If you included the Help Desk Verification Service in the installation of your DualShield server, then the following components with the same name "Help Desk Verification Service" will be automatically created in the MFA server:

  • Application
  • Realm
  • Agent
  • Logon Procedure


To set up the Help Desk Verification Service, you only need to configure the realm and logon procedure that are used by the Help Desk Verification Service, and you also need to create a new logon policy for the Help Desk Verification Service.

Please follow the steps below:

Set up Realm

For the realm, you simply need to add the AD domain to the realm

Set up Logon Procedure

The logon procedure defines how users can be verified. You need to add logon steps and authentication methods

Add any authentication method that can be used to verify a user's identity, e.g. One-Time Password. 

Create Logon Policy

The Help Desk Verification Service is used by the admin or helpdesk team to verify the identity of users. Therefore, you need to make sure that MFA is enabled on all users. The simplest and most reliable way of enabling MFA on all users is to create a dedicated logon policy for the Help Desk Verification Service application.

To create or edit a policy, we need to open the policy editor window first.

Select "Administration | Policies" on the side panel,


To create a new policy, click the "CREATE" button on the toolbar to open the policy editor window.


In the policy editor, firstly select Logon from the Category drop-down list

Policy Bindings

Enter or select the following policy bindings:
Holder:

The policyholder defines the scope of the policy. 

Name:A unique name that describes this policy
Applications:

Optionally, you can bind the policy to a specific application or a list of applications. To specify the application(s),  select the field: Apply policy to these applications

If the field Apply policy to these applications is left empty, then the policy will be applied to all applications. 

Policy Options

Editing the Logon Policy

Logon policy settings can be edited using the following procedure;

  • From the Home page of the Management Console, left click on the menu item "Administration", select "Policies", then in the new tab "POLICIES", select the category "Logon", then click the  button;.

    The Logon policy settings can now be viewed (or edited) by left clicking on the context menu of the Logon policy, then selecting either "View" or "Edit";


After editing the policy setting, a new window titled "Policy - Edit" will open that can be used to edit the policy settings;




The category for this policy is "Logon" (this property cannot be edited).

The holder of this policy is "System" (this property cannot be edited).

The name assigned to identify the Logon policy by the System Administrator.

The System Administrator may use this field to annotate this policy.

This option allows the System Administrator to enable or disable this policy.


Expandable Sections

The remaining policy settings are grouped into the following expandable sections;

  • The purpose of the section "Authentication" is to provide the system administrator with with policy settings that determine when multi-factor authentication is required.

    image-2025-4-3_13-31-44.png



    This setting determines if user authentication is required when logging in;

    • Multi-factor authentication is not required for all users
      This option means that all users will be exempted from 2FA or MFA. This option is typically used to exempt a group of users from 2FA or MFA.

    • Multi-factor authentication is required for users with tokens only
      This option means that users who have a 2FA/MFA token in their account will be enforced to login with 2FA/MFA, while those users who do not have a token 2FA/MFA token will be exempted from 2FA/MFA in the logon process. .
    • Multi-factor authentication is required for all users

      This option means that all users will be enforced to login with 2FA/MFA

      Please note that users in the context of a policy include users in the scope of the policy only, i.e. the policy holder.

    This option allows the administrator to specify if authentication can be skipped on subsequent logon attempts (for the specified length of time).

    If this value is set to zero, then the feature is disabled, and authentication skipping does not take place.


    If authentication skipping is enabled, this setting will determine if the password is kept (and the second factor skipped), or if all factors are skipped;

    • Skip the second factor and keep the password
      The second factor is skipped, but the password is kept.

    • Skip Al factors including the password
      All factors are skipped.

    If this checkbox is ticked, then name guessing will be prevented (the user will not be informed if the username he supplies is known).

    if this checkbox is enabled then a CAPTCHA will be presented during logon (to ensure a human is supplying the authentication factors).

  • The purpose of the section "IP Filter" is to specify when to allow or deny logon based on the users' IP address.



    This setting determines if user authentication is required when logon attempts are made from the specified IP address;

    • required
      If this option is selected, then the user will be asked to provide multi-factor authentication prior to logging on.

    • not required
       f this option is selected, then the user will not be asked to provide multi-factor authentication prior to logging on..

    This option is used to store the IP Address range that will be subject to the previous option.

    Single IP address or IP ranges, e.g. 192.168.0.1; 192.168.0.10-192.168.0.20

    • IP with proxy: 1.2.3.4[192.168.0.254],
    • IP range with proxy: (1.2.3.0-1.2.3.255)[192.168.0.254],

    Note: 192.168.0.254 is the proxy server

  • The purpose of the section "User Agent Filter" is to specify when to allow or deny logon based on the agent used by the user agent.

     


    This setting determines if user authentication is required when logon attempts are made the matching agent;

    • required
      If this option is selected, then the user will be asked to provide multi-factor authentication prior to logging on.

    • not required
       f this option is selected, then the user will not be asked to provide multi-factor authentication prior to logging on..

    This setting allows you to list the agents that this policy will apply to;;

    The user agent are listed ass a text string (regular expressions are supported).

    e.g. (MacOutlook|Apple-iPhone6C) will match both "MacOutlook" and "Apple-iPhone6C"

  • Unable to render {include} The included page could not be found.

  • The purpose of the section "Geo Location Filter" is to specify when to allow or deny logon based on the geographic location of the user.



    This setting determines if user authentication is required when logon attempts are made from the specified IP address;

    • required
      If this option is selected, then the user will be asked to provide multi-factor authentication prior to logging on.

    • not required
       f this option is selected, then the user will not be asked to provide multi-factor authentication prior to logging on..

    After clicking on the icon the following window will open;

    Location details are then supplied that identify the which geographic locations the policy will apply to during logon. (based up IP addresses).


  • The purpose of the section "Geo Location Filter" is to specify when to allow or deny logon based on the geographic location of the user.



    This setting determines if user authentication is required when logon attempts are made from the specified IP address;

    • required
      If this option is selected, then the user will be asked to provide multi-factor authentication prior to logging on.

    • not required
       f this option is selected, then the user will not be asked to provide multi-factor authentication prior to logging on..

    After clicking on the icon the following window will open;

    Location details are then supplied that identify the which geographic locations the policy will apply to during logon. (based up IP addresses).


  • The purpose of the section "Others" is to provide logon policy settings that don't fit into the other main sections.



    This options determines if passwords can be cached in the browser.

    When set to a non-zero value this policy setting will allow One-Time Passwords to be reused within the specified number of minutes.

    If selected, this checkbox will ensure that the last used login name is remembered on the local client after the user has logged in.

    If selected, this checkbox will ensure that the last used login method is remembered on the local client after the user has logged in.

Create a new logon policy, and apply the new policy to the Help Desk Verification Service application. Also, select "Multi-factor authentication is required for all users"



  • No labels