribute into the layout creation area.
2. Select "Radio Button" field type from the Drop-Down menu.
3. Enter your options in the "Enter Choices" field (as shown in the above figure).
4. To set Security, check against "Mandatory" or "Read only".
5. Set Appearance
 Help Card(Text you enter acts as a tooltip, when the end user moves the mouse on the
icon).
6. Click on Done.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Example to Customize the Department Attribute:

1. "Drag and Drop" the Department attribute into the layout creation area.
2. Select "Drop Down Box" field type from the Drop-Down menu.
3. Enter your options in the "Enter Choices" field (as shown in the above figure).
4. To set Security, check against "Mandatory" or "Read only".
5. Set Appearance
 Help Card(Text you enter acts as a tooltip, when the end user moves the mouse on the
icon).
6. Click on Done.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Example to Customize the Manager Attribute:
Default Field Type:

1. "Drag and Drop" the Manager attribute into the layout creation area.
2. "Default Field Type" option is preselected in the Drop Down menu.
3. To set Security, check against "Mandatory" or "Read only".
4. Set Appearance
 Initial Value (Provide input that will appear as default text).
 Help Card(Text you enter acts as a tooltip, when the end user moves the mouse on the
icon).
5. Click on Done.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Drop Down Box:

1. "Drag and Drop" the Manager attribute into the layout creation area.
2. Select "Drop Down Box" field type from the Drop-Down menu.
3. Enter your options in the "Enter Choices" field (as shown in the above figure).
4. To set Security, check against "Mandatory" or "Read only".
5. Set Appearance
 Help Card(Text you enter acts as a tooltip, when the end user moves the mouse on the
icon).
6. Click on Done.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Gina Installation
ADSelfService Plus application allows you to configure Gina/CP (Ctrl + Alt+ Del) which enables the
end-users to reset passwords/unlock accounts from "winlogon
screen".
Gina / CP Installation:
This feature is an extension of the standard "Microsoft GINA", which comes with the additional
functionality of displaying the "Reset/Unlock' button in the"WinLogon"(CTRL + ALT + DEL)screen.
For the users to "Reset/Unlock" their "Passwords/Accounts" at the press of "CTRL+ ALT+ DEL" keys,
the Client Software(MSI package) must be installed in their respective systems.
In ADSelfService Plus , the "Client Software" installation process can be effected in the following
ways:
1. Client Software Installation from the ADSelfService Plus Console.
2. Client Software Installation via GPO (Group Policy Object).
3. Client Software Installation via SCCM (System Center Configuration Manager).
4. Manual Installation Of Client Software.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Client Software Installation From The ADSelfService Plus
Console
It is possible to perform "Bulk Installation of the Client Software" onto the user machines (of the entire
domain (or) the selected computers) from a centralized ADSelfService Plus console.
The two different methods used for such a "Client Software Installation" are:
1. Domain Based Installation
2. Organizational Unit(OU) Based Installation
Domain Based Installation
1. Click on Configuration -->Administrative Tools --> GINA (Ctrl+Alt+Del) --> GINA/CP
Installation
2. Click on "New Installation"
3. Select "Domain" from the drop down list
4. Select the computers from the available list
5. Click on "Install"
Organizational Unit(OU) Based Installation:
1. Click on "Configuration --> Administrative Tools --> Gina (Ctrl+Alt+Del) --> GINA / CP
Installation"
2. Click on "New Installation"
3. "Select Domain" from the Drop Down list
4. Click on "OU Based Filter"(present at the top right corner)
5. Select "List View" or "Tree View" to view the List of Organizational Units (OUs) in the Domain
6. Check against the desired "OU" and click on "Get Computers"
7. This will 'display' the 'list of computers' in the selected OU
8. Check against the 'desired computers' and click on 'Install'
The Installation process would be completed in a short time and the message "Process Is Completed"
would be displayed. Click on "OK" button to return to the GINA/CP installation screen.
Import Computers:
The "Import Computers" link is used to import computers via CSV file for the purpose of "Client
Software " installation.
To import computers for "Client Software" installation


Click on "Import Computers" link



Click on "Browse" and "Select" the CSV file



Hit the "Install" button

View Installed Machines:
All the "Client Software" installed machines are listed under the "Installed Machines" tab. To view all
the"Client Software Installed Machines" in the Domain

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide



Click on the Installed Machines tab



Select the Domain from the Drop Down Box



This lists all the Computers in which "Client Software" has been installed

View Error Occurred Machines:
Error might occur while installing the "Client Software".The computers that are subjected to such
errors are listed under the "Error Occurred Machines" tab.
To list all the "Error Occurred Machines" in the Domain




Click on the Error Occurred Machines tab
Select the Domain from the Drop Down Box
This action lists all the Machines where 'GINA/CP' installation could not be completed

Remove / Re-install Client Software :



Click on Un-install (This will remove the Client Software from all the Machines one selects
from the available list).
Click on Re-install (This will re-install Client Software onto machines where installation could
not be completed but gets displayed under "Installed Machines" List)

NOTE:




The 'Reason' behind the failure of 'GINA/CP' installation will also get listed when you
view the list of 'Error Occurred Machines'
"Remove/Re-Install" buttons would appear only when you click on the "Installed
Machines" or "Error Occurred Machines" tab .

"Export " & "Printable View" Options:
The "Export As"option is used to export the list of "Client Software Installed' & 'Error Occurred"
computers in different file formats like CSV,HTML,PDF & XLS. This process is usually carried out for
auditing purposes. "The Printable View" option is used to preview the printable version of the "Client
Software Installation" feature.
1. You have the option of performing a quick search for "filtering and finding the
desired computers" using the "Quick Search" option instead of going through all the
computers one by one.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Client Software Installation via GPO (Group Policy Object)
For complete information on Client Software Installation via GPO refer the link provided here.
http://www.manageengine.com/products/self-service-password/gina-gpo-installation-guide.pdf

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Client Software Installation Via System Center
Configuration Manager
System Center Configuration Manager:
System Center Configuration Manager is one of the methods of client software installation used to
distribute the client software over a given domain. System Center Configuration
Manager is a systems management software product by Microsoft for managing large groups of
Windows-based Computer Systems. The SCCM offers remote control, patch management, software
distribution, operating system deployment, network access protection and hardware & software
inventory. To make use of the SCCM feature, it must be installed in your system.
Steps To Be Followed To Create A Package:
1. Start up your 'Configuration Manager Console' and click on the 'Site Database->Computer
Management ->Software Distribution' and then Select Packages' in the left pane.
2. Right click on the 'Packages' and select 'New -> Package'( A 'New Package Wizard' will open
up)
3. Fill in the 'General Package' properties (as you desire)
4. In the 'Data Source' tab, select the 'This Page Contains Source Files' checkbox and click on
'Set' to specify the source of the 'SCCM' package.
5. Change the 'Source Directory' location to 'Local drive' on 'Site Server' and browse to the path
of your package
6. Click 'OK' & Set the 'Schedule to update the Distribution Points'
7. Set the 'Data Access' Options or 'Revert to the Default Settings'
8. In the 'Distribution Settings' tab, 'Set the Priority of the Package' to 'high'
9. Under the 'Reporting' tab, set the MIF(Management Information Format) properties as
'Default' .
10. Set the 'Security Rights' for the package
11. Review the 'Summary of the Selected Choices'
12. Click on 'Next' to install the 'Package'
13. A confirmation message will appear that the 'Package has been Installed'
Creating A Program For The Package:
1. In Configuration Manager Console,expand the newly 'Added Package' & right click on
'Program'
2. Choose 'New -> Program'
3. Fill in the Program Details (under the 'General' tab) Provide the 'Command Line' as
follows:"msiexec /i ADSelfServicePlusClientSoftware.msi
SERVERNAME=selfservice.xyz.com PORTNO=8888 /qn".
4. In the 'Requirements' tab,select the 'The Program can run on Specified Client Platforms'
option & choose the 'desired operating systems'
5. Under the 'Environment' tab,choose 'Program Can Run Whether Or Not The User Is Logged
In' option
6. In the 'Advanced Settings' tab,leave all the settings as they are (that is,'default settings')

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

7. Ignore the 'Windows Installer Package' tab
8. Under the 'MOM Maintenance' tab,select 'Generate Operations Manager alert if this program
fails' option
9. Review the 'Summary Of The Program' and then click 'Next'
10. Click 'Close' to finish
Advertising The Package:
Once the package has been created along with the programs,the next step is to 'Advertise the
Package'(specifying the programs that you want your clients to run).This can be done as follows:
1. In the 'Configuration Manager Console', select 'System Center Configuration Manager ->Site
Database ->Computer Management -> Software Distribution ->Advertisements'
2. Right click on 'Advertisement' & select 'New -> Advertisement'
3. Fill in the details for the 'Advertisement' as follows:
Under the 'General' tab,provide the various details of the Advertisement as follows:
 Name' (of the program)
 Comment (regarding the program)
 Click on 'Browse' buttons to choose the 'Package,Program & Collection'
When prompted about 'Distribution Points',click 'Yes' (the updation of the 'Distribution Point'
would be done at the end)
In the 'Schedule' tab,set the schedule for the 'Advertisement' as follows:
 Set the 'Date' & 'Time' for the Advertisement
 Click on the 'Yellow Star' to set the 'Mandatory Settings'
 Set the 'Priority' to 'High'
Review the changes.
Under the 'Distribution Points' tab,
 Provide the necessary information
Review your distribution point settings on fast or slow LAN
Under the 'Interaction' tab,
 Set the Time Interval to 15 minutes
Under the 'Security' tab,
 Review the 'Security' settings
4. Summary Of The Advertisement' would be displayed,click on 'Next' to finish
Creating The Distribution Points
In the SCCM Configuration Manager Console
1. Select the 'Configured Package' & right click on it .Select 'New Distribution Points'
2. 'New Distribution Points' wizard opens up
3. Click 'Next' to continue
4. Select the 'SCCM Server' from the available list & click 'Next'
5. Under the 'Confirmation' tab,review the 'Summary Of Selected Choices' & click 'Close'

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Updating The Distribution Points
1. 1 Right click on the 'Distribution Points' & choose 'Update Distribution Points' option
2. A dialog box would appear stating that 'Are You Sure You Want To Update All Distribution
Points?'
3. Click 'Yes'
Distributing The Created Package:
In the SCCM Configuration Manager Console,
1. Select the 'Configured Package' & right click on it.
2. Select 'Distribute -> Software' the 'Distribute Package Wizard' will open up
3. Under the 'Distribution Points' tab,select the 'Distribution Points' option & click on 'Next'
4. Under the 'Advertise Program' tab,select 'Yes' for 'Do you want to advertise a Program from
this Package' option
5. In the 'Select Program' tab,select the 'Program that you want to Advertise to the members of
a Collection'
6. Click on 'Next'
7. Specify various details concerning the 'Advertisement of the Program' as mentioned below:
Specify the 'Collection' that should receive the 'Package'
 You can either specify 'An Existing Collection' (or) 'Create A New Collection'
Specifying An Existing Collection:
 Click on 'Browse' & Select the 'Desired Collection'
 Click on 'Next'
Specifying A New Collection
 Give the 'Name & Comment' for the 'New Collection'
 Provide atleast 'One Membership Rule' & click on 'Next'
8. Provide the 'Advertisement Name & Comment' in the respective textboxes.
9. Click on 'Next'
10. Under the 'Advertisement Subcollections' tab,specify 'Whether the Advertisement should be
made available to Subcollections or not' & click 'Next'
11. Configure a 'Scheduler' for the Advertisement under the 'Advertisement Scheduler' tab & click
'Next'
12. Under the 'Assign Programs' tab,provide the necessary specifications & click on 'Next'
13. A 'Summary of the Advertisement'(with the specified requirements) would appear
14. Clicking on 'Next' would 'Distribute the Package' successfully
You can speed up the 'Distribution of Advertisements' by initiating the 'User Policy Retrieval
& Evaluation' and 'Machine Policy Retrieval & Evaluation' cycles respectively. These cycles
can be initiated from the 'Action Tab' of the 'Configuration Manager Properties' in the control
panel (on your client computers).

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Manual Installation Of Client Software
An alternative method for the "Client Software Installation" is to manually install the software onto the
client machines with the help of the "MSI package"
To view the "MSI package", navigate to the location where the ADSelfService Plus has been installed
and select the "Bin" folder.
.
Steps To Be Followed For The Manual Installation Of The Client Software :
Copy & paste the 'MSI package' onto the computers (where the Client Software is to be installed),
then
1. Right click on the 'MSI package' & click on 'Install'
2. The "ADSelfService Plus Client Software Setup Wizard" will appear. Click
3. "Next" to continue
4. Select Installation Folder" page would appear
5. To select the "location of your choice" - for the installation of the Client Software - click on
"Browse" and select the desired location
6. Click on "Next" to continue "ADSelfService Plus Server Details" page would open up
 Provide the "Name of the ADSelfService Plus Server" in the respective text box provided
 Follow it up with the "Port Number of the ADSelfService Plus Server".Declare the port number
in the "HTTP" mode ( this version is also compatible with the "HTTPS" mode)
7. Click on "Next" to continue
8. "Confirm Installation" page would appear, click on "Next" to go ahead with the installation
9. This would lead you to the "Installation Complete" page, where the message "ADSelfService
Plus Client Software has been successfully installed" would be displayed
10. Click on "Close" button to exit the "GINA/CP Client Software Setup Wizard".
Manual Installation Via Command Prompt:
It is also possible to install the "GINA/CP Client Software" with the help of "Command Prompt" instead
of using the "GINA/CP Client Software Setup Wizard".
The command which is executed for the Installation process is "msiexec
/iADSelfServicePlusClientSoftware.msi SERVERNAME=selfservice.xyz.com PORTNO=8888 /qn".

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Gina/CP Customization
'GINA/CP Customization' is a feature of ADSelfService Plus which assists you in revamping the
'GINA/CP' layout based on your requirements. Using this feature,aspects like the 'Gina/CP icon' and
the 'Text on & above the Reset/Unlock button' can be customized.
Steps To Be Followed Inorder To Customize The Gina/CP :
1. Click on 'Configuration -->Administrative Tools --> Gina (Ctrl + Alt + Del) --> Gina/CP
Customization'.
2. In the 'Frame Text' textbox,enter the 'appropriate text' (which will 'Direct the User' to click on
the 'Reset/Unlock' button).The default text is 'Please Click On Reset/Unlock Button to
reset/unlock your account with ADSelfService Plus'.
3. Follow it up by 'Configuring the Text' for the 'Reset/Unlock Button'(the text which will be
displayed on the 'Reset/Unlock Button').
4. To select the 'Icon' for the 'Gina/CP feature',click on 'Browse' & select the 'desired icon' (Only
BMP files (with size 48 * 48) can be used as the 'Gina/CP Icon')
5. Specify the 'Name of the Machine' where the ADSelfService Plus has been installed in the
'Server Name' textbox
6. Provide the 'Port Number' in the respective box.Declare the port number in 'HTTP' mode (also
compatible with the 'HTTPS' mode)
7. Click on 'Save' to store the configured settings.
 Only the 'Future Gina/CP Installations' will be affected by this 'Gina/CP
Customization' process
 For an already 'Deployed Gina/CP',customization can be done with the help of the
'Gina/CP Customization Scheduler'

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Gina/CP Schedulers
The 'Gina/CP Schedulers' is a feature of ADSelfService Plus using which you can create 'Schedulers'
for the Gina/CP 'Installation & Customization'.
'Gina/CP Schedulers' are used to automate the 'Gina/CP installation' process over a domain.During
manual installation of Gina/CP,it is possible that a few computers might be left uninstalled (due to
some technical issues).To elude such sticky situations,the 'Scheduling' process is deployed - which
ensures that all the computers within a domain get installed with the 'Gina/CP' client software .
To re-configure an already deployed Gina/CP,the 'Customization Scheduler' feature is used.
Steps To Be Followed Inorder To Configure The Gina/CP Schedulers:
1. Select 'Configuration Administrative Tools --> Gina(Ctrl + Alt + Del ) --> Gina/CP Schedulers'
2. Click on the 'Edit' icon (inorder to alter the default settings of the 'Gina/CP Installation (or)
Customization' scheduler)
3. Select the 'Domain'(for which the Scheduler is to be configured)
4. For OU based selection,click on the 'Add OUs' link & Select the 'Desired OU(s)'
4.
5.
6.
7.
8.

Set the 'Frequency for the Schedulers' Options available for scheduling are:
Daily
Weekly ( specify the Day )
Monthly ( specify the Date)
Hourly
Select any one of the above mentioned options.
5. Set the 'Time' at which the 'Scheduling' would occur
6. Click on 'Save' to store the configured settings.
You can Enable/Disable the 'GINA/CP scheduler' using the 'Enable/Disable' icon

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Technician
Technician is a status that you can assign to the end-users. When a user is declared as a technician,
then he will be provided with the rights to configure the various settings of the
ADSelfService Plus application.
This application allows you to configure technicians of two types:


Super Admin.



Operator.

Steps to Configure a Technician.
Super Admin:
When you declare an end-user as a Super Admin, then he will be provided with the full control over
the entire application.A Super Admin has the right to re-configure the entire layout of the
ADSelfService Plus.
Operator:
Declaring an end-user as the operator would provide him with the rights to perform the auditing
operations for this application.
A Technician is provided only with the information that appertains to the domain to which he
belongs.

Configuring Technician Settings
1. Select 'Configuration --> Administrative Tools --> Technician'
2. Click on 'Add New Technician' button
3. Choose the 'Domain' from the Drop Down box
4.
5.
6.
7.
8.

Incase of selecting 'Domains' other than the 'ADSelfService Plus' application:
Click on the 'Choose' link
Select the 'User' from the available list & click 'Ok'
Select the 'Role' for the 'Technician' (Super Admin/Operator)
Click on 'ADD'

The 'Technician' would be created. These technicians can logon using their 'Windows Logon'
credentials.
5.
6.
7.
8.
9.

Incase of selecting the 'ADSelfService Plus' domain:
Provide the Login Name
Specify the Password & Confirm it
Select the 'Role' for the 'Technician'(Super Admin/Operator)
Click on 'ADD'
 The 'Technician' would be created. These technicians (ADSelfService Plus domain)
are the ones who have no Active Directory accounts and therefore have to use the
credentials that are configured by you.
 A message would be displayed stating that 'the technician was successfully created'.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

External Data Sources
This is a feature of ADSelfService Plus using which you the admin - to connect with in-house data
sources like Oracle, MS SQL and MY SQL and with the other external data sources. These data
sources can be utilized in ADSelfService Plus.
 Establishing Connection.


Fetching the Security Q & A from an External Database.



Fetch Again.

Establishing Connection:
The first step is to "establish connection with an external data base" from where the data is going to
be fetched.
1. Select Configuration -->Administrative Tools --> External Data Sources.
2. Click on 'Add New Data Source' to create a new data base Connection.
3. "Data Base Connection" page appears on screen.
4. Enter the "Connection Name" in the textbox provided.
5. Select the 'Data Base Server' from the 'Select DB Server' drop down list box.
6. Specify your "Hostname/IP Address" in the respective box provided.
7. Give the 'Port Address' as well.
8. Choose a suitable Data Base to which the connection is to be made.
9. Mention the "username".
10. Follow it up with the password (if the password has not been configured, then the respective
textbox can be left empty).
11. Select "SAVE" to save the settings that were configured.



The user should have the privileges to execute basic commands in the database
server.
The ADSelfService Plus installed machine must be granted the permission to access
the database server.

Once the connection has been established, the next step is to fetch the "Security Q & A" from the
external database.
Fetching the Security Q & A from an External Database:
1. Select Admin -->> External Data Sources.
2. Click on ADD to create a new Q & A fetcher.
3. Enter an apt "Title".
4. Select the "Connection" that you just created.
5. Choose the "Policy" to which this "Security Q & A" will apply.
6. Type the appropriate "Query" to fetch data from the external database table .
7. Click on Save to save the configured settings.
 The general form used while formatting a "Query" is "Select Username, Question,
Answer from TableName;"
 "Conditions/Join Queries" too can be used.
 In the case of Oracle Server, avoid "semicolon"(;) at the end of the "Query"

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Fetch Again:
Updating an existing data source can be done with the help of a process called "Fetch Again" option.
Eg. Let's say about "100 new users" are added to an "already connected data source" then these
users can be easily "updated" using the "Fetch Again" option.
The "Fetch Again" option is indicated by an upward pointed arrow. Clicking on this arrow would
update the database with the newly added entities.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Security Center
As the name suggests, under this tab, you are provided with the features using which you can beef up
the security of the end-userâ€™s account.
Features available under this tab are mentioned below:


Password Strengtheners



Security Q & A Strengtheners



Anti-Hacking System

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Password Strengtheners
This feature provides you with a set of rules that you can impose onto the end-users while they
configure their passwords. These rules are intended to increase the security of the user passwords.
Features:


Enforce Password Strength Level



Force Users To Change Password At Next Logon.

Configuring Password Strengtheners
Enforce Password Strength Level :
As the name suggests, this feature apprizes the end-users of their password strength. It does
so with the help of a feature by name Password Strength Analyzer.
While working with Password Strength Analyzer, you are granted with the option of choosing the
password strength level from the list of available choices (strong, good, weak & too short)

Force Users To Change Password At Next-Logon:
Another way of securing a user's password is to force them to change it at regular intervals. A
user would be required to change his password whenever he avails himself of the "Password
Reset" service, that is, on his next logon into the application following the Password Reset
operation.
Configuring Password Strengtheners
Password Strengtheners listed above can be configured by
1. Clicking on the "Advanced" icon against a Self-Service policy.
2. From the Pop-Up click on the "Reset & Unlock" tab

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Security Q & A Strengtheners
Using this feature, you can secure the 'Security Q & A' process which serves for the purpose of user
authentication. This feature offers you with a "set of self-explanatory rules" which can be imposed
onto the user - in order to maintain the confidentiality of the user account - while he undertakes the
Security Q & A process.
The rules under this feature are listed below:


Prevent a user from providing the same answer to multiple questions



Prevent a user from using any word of a question in their answers



Display security questions one by one



Display only a random subset from a user's security questions



Make security answers case-sensitive



Hide answers during reset/unlock operations

To Configure Security Question and Answer Strengtheners click here.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Anti-Hacking System
This feature is a compilation of several services which assist you in securing the user's account from
various hacking threats. It does so by allowing you to impose a set of rules onto the user accounts
that provide resistance against cyber-crimes, eaves-dropping or sneaking.
It offers you with the following services:


Brute Force/Dictionary Attack Preventers.



Man-In-The-Middle Attack Preventers.



Safeguard Inactive-Account Loopholes.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Brute Force/Dictionary Attack Preventers
"Guessing" is one of the easiest forms of hacking. So, in order to keep this malign craft at bay,
ADSelfService Plus provides you with the following features:


Block User Accounts Failing At Security Q &A



Session Time-out



CAPTCHA

Block User Accounts Failing At Security Q & A:
The probability of a user failing at the Security Q & A process is limited, as he would be well aware of
the details provided by him.
As a protective measure against hacking, this feature blocks users who fail the Security Q & A test for
a definite time period (the ideal value being 5 attempts but can be changed to any desired value; as
there is always a possibility of a user forgetting his Security Q & A details). To Block User Accounts
Failing at Security Ques and Ans Click here.
Session Time-out :
Password Reset & Account Unlock are two very delicate tasks which should be carried out with
utmost care. To do so, this feature helps you to preclude any leak out of confidential user information
by allowing you to set a time limit for the "Password Reset/Unlock Account" sessions, thus preventing
any "user idle time".
Whenever the user happens to exceed the time limit set for performing the 'password reset or unlock
account task', the whole process will get locked out & the user has to start all over again. To
Configure Session Time-Out click here.
CAPTCHA :
More popularly known as the word verification image, this feature when enabled would help you to
beef up the security of the user. To Configure CAPTCHA feature click here.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Man-In-The-Middle Attack Preventers
Whenever a transaction happens between two extremities, the possibility of some source getting hold
of the information while on its way to its destination is huge. To avoid such incidents, this application
provides you with two features that are listed below:


E-mail Notification Upon Password Self-Service



Secure Connections

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Safe-Guard Inactive Account Loopholes
Inactive accounts have always been a nuisance while managing user accounts. You cannot discard
the information pertaining to these inactive accounts since there is always a possibility of these users
returning back to the application.
Maintaining such inactive accounts might lead to various problems with the issue of 'License
Management' topping the list.
To counteract the problems that arise from the such Inactive User Accounts,the ADSelfService Plus
application provides you with a feature by name 'Restrict Inactive Users'.
Restrict Inactive Users:
Using this feature,you can strip the licenses of the Inactive Users and provide it to the newly added
accounts of this application.
Besides effective License Management,this feature provides you with the option of 'restricting inactive
users' from logging into this application.
ADSelfService Plus brings about the process of 'restricting inactive users' without discarding the
information pertaining to their accounts. For more on Restricting Inactive Users and its configuration
click here.
This application provides you - the administrator - with the rights to change the status of
these 'Inactive Accounts'.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Admin
Under this tab,you are provided with features via which you can configure the settings of the
ADSelfService Plus to suit your requirements.
The features available under this tab are:


Customize: Configure an environment of your own within this application using the features
available under this option



System Utilities:Provides you with features necessary for the functioning of ADSelfService
Plus application.



Product Settings:Configure the settings of the ADSelfService Plus application via this
feature



License Management: Manage user licenses effectively with the help of this 'License
Management' feature.

ZOHO Corp.

ManageEngine ADSelfSerivce Plus – Admin Guide

Customize
Under this tab,you are provided with features using which you can customize the various settings of
the ADSelfService Plus application .
The 'Customize' tab hosts three different features:


Logon Settings



Re-branding



Personalize

ZOHO Corp.

100

ManageEngine ADSelfSerivce Plus – Admin Guide

Logon Settings
As the name suggests,the 'logon settings' feature of the ADSelfService Plus assists you in configuring
the logon page of this application.
By default,the ADSelfService Plus application provides you with two different modes of logging into
this application:


As an Administrator &



As an End-User




You - as the administrator - get to decide whether the end-users would be availed
with the 'Admin Login' option.
In any case,it is advisable to prevent the end-users from making use of the 'Admin
Login' portal.(By enabling the 'Hide Self-Service Admin Login' option.For further
details click on 'Configuration').
Enabling the 'Hide Self-Service Admin Login' option requires you to specify the
'url(s)/DNS names' that would be allowed to access the admin portal in the 'Make
Admin Login Page Accessible Only from' textbox

Features:
Single Sign-On :
Enable the end-users to login into this ADSelfService Plus application using their respective domain
credentials instead of configuring a new set of login credentials.
Customizing The End-User Logon Page:
As an administrator,you are provided with the rights to customize the logon page of the end-users.To
do so,click on the 'Customize User Logon Page' link available under this 'Logon Settings' feature.
Configuration:
1. Click on Logon Settings (Admin --> Customize --> Logon Settings)
2. Enable the 'Hide Self-Service Admin Login' checkbox.
3. Check the 'Single Sign-On' option
4. Enable the 'Show Log Onto' option in order to allow the end-users to select the domain to
which they belong.(This option is required in the case of ADSelfService Plus lodging multiple
domains)
 While selecting the 'Show Log Onto' option,you are provided with the choice of setting the
'Select Domain' as the 'default value' in the 'Show Log Onto' drop-down box.
 To do so,enable the 'Show Select Domain As The Default Value' checkbox
5. Click on 'Save' to store the configured settings.

ZOHO Corp.

101

ManageEngine ADSelfSerivce Plus – Admin Guide

Customize User Logon Page
Using this feature of ADSelfService Plus,you can customize the user logon page.The process of
customization is brought about using the "drag and drop" method.
This feature comprises of two different fields.They are:


Pre -Defined Field



Custom Field

Pre-Defined Field:
These are the default elements that are provided to you (admin).There are five different fields
available.


Reset Password



Unlock Account



Enrollment



Change Password



Self Update

Operations That Can Be Performed On The Pre-Defined Elements:
Though the Pre-Defined elements are default ones,you have the right to 'edit or delete' these options
from the user logon page.To modify the pre-defined elements,you are provided with the following
options:


icon - which appears on mouseover the pre-defined element - would
EDIT - Clicking on
pop up a dialog box via which you can edit the contents of these pre-defined elements



DELETE - Click on the
page.

icon in order to delete the predefined elements from the user logon

The deleted element can be re-enabled by clicking and dragging the same from the 'PreDefined Elements Area' available on the left side of the Logon Page Customizer.

Custom Field:
You can add new attributes onto the user logon page using this custom field. The elements that can
be added are


Text



Link



Image



Horizontal Line



Vertical Line

To view the working of the above mentioned options, click "CUSTOM FIELD ATTRIBUTES"

ZOHO Corp.

102

ManageEngine ADSelfSerivce Plus – Admin Guide

User Logon Dialog Box:
Just as you can reposition various fields on the user logon page,you can also re-map the 'user logon
box'.Moving the mouse pointer over this dialog box enables "Hide" button,which when clicked leads to
another dialog box.
The newly popped-up dialog box contains "Keep The Logon Form Hidden By Default" checkbox.
Checking this option would disable the user logon box.
Enabling The User Logon Box:
To enable the User Logon Box ,click on 'Show' icon (which appears when the logon box is in a
disabled state).
Steps Involved In Configuring The User Logon Page:
1. Click on "Customize User Logon Page" link on the 'Logon Settings' page (Admin -->
Customize --> Logon Settings)
2. Drag and position the "Pre Defined Elements" in the desired locations
3. Click on "Custom Fields" and add the fields of your choice from the options available.
4. Click on "Preview This Settings" to view the page before being saved
5. Hit the "SAVE" button to save the configured settings.
CUSTOM FIELD ATTRIBUTES:
ADD TEXT ATTRIBUTE:
Using this attribute you can add ( as well as format) the text on the user logon page.Clicking this
option would pop up a window via which you can configure the text to be displayed on the user logon
page.
ADD LINK ATTRIBUTE:
Create links to other web pages with the help of this Add Link Attribute. Clicking on this option would
pop up another window which contains the following two fields:
 Name - specify the name of the web site


Target URL - mention the URL of the page (which is to be linked)

ADD IMAGE ATTRIBUTE:
Add images onto the 'User Logon Page' with the help of this 'Add Image Attribute'.
ADD LINE:(Horizontal & Vertical)
Using this 'Add Line' option,you can add lines onto the 'User Logon Page'. The lines that you create
can be moved as well as resized as you desire.

ZOHO Corp.

103

ManageEngine ADSelfSerivce Plus – Admin Guide

Rebranding
"Rebranding" is a feature using which you can customize the ADSelfService Plus display settings
"based on the environment" in which it is deployed.
Steps Involved In Configuring The "Rebranding" Feature:
1. Click on 'Rebranding' (Admin --> Customize --> Rebranding)
2. Browse and Select the desired image ( logo for your application) via "Change Image/Logo"
field
3. Select the "Desired Color" from the "Change Theme Color" field
4. Pick the "Font Style" from the "Font Family" drop down box
5. Select the "Font Size" from the "Font Size" drop down box
6. Specify an appropriate 'Browser Title'
7. Choose the 'Browser Title Image'
8. Enable the "Customize Password Policy Messages" checkbox to re-configure the standard
"Domain Password Policy" regulations (displayed in the pages that a user goes through
while "resetting/changing" his password)
This process of re-configuring can be done by editing the "html"
file found at the location specified below:
\webapps\adssp\html\_PasswordPolicy.html
To restore the 'Default Domain Policy' settings,disable the 'Customize Password Policy
Messages' checkbox & click on the 'Update Domain Objects' button (Refresh Icon) in the
Domain Settings feature.
9. Hit the "SAVE" button to store the configured settings
Change Image / Logo for Admin Users:
An administrator can replace the default ADSelfService Plus logo with his corporate logo or an image
of his choice. The modified image present at the top left corner of the Application will then be viewed
by all Self-Service Users.
To replace the default ADSelfService Plus logo
1. Login ADSelfService Plus
2. Click on the "Admin Tab"
3. Click on "Rebranding"
4. Click on "Browse" and provide a check against the "Change Image / Logo" box provided
and select your corporate image or logo.
5. Click on "Save" to save the changes.
Customize messages at Reset Password /Unlock Account pages
An Administrator can customize the header and footer messages on one or all pages in
ADSelfService Plus, directing a user to perform a password reset (Using "Forgot your Password" link)
or account unlock (Using "Unlock your Account" link). Customization of header and footer is done by
providing links, or text messages within a HTML Table element.

ZOHO Corp.

104

ManageEngine ADSelfSerivce Plus – Admin Guide

To customize the Header and Footer Messages in one or all the pages edit the file
"CustomLayout.txt" from the location provided below,
\webapps\adssp\html\
Each page directing to Password Reset or Unlock Account has different names as described below.
"url-reset" : "Reset Your Password" Page where users enter their name & select their domain. Enter
your text messages in the file "CustomLayout.txt" within the open and close Tags provided below.
Enter Message or Link
Enter Message or Link
"url-validateuser" : "Security Questions" Page where users answer secret questions. Enter your text
messages in the file "CustomLayout.txt" within the open and close Tags providded below.
Enter Message or Link
Enter Message or Link
"url-resetpassword" : This is the Page which provides "Domain Password Policy requirements" for
users when Password Reset / Unlock Accounts. Enter your text messages in the file
"CustomLayout.txt" within the open and close Tags providded below.
Enter Message or Link
Enter Message or Link
"url-resetresult" : This page shows the status of a "password reset" or "account unlock". Enter your
text messages in the file "CustomLayout.txt" within the open and close Tags provided below.
Enter Message or Link
Enter Message or Link
Example:

Enter your text message

(Note: Save a BackUp copy of the existing file CustomLayout.txt before editing.)

ZOHO Corp.

105

ManageEngine ADSelfSerivce Plus – Admin Guide

Personalize
ADSelfService Plus offers you with a feature by name 'Personalize' using which you can modify the
settings of this application to suit your requirements.In other words,you can create your own
environment within this application via this 'Personalize' feature.
Features:
This feature:
 Allows you to change the 'default login credentials' provided to you by this application at the
time of purchase.


Allows you to view this application in the language that you prefer.



Lets you to set the 'time zone' of your choice



Lets you to choose the 'Date' & 'Time' formats as per your requirements.

Configuration:
Changing The Logon Credentials:
1. Enter the 'Old Password' in the specified box.
2. Follow it up with the 'New Password' & confirm the same in the succeeding field.
Creating An Enviroment Of Your Own Within ADSelfService Plus:
1. Choose the 'language' that you desire
2. Select the 'Time Zone'
3. Choose the 'Date & Time' formats
4. Click on 'Save' to store the configured settings

ZOHO Corp.

106

ManageEngine ADSelfSerivce Plus – Admin Guide

System Utilities
Under this tab,you are provided with the features via which you can 'update' as well as 'secure' the
settings of the ADSelfService Plus application.
The features listed under this tab are:


Dashboard Updater



Automatic DB Backup

ZOHO Corp.

107

ManageEngine ADSelfSerivce Plus – Admin Guide

Dashboard Updater
Update the dashboard of the ADSelfService Plus application with the help of the Dashboard Updater
feature available under the System Utilities tab. Besides dashboard updation, this tab also provides
you with the option of synchronizing ADSelfService Plus with your organization's Active Directory.
Features available under this tab:
 AD Synchronizer.


Locked Out Users.



Password Expired Users.

 Soon-To-Expire User Passwords.
All the above mentioned features can be updated via this "Dashboard Updater" feature .
The updation is brought about by configuring 'schedulers at regular intervals' which perform the task
of updating the features available under this tab.
You are also provided with the option of editing the schedulers that bring about the updation
process. To do so,click on the 'Edit' icon.

AD Synchronizer
The AD Synchronizer synchronises the ADSelfService Plus database with your Organization's Active
Directory. Scheduling ADSelfService Plus synchronization with your organization’s Active Directory
helps in the update of Application dashboard reports. Users will be able to view an updated
Dashboard and latest reports from the Active Directory.
The Synchronization is based on the Schedule frequency which is editable and displayed on the
Table.
To modify the Schedule Frequency:
1. Click on "Admin" Tab -->>"Dashboard Updater"
2. From the Actions column of the "Dashboard Updater" table click on the

edit icon.

3. This Pops-Up the "AD Synchronizer" where you can set the "Schedule Duration"
4. The "AD Synchronizer" schedules a report depending on any of the frequency listed below
based on User selection.
1. Daily

- A Report will be scheduled once a day at the time selected.

2. Weekly - A report will scheduled once a week on "selected day from Drop Down" at
"Selected time of that Day"
3. Monthly - A report will be scheduled once every month at a "selected time from drop" on
a "selected date from drop down"
4. Hourly - A report will be scheduled once in every "selected from drop down" hours.
The "Dashboard Updater" table lists the "Schedule Frequency" and the Schedule for the
"Next Run". Any fresh data updated in Active Directory will be synchronized with
ADSelfService Plus at the time displayed under the "Next Run" column.

ZOHO Corp.

108

ManageEngine ADSelfSerivce Plus – Admin Guide

Locked Out Users
From the "Actions" column of the "Dashboard Updater" table, click on the
edit icon to schedule an
update of the ADSelfService Plus dashboard. The dashboard will display the latest data about
Locked-Out Users.
Password Expired Users
From the "Actions" column of the "Dashboard Updater" table, click on the
edit icon to schedule an
update of the ADSelfService Plus dashboard. The dashboard will display the latest data about
Password Expired Users.
Soon-To-Expire User Passwords
From the "Actions" column of the "Dashboard Updater" table, click on the
edit icon to schedule an
update of the ADSelfService Plus dashboard. The dashboard will display the latest data about Soonto-Expire User Passwords.

ZOHO Corp.

109

ManageEngine ADSelfSerivce Plus – Admin Guide

Automatic DB Backup
As a proactive measure against the loss of data,the ADSelfService Plus application provides you with
a feature by name Automatic DB Backup.This feature assists you in creating 'schedulers for data
backups' at regular intervals,thereby precluding any chance of losing data.
Configuration:
1. Select the frequency (daily,weekly,monthly or hourly) for scheduling.
2. In case of selecting the Weekly (or) Monthly option,you have to specify the 'time' & 'date' at
which the scheduling will take place.
3. In case of selecting the Daily (or) Hourly option,you have to specify the 'time' at which the
scheduling will take place
2. In the 'Back-up Storage Path' text box,provide the path name for these 'Back-Up' files.
3. Click on 'Save' to store the configured settings.
If the specified path is wrong or unavailable, the database will be stored in the default backup
folder under the product installation directory

ZOHO Corp.

110

ManageEngine ADSelfSerivce Plus – Admin Guide

Product Settings
This tab offers you with features via which you can establish the software settings of the
ADSelfService Plus application.
The utilities available under this tab are:


Connection



Server Settings



Windows Service

ZOHO Corp.

111

ManageEngine ADSelfSerivce Plus – Admin Guide

Connection
The 'Connection' feature is used to configure the 'Port Settings' of the ADSelfService Plus application.
It is also used for 'establishing connections' with other 'Manage Engine' products.


Configuring Port Settings



Establishing Connection with other ManageEngine Products

Configure The Port Settings :
Steps to be Followed In-order To Configure The Port Settings :
1. Click on 'Connection' (Admin --> Product Settings --> Connection)
2. Specify the 'Default Port Number'(8888) (OR) Specify the 'Port Number' - of your choice- in
the respective box provided
3. Check the 'Enable SSL Port' checkbox for 'safe transfer of data' via encryption ( Click on 'SSL
Certification Tool' for further details )
4. Check the 'Enable LDAP SSL' checkbox (for secure communication between Active Directory
& ADSelfService Plus)
5. Select the 'Session Expiry Time' - time for which the user session would last - from the dropdown box
6. Click on 'Save' to store the configured settings
Establish Connection with other ManageEngine Products:
Steps to be Followed to establish Connection with other ManageEngine Products:
1.
2.
3.
4.
5.
2.
3.
4.

Enter the 'Server Details'
The 'Application Name' (with which the connection is to be established)
The 'Server Name'(the 'Manage Engine Product Installed Machine' which is to be connected)
The 'Port Number' of the 'Server'
Configure the 'Protocol'(http/https)
Under the 'Authentication Details' option enter
The 'Login Name' &
The Password

3. Click on 'Test Connection & Save' button ( to test the 'Established Connection')

ZOHO Corp.

112

ManageEngine ADSelfSerivce Plus – Admin Guide

Entrusting 'SSL Certification' with SSL Certification Tool
Entrusting this 'SSL Certificate' upon an ADSelfService Plus ensures 'safe transfer of data' between
this application & various others.
The SSL Tool brings about data security via 'encryption' process.
This page provides you with the 'Guidelines for Installing the SSL certificate' along with a 'CSR
Generator form'.
Guidelines For Installing The SSL Certificate On The ADSelfService Plus Application:
Installing the 'SSL certificate onto the ADSelfService Plus' application is a 'three-step process':
1. SSL Certficate Request
2. Generating The Keystore File &
3. Embedding the SSL Certificate With ADSelfService Plus
SSL Certificate Request:
Before requesting for a certificate from any certifying authority,one needs to create a tomcat specific
'.csr file' & a '.keystore file'.These two files should be named as 'selfservice.csr' &
'selfservice.keystore' respectively.
Generating The 'csr' file:(with the help of the 'CSI GENERATOR' form)
Steps To Be Followed:
1. In the 'Common Name' textbox,provide the 'domain name' for accessing the 'Server'(eg.
www.example.com)
2. Specify the 'Organizational Unit'(OU) in the respective textbox provided
3. In the 'Organization' textbox,provide the 'Legal Name' of your organization.
4. Specify the 'City'(in which your organization is located) in the textbox provided
5. Mention the 'State/Province' (in which your organization is located) in the respective textbox
provided
6. Provide the 'Country Code'(of the country where your organization is located)
7. In the 'Password' textbox,specify the 'Password'(minimum 6 characters in length) that you will
be asked while installing the certificate
Optional Features:
8. In the 'Validity' textbox, set the 'Validity Period' for the certificate(by default,it is 90 days)
9. Public Key Length
10. Click on the 'Generate CSR' button to generate the CSR file.
Generating The Keystore File (and associating it to the CA signed certificates):
1. Unzip & extract all the certificates received from the CA to the \jre\bin
2. To generate keystore and add signed certificates,follow the below mentioned instructions:

ZOHO Corp.

113

ManageEngine ADSelfSerivce Plus – Admin Guide

Directions to generate keystore for 'Go Daddy' certificates:
keytool -import -alias root keystore selfservice.keystore -trustcacerts -file gd_bundle.crt
keytool -import -alias cross -keystore selfservice.keystore -trustcacerts -file gd_cross.crt
keytool -import -alias intermed -keystore selfservice.keystore -trustcacerts -file gd_intermed.crt
keytool -import -alias tomcat -keystore selfservice.keystore -trustcacerts -file selfservice.crt

Directions to generate keystore for 'Verisign' certificates:
keytool -import -alias intermediateCA -keystore selfservice.keystore -trustcacerts -file < your
intermediate certificate > .cer
keytool -import -alias tomcat -keystore selfservice.keystore -trustcacerts -file selfservice.cer

Directions to generate keystore for 'Comodo' certificates:
keytool -import -trustcacerts -alias root -file AddTrustExternalCARoot.crt -keystore
selfservice.keystore
keytool -import -trustcacerts -alias addtrust -file UTNAddTrustServerCA.crt -keystore
selfservice.keystore
keytool -import -trustcacerts -alias ComodoUTNServer -file ComodoUTNServerCA.crt -keystore
selfservice.keystore
keytool -import -trustcacerts -alias essentialSSL -file essentialSSLCA.crt -keystore
selfservice.keystore

Embedding The SSL Certificate into ADSelfService Plus:
1.
2.
3.
4.
5.
2.
3.
4.
5.
4.

Ensure that Enable SSL Port is checked in the product.
Login in to "ADSelfService Plus"
Click on Admin -->>Product Settings -->>'Connection'
Provide check against 'Enable SSL Port' option
Click on Save (This will "Enable SSL Port")
Copy SelfService.keystore from \jre\bin to \conf
Edit "server.xml"(at \conf) by replacing the value of:
"keystoreFile" with "./conf/SelfService.keystore"
"keystorePass" with whatever password you entered into the CSR generator. Save the
server.xml
Restart ADSelfService Plus.

If the browser presents no warning,then you have installed the SSL certificate successfully.




You are provided with the option of 'editing' an 'already configured connection' by
clicking on the 'Edit' icon.
Changes in the 'Port Number' will come into effect only at the 'Restart of the
ADSelfService Plus application'
Incase you want to refer to the 'Server' with the 'Machine Name' instead of using the
'Port Address',then it can be done so by declaring the 'Port Number' as '80'.

ZOHO Corp.

114

ManageEngine ADSelfSerivce Plus – Admin Guide

Server Settings


Configuring Mail Server Settings



Configuring SMS Server Settings



Steps Involved In Configuring The Modem Port & Modem Speed



Requirements For Establishing SMS Server Connection

Configuring Mail Server Settings
1. Click on "Server Settings" (Admin --> Product Settings --> Server Settings)
2. Specify the "Mail Server" and "Mail Port" in the respective boxes provided.
3. In the "From" Address field enter the e-mail address from which you are likely to receive the
report mails.
4. Check against the "Authentication" option,enter the 'Username' and 'Password' of the Mail
Server to avoid anonymous login.
5. Enable 'Use Secure Connection' (SSL/TLS) checkbox (for securing the data transmission
between ADSelfService Plus & other applications)
6. Check the 'Send E-mails In HTML format' option
7. Click on "Save" button
To verify your 'Mail Server Settings', send a test email via the "Send Test Mail" Link. A 'Test Mail' will
be sent to the specified e-mail id's.
Configuring SMS Server Settings
1. Click on "Server Settings" (Admin --> Product Settings --> Server Settings)
2. Specify the "Modem Port" in the respective box
3. Click on "Save" button
To verify your 'SMS Server Settings', send a test message via the "Send Test Message" Link. A 'Test
Message' will be sent to the specified Mobile Number.
Steps Involved In Configuring The Modem Port & Modem Speed:


Connect your GSM Modem to the Serial Communication Port.



Only a serial cable must be used for connectivity.

 The port number for
 Window Devices: Will be comx. Eg. com7 or com8


Enter the Port Number to which the modem is connected :eg.(COM 1)

Requirements For Establishing SMS Server Connection


Modem/ Mobile must have GSM functionality with a provision to insert the SIM card.



Should support 7bit (GSM default alphabet), 8bit and Unicode (UCS2) encoding.

- Matching these criterias allows, ADSelfService Plus to support your modem/ mobile phone.

ZOHO Corp.

115

ManageEngine ADSelfSerivce Plus – Admin Guide

Windows Service
Whenever an application is declared as a NT Service,then it can be accessed from any
system,irrespective of it's location(the server in which it is installed).To declare the ADSelfService
Plus as a NT Service follow the steps given below:
Steps To Be Followed Inorder To Install & Start ADSelfService Plus As A Service:
1. Please stop the ADSelfService Plus,if it is running(Start --> Programs -->ADSelfService Plus -> Stop ADSelfService Plus)
2. Install as a Service(Start --> All Programs --> ADSelfService Plus --> NT Service --> Install
ADSelfService Plus as a Service)
3.
4.
5.
6.

Start as a service
Start -->Run and type 'services.msc'
Right-click on "ManageEngine ADSelfService Plus" and Click on Properties.
Go to Logon Tab and choose "This Account" option. Enter an Administrative credential and
click OK.
7. Right click on Manage Engine ADSelfService Plus and Click on Start

Now it would be possible to access the ADSelfService Plus application,even if the system - in which
ADSelfService Plus has been installed - is in a 'logged off' state.

ZOHO Corp.

116

ManageEngine ADSelfSerivce Plus – Admin Guide

License Management
As the name suggests, this feature enables you to manage licenses â€“ that of ADSelfService Plus.
Since ADSelfService Plus is a "per user" license product, this feature bears a huge significance.
When users enroll with ADSelfService Plus, they are provided with the access rights termed as the
"license". In more simple terms, just as you need a license to drive a car, you need a license to use
the services of ADSelfService Plus.
Why Do We Need License Management Feature?
What Exactly Is License Management?
Let's us assume an organization comprises of 5000 users and it purchases 5000 user licenses.
Gradually, over the years, about 1000 employees drop out of the organization. Then, it means 1000
licenses, for which the organization made a payment, is being wasted! Now, what if the product offers
the organization a chance to reuse these licenses,by giving it to new arrivals?! After all, an
organization is a place where there will be steady influx and efflux of employees!
Well, this is "license management" in a nutshell - as simple as that! Manage user licenses, so as to
provide the organization maximum benefit.
Advantages:
 Clients get their money's worth. No wastage of licenses = no wastage of money.


Since old licenses are reused, there is no need to buy new licenses for new arrivals. More
savings.



Everything is organized.

In short,"license management" performs a sort of "drain the swamp" work for keeping an organization
in an orderly manner.
Restricting inactive users from accessing ADSelfService Plus is a part of effective license
management.
Click on Restrict Users for further details.

ZOHO Corp.

117

ManageEngine ADSelfSerivce Plus – Admin Guide

Restrict Users
In this page we discuss


The users who can be restricted from using the License



Configuring The License Management Feature



Enabling a Restricted User

The users who can be restricted from using the License
License management involves the process of restricting users who fall under the following four
categories:
1. Account Expired Users
2. Account Disabled Users
3. Inactive Users &
4. Deleted Users.
1. Account Expired Users:
This happens for user accounts that are created for a shorter time duration (eg.in the case of a
temporary employee).As the account's time duration elapses,the user account gets expired - as there
is no point in maintaining a disembodied account. A user with an expired account will be stripped of
his license.
2. Account Disabled Users:
The rights for disabling a user account is in the hands of the administrator. By disabling a user
account,the administrator denies user the access to ADSelfService portal.This usually happens when
a user retires from an organization.
3. Inactive Users:
License Management feature allows the administrator to block users who have been inactive for a
specified time period.The time period can be set to any number of days (your choice).Using this
feature you - the administrator - can take precautionary steps inorder to prevent any disarray in an
organization.
4. Deleted Users:
Just as the license management feature restricts the inactive users,it can also forbid the deleted users
from accessing the ADSelfService portal.As in most cases,there is no need of licenses for users who
have been deleted from an organization.
When a user gets restricted,then the entire database related to that particular user is
lost.Therefore,the future report generations would not contain the details of this restricted
user.

ZOHO Corp.

118

ManageEngine ADSelfSerivce Plus – Admin Guide

Configuring The License Management Feature:
The license management feature can be configured as follows:
1. Click on Restrict Users (Admin --> License Management --> Restrict Users)
2. Select the required Domain,then
3. Choose the desired OUs (in which you are going to restrict users)
4. Click on Add Users
5.
6.
7.
8.
9.

"Add Users For Restriction" windows appears.It contains four different options.They are:
Account Expired
Account Disabled
Inactive Users
Deleted Users

6. Select anyone of the above mentioned options & generate the respective User Report.
7. A 'User Report' can be generated by clicking on Generate button.(To stop the 'Account
Expired' & 'Account Disabled' report generation,click on the "Stop" button.)
8. Once the report is generated,select the user to be "restricted" by "Enabling the Checkbox"
beside the "desired Username".
9. After user selection,click on the 'Add User' button.
10. A pop up window will appear bearing a warning message that the 'user to be restricted would
be denied access to the ADSelfService Plus portal'.
11. Click OK to restrict the user.
Enabling A Restricted User:
1. A Restricted User can be reinstated by enabling the checkbox beside that particular
username on the Restrict Users page.
2. Click on 'Allow Access' tab.
3. A message box will appear stating that the user was successfully reinstate
When a user gets reinstated,the administrator has to re-enroll that particular user (since the
information associated with the restricted users gets lost)

ZOHO Corp.

119

ManageEngine ADSelfSerivce Plus – Admin Guide

Support
The one place you should turn to for all the guidance you need while working with the ADSelfService
Plus application.
It provides you with the following features:
E- Mail Tech Support:
You can submit your queries regarding this application to the Tech Support team that will report back
to you as soon as possible.
ADSelfService Plus application provides you with a Toll-Free number (1-888-720-9500) to which you
can contact in case of requiring any guidance.
User Forums:
A place where the end-users can discuss various issues regarding this application.
You - the admin - too can gain an insight on how to better this application based on the views of the
end-users posted under these forums.
Subscribing To ADSelfService Plus:
Subscribing to this application is a very easy task. To do so,the ADSelfService Plus provides you with
the following details:
I The 'Get Quote' Option:
You can gain information about the 'price quotes' of this application by submitting the 'ADSelfService
Plus Get Quote form' which requires you to fill in some personal details.
II The 'Pricing Details' Option:
You can also view the pricing details of ADSelfService Plus based on your requirements by clicking
the 'Pricing Details' option.
III The 'Buy Now' Option:
Subscribe to ADSelfService Plus by clicking onto the 'Buy Now' option. It puts light onto the following
features:




'Terms & Conditions' to be followed while making use of ADSelfService Plus.
Two versions of ADSelfService Plus (Standard & Professional)
Licensing Fee ( in accordance with your requirements)

IV Compare Editions Option:
The ADSelfService Plus application is available in two different formats:


Standard

 Professional
The 'Compare Editions' option provides a comparison between the two available versions,thereby
providing you with a clear idea about the version that would suit you the best.

ZOHO Corp.

120

ManageEngine ADSelfSerivce Plus – Admin Guide

Troubleshooting Tips


Domain Settings



Active Directory Self Update



Active Directory Reports



GINA

Domain Settings
1. When I start ADSelfService Plus, none of my domains are discovered. It says "No Domain
Configuration available". Why?
2. When I add my domains manually, the Domain Controllers are not resolved. Why?
3. When I add the Domain Controller, I get an error as "The Servers are not operational". What
does it mean?
4. When I add the Domain Controller, I get an error as "Unable to get domain DNS / FLAT
name". What does it mean?
5. The status column in the domain settings says that the user do not have Admin Privilege?
1. When I start ADSelfService Plus, none of my domains are discovered. It says "No Domain
Configuration available". Why?
ADSelfService Plus, upon starting, discovers the domains from the DNS Server associated with the
machine running the product. If no domain details are available in the DNS Server, it shows this
message.
2. When I add my domains manually, the Domain Controllers are not resolved. Why?
When the DNS associated with the machine running ADSelfService Plus do not contain the
necessary information. You need to add the Domain Controllers manually.
3. When I add the Domain Controller, I get an error as "The Servers are not operational". What
does it mean?
This means that either the specified Domain Controller is invalid or it could no be contacted at present
due to network unavailability.
Questions
4. When I add the Domain Controller, I get an error as "Unable to get domain DNS / FLAT
name". What does it mean?
This error could be due to any of the following reasons:
1. When the specified user name or the password is invalid.
2. Anonymous login (when no user name and password is provided)
3. When IP Address of the Domain Controller is specified instead of its name.
5. The status column in the domain settings says that the user do not have Admin Privilege?
This is a warning message to indicate that the specified user do not have administrator privileges i.e,
the user is not a member of Domain Admins Group. Hence permissions applicable to Administrator
may not be available to this user.

ZOHO Corp.

121

ManageEngine ADSelfSerivce Plus – Admin Guide

Active Directory Self Update
1. Error Code - 80070005 / Error Code - 5 : Error In Setting Attributes, Access is denied
2. While user password reset, I get the following error "Error in setting the Password. The
network path not found - Error Code: 80070035"
3. While user password reset, I get the following error "Error in setting the Password. There is a
naming violation - Error Code : 80072037"
4. While updating the user information, I get the following error "The server is unwilling to
process the request - Error Code : 80072035"
5. While updating the user information, I get the following error " Error In Setting Terminal
service Properties. The specified user does not exist - Error Code : 525"
6. I have updated the exchange attributes using ADSelfService Plus, but the properties are not
updated in the Exchange Server yet.
7. I am not able to set the Terminal Services properties for the user?
8. When I modify an user, I get the following error "A device attached to the system is not
functioning - Error Code : 8007001f "
9. Email address for user not showing up or not set properly?
10. Error - The server is unwilling to process the request while resetting Password, which did not
match password complexity
11. Error code: 8007052e
12. Error code: 80070775
13. Error code: 800708c5
14. No such user matched. Verify the LDAP attribute in search query
1. Error Code - 80070005 / Error Code - 5 : Error In Setting Attributes, Access is denied
Cause : User account do not have enough privilege over the object.
Solution :
1.
2.
3.
4.

Login to ADSelfService Plus with the "admin" credential.
Click on the "Domain Settings" found at the right top corner.
Click on the edit image to "Edit Domain Details".
Check the "Authentication" and provide the privileged "Domain User Name" and "Domain
Password".
5. Save the Changes and continue with the operations.

2. While user password reset, I get the following error "Error in setting the Password. The
network path not found - Error Code: 80070035"
While setting the password for the user if the target machine could not be contacted, this error is
shown. This could happen when the DNS associated with the machine running ADSelfService Plus
do not point to the Domain Controller where the user account is being created (possibly both are in
different domains).
3. While user password reset, I get the following error "Error in setting the Password. There is
a naming violation - Error Code : 80072037"
One possible reason for this error could be that the password contains some special characters that
are not allowed.

ZOHO Corp.

122

ManageEngine ADSelfSerivce Plus – Admin Guide

4. While updating the user information, I get the following error "The server is unwilling to
process the request - Error Code : 80072035"
One possible reasons for this error could be:
1. When modifying the SAM Account Name format for multiple users and when more than one
user happen to have the same SAM Account Name.
5. While updating the user information, I get the following error " Error In Setting Terminal
service Properties. The specified user does not exist - Error Code : 525"
One possible reason could be that the user or the system account as which the product is run do not
have an account in the target domain. Terminal Service properties can only be set if the user account
or the system account (applies when ADSelfService Plus is run as a service) that runs ADSelfService
Plus has an account on the target domain.
6. I have updated the exchange attributes using ADSelfService Plus, but the properties are not
updated in the Exchange Server yet.
ADSelfService Plus modifies the exchange properties in the Active Directory. The changes may not
immediately reflect in the Exchange Server. It will get updated after some time.
7. I am not able to set the Terminal Services properties for the user?
One possible reason could be that the user or the system as which the product is run do not have an
account in that domain.
Refer to here for starting ADSelfService Plus in User or System account.
8. When I modify an user, I get the following error " A device attached to the system is not
functioning - Error Code : 8007001f "
The possible reasons for this error could be:
1. When modifying an user, if an unacceptable format is chosen for the naming attributes. For
example, if the format chosen for the Logon Name is LastName.FirstName.Initials and if the
user do not have any one of these attributes specified, this error will occur.
9. Email address for user not showing up or not set properly?
The possible reason could be:
1. Email may Not be set as per Recipient Policy. check whether all ldap attributes in recipient
ploicy query are set to specific value.
2. Check in the user account properties whether you entered the attribute for email. Ex:
xyz@company.com. The company should be entered to the users.
10. Error-The server is unwilling to process the request while resetting Password which not
maches to password complexity
The possible reason could be:
You may not have specified or opt for any options in 'Password Complexity' while creating user
account.
Ex: There will be options for password complexity like length of password, Characters that can be
used or number of bad login attempts etc. You need to select any degree of complexity, ignoring so
will throw above error.

ZOHO Corp.

123

ManageEngine ADSelfSerivce Plus – Admin Guide

11. Error code: 8007052e
The reason is, the Supplied credentials are invalid.
12. Error code: 80070775
Reason: The referenced account is currently locked out and may not be logged on.
13. Error code: 800708c5
Reason: The password does not meet the password policy requirements. Check the minimum
password length, password complexity and password history requirements.
14.No such user matched. Verify the LDAP attribute in search query
Reason: No Users in AD matches with the criteria provided by you.Try choosing the correct matching
attributes by checking with the query provided in the "Match criteria for Users in AD",this is obtained
by clicking on "Update in AD" button and expanding "Select Attributes" box.
Active Directory Reports
1. When I specify the details and generate the report, it says "No Result available" or incomplete
data
2. AD Reports shows an object that do not exist in the Active Directory?
1. When I specify the details and generate the report, it says "No Result available" or
incomplete data
It could be because of any of the following reasons:
1. When ADSelfService Plus could not contact the Domain Controller as it is not operational or
due to network unavailability.
2. In case of multiple Domain Controllers, when the data is not replicated in all the Domain
Controllers.
3. The LastLogonTime that is used to determine the inactive users and computers is not
replicated in all the Domain Controllers. Hence, you need to specify all the Domain
Controllers in the Domain Settings to enable ADSelfService Plus to retrieve the data from all
the Domain Controllers.
4. When the password policy is not set (i.e., Max Password Age is set to zero), the Password
Expired Users report and Soon to Password Expiry users report will not show any data.
2. AD Reports shows an object that do not exist in the Active Directory?
This mismatch could occur when the data is not synchronized with the Active Directory. The data
synchronization with the Active Directory happens everyday at 1.00 hrs. If ADSelfService Plus is not
running at that time, you can initiate the data synchronization manually by clicking the icon of that
domain from the Domain Settings.
Troubleshooting GINA
1. I receive the error message "Initiating Connection to Remote Service . . . Failed" why?
2. I receive the error message "Network path not found/Invalid Credential".
3. I receive the error message "The network path was not found".
4. Not able to copy ADSelfServicePlusClientSoftware.msi to the client machines. Why?
5. Couldn't connect to the machine, ADMIN$. Access is denied

ZOHO Corp.

124

ManageEngine ADSelfSerivce Plus – Admin Guide

6. Logon Failure: The target account name is incorrect.
7. Logon failure: unknown user name or bad password
8. I receive the message "Another installation is already in progress".
1. I receive the error message "Initiating Connection to Remote Service . . . Failed" why?
 Ensure if such a computer really exists. If so, ensure it is well connected to the network.


To check for connectivity, ping this computer only from the server where ADSelfService Plus
has been installed.

2, I receive the error message "Network path not found/Invalid Credential". Why?


Ensure if such a computer really exists. if it exists, ensure it is well connected to the network.



To check for connectivity, ping this computer only from the server where ADSelfService Plus
has been installed.

3. I receive the error message "The network path was not found". Why?


Ensure if such a computer really exists. If so, ensure it is well connected to the network.



To check for connectivity, ping this computer only from the server where ADSelfService Plus
has been installed.

4.Couldn't copy the MSI file "ADSelfServicePlusClientSoftware.msi" to the client machine.
Why?
Reason : Insufficient privilege to access the client machine.
Solution: Update the credential provided under the "Domain Settings" of ADSelfService Plus if Self
Service Product is running as an application.
When ADSelfService Plus is running as service, update service account's credential from the "Logon"
Tab editing the properties of "Services.msc"
5.Couldn't connect to the Client Machine, ADMIN$.Access is denied
Reason : Admin share might not be enabled.
Solution: Enable Admin Share permissions for the client machine. Configure Domain Settings(When
Run As Console) / Logon Tab(When Run As Service) with Administrative Credentials
6.Logon Failure: The target account name is incorrect.
1.This error message can occur if two computers have the same computer name. One computer is
located in the child domain; the other computer is located in the parent domain.
7.Logon failure: unknown user name or bad password
Reason:.Admin share might not be enabled.
Solution:.Configure Domain Settings(When Run As Console) / Logon Tab(When Run As Service)
with Administrative Credentials
8.Another installation is already in progress.
Solution : Try to install after few minutes

ZOHO Corp.

125

Source Exif Data:

File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.6
Linearized                      : No
Author                          : Zoho Corporation Pvt. Ltd.
Comments                        : 
Company                         : Zohocorp
Create Date                     : 2013:04:08 16:31:24+05:30
Modify Date                     : 2013:04:08 16:33:26+05:30
Source Modified                 : D:20130408110108
Subject                         :  ManageEngine Self Service Password :: Admin Guide
Has XFA                         : No
XMP Toolkit                     : Adobe XMP Core 5.2-c001 63.139439, 2010/09/27-13:37:26
Metadata Date                   : 2013:04:08 16:33:26+05:30
Creator Tool                    : Acrobat PDFMaker 10.0 for Word
Document ID                     : uuid:6205d288-3dbd-4c38-b653-14d94f31ee6c
Instance ID                     : uuid:d40f5344-fa20-4fc4-9810-e2ecf123379a
Format                          : application/pdf
Title                           :  ManageEngine Self Service Password :: Admin Guide
Description                     :  ManageEngine Self Service Password :: Admin Guide
Creator                         : Zoho Corporation Pvt. Ltd.
Producer                        : Adobe PDF Library 10.0
Headline                        : Converted by HTM2DOC Version 1.00
Page Layout                     : SinglePage
Page Mode                       : UseOutlines
Page Count                      : 126

EXIF Metadata provided by EXIF.tools

ManageEngine Self Service Password Pelco DVR C2619M Admin Guide

Navigation menu

Versions of this User Manual:

Views

Navigation