How to prevent users from changing settings.

Restrict options for end user to change lock/unlock settings

Admins can control what features are available to end users from the GateKeeper Hub. All computers in the same Group will be subject to the same configurations for locking, unlocking, and password complexity.

1) Login to your GateKeeper Hub.

2) Click on Group Settings on the left side.

3) Find the Group you would like to make changes to and click "Manage Settings" to the right of the Group's name.

4) Now you can edit lock settings, unlock settings, advanced settings, and limit the features end users have control over on their client computers.

LOCK SETTINGS

Below are the options for each setting along their explanations for Proximity Lock Method and Button Lock Method.

Set on Client computer:	Allows end-users to choose the settings on the Client application on their own computers.
Disable:	Turns off the feature. Not recommended.
Lock Workstation:	Auto-locks the computer. Leaves the current session active and available for any user to login.
Disconnect Session:	Locks the computer and enables switching between local or AD user accounts on Windows 7 and Mac (OS 10.13 and 10.14) computers.
Logout:	Logs the user out from the computer.

Inactivity Lock Method will lock the computer if the user is inactive (no keyboard or mouse activity) for the specified time. Use Lock Workstation if you are the only user or Disconnect Session (Switch User) if multiple people use this computer. The user has the following Lock options available in the drop-down menu. Note 1: For macOS, Lock Workstation and Logout options are not supported. Note 2: For Windows 7, it is recommended to use Disconnect Session instead of Lock Workstation.

• Disabled
• Lock Workstation
• Disconnect Session (Switch User)
• Logout

Token Visibility Timeout feature allows you to set a timer for how long the computer will remain unlocked if suddenly the software receives no data from the token. Sudden signal loss  can happen if a user places their hand over the token or buries it in their pocket. This feature is set in 15-second increments (15, 30, 45, 60).

Lock Delay Timeout delays locking the computer after a lock decision has been made for this time period. Choose a value for this delay if you want to prevent the computer from locking immediately when you walk away. Important: This lock delay will only apply when the computer is locked due to proximity.

Operating System Timeout disables your screen saver from starting when your computer times out. Choose the appropriate option to keep your timeout policy enabled or to disabled. If your timeout policy is set by your network administrator, this setting will not override the network policy.

Disconnect Remote Session allows user to enable or disable disconnecting remote session when the local computer is locked. This requires the client version to be 3.9 or higher, and the GateKeeper Remote application to be installed on the remote computer.

• Enable
• Disable

Lock Sensitivity changes the lock/unlock distance for your computer. The higher the sensitivity, the shorter the distance needed to lock. We recommend Medium sensitivity for the best lock/unlock experience for most environments. Note: Applies to Client App version 3.6.9 or lower.

Motion Detection Sensitivity is useful for adapting your locking and unlocking experience in different environment. High level setting motion sensitivity will allow the computer to lock quicker. If the system is locking too much while you are sitting at your desk, reduce the motion sensitivity to the Low level.

UNLOCK SETTINGS

Unlock Methods

Set on Client Computer:	Allows end-users to choose the settings on the Client application on their own computers.
Automatic Login:	Proximity login - once the user is in the range of the computer, the user will be authenticated.
Press Enter to Login:	When the token is in range of the computer, pressing the Enter key will authenticate the user.
Touch to Login:	Touch the token to the USB sensor to authenticate – just like an NFC card.
GateKeeper with PIN Login:	Requires the presence of a GateKeeper token and typing of a secret PIN to authenticate.

Quick Return Timeout: GateKeeper can be set to automatically unlock the computer if the same user comes back to the same computer within this Quick Return Timeout period. Only applicable when the Unlock Method is set to GateKeeper with PIN Login. Force PIN Login Timeout

Force PIN Login Timeout: GateKeeper can force users to type their PIN to log in irrespective of their chosen Unlock Method if the user comes back to the computer AFTER this PIN Login Timeout period. Use this to force users to confirm their identity at required intervals. If the timer is set to 1 hour with the Automatic Login mode, then the users will be required to log in with their PIN after every 1 hour.

Require user to enter Windows/macOS password

Set on Client computer:	Allows end-users to choose the settings on the Client application.
Never:	GateKeeper will never ask for your Windows or Mac username and password to authenticate.
At Login:	GateKeeper will ask for Windows or Mac username and password only when you log into your account using their token.
Always:	Any time a user unlocks their computer with their token, they will be asked for their Windows or Mac username and password.

Windows/macOS standard login

Set on Client computer:	Allows end-users to control this feature from their own computers.
Enable:	Any time a user unlocks their computer with their token, they will be asked for their Windows or Mac username and password.
Disable:	This will disable the Windows/macOS login option. If the user does not have their token, they will not be able to access the computer.

ADVANCED SETTINGS

Here, you can manage all the options available to end users on their Client-side computers. Restrict certain features or let end users make their own configurations.

GateKeeper Application Launcher allows users to choose programs to automatically launch either at startup or logon. EHRs, CRMs, Microsoft 365, Salesforce, and more can be auto-launched.

Notifications: This feature enables or disables desktop GateKeeper notifications on the local PC.

Add new user through client application:

Allow or prevent GateKeeper users from adding new users through the client application. We recommend preventing users from adding new users for security purposes.

Add credentials through client application:

Allow or prevent GateKeeper users to add more credentials to their profile. These can be domain, local or web credentials. We recommend keeping this option enabled for your users.

Add tokens through client application:

Allow or prevent GateKeeper users to add new tokens to their profile. We recommend disabling this option if you want administrators to manage tokens for your users.

Set range through client application:

Allow or prevent GateKeeper users from changing the range settings on the client application. Once the range is set, we recommend disabling this option to prevent inappropriately training the GateKeeper software. Note: Applies to Client App version 3.6.9 or lower.

Change server address through client application:

Allow or prevent GateKeeper users on the client application from changing the connection to the Hub server. This option should be disabled so that users cannot disconnect the computer from the GateKeeper Hub network.

Global Settings

Located in the Hub in the Group Settings tab, next to the Add Group button.

Authenticators: Choose what authentication device will use to access computers on your network.

• GateKeeper Bluetooth Tokens: GateKeeper Halberd or Trident App soft token for smartphones.
• Fingerprint: Biometric authentication with your fingerprint. See a list of compatible fingerprint readers here.

Secure Key Exchange: Exchange a secure key with your GateKeeper token to make it cryptographically unique. This will enhance the security of proximity authentication by auto-verifying One-Time-Passcodes sent by the token.

Firmware Update: Enable the client software to update the firmware of GateKeeper tokens. Please make sure to have the latest version of the GateKeeper Client software running on all computers before enabling firmware update.

Warning: This will cause GateKeeper tokens to stop working with version 3.6.9 and prior.

PIN Complexity: Choose strength requirements for the GateKeeper PINs. You can set minimum length, characters, numbers and special character requirements for the PIN.

For more questions on software for proximity authentication, please read more at www.gkaccess.com or reach out at [e-mail] or [phone]. 

-------------

Change group settings; GateKeeper group settings change; Edit settings; let end users configure settings; don't let end users configure settings; different settings for different people; different ranges; set different ranges for different people; let people add new users; add new users from any computer; add new keys from anywhere; let people add their own key fobs; let employees add new GateKeeper keys; let people register new computers; let people change servers; let people change server addresses; how to I change server address on computers; change PIN requirements; control options; limit options; limit changes; don't let them change settings; fixed settings; lock settings in place; control all computers; master computer; master key for computers; admin controls; controls for admins; master controls; gatekeeper administrator controls; admin login for gatekeeper; gatekeeper admin log in; Limit options for client-side settings.; Limit options for end users to change lock settings.; Limit options for end users to change unlock settings.; don't let users change settings; How to prevent users from changing unlock settings.; How to prevent users from changing lock settings.; How to prevent users from changing login settings.; How to prevent users from changing logout settings.; How to prevent users from changing range settings.; How to prevent end users from changing admin setting.; fix settings in place; don't let anyone change settings; lock in settings;