Help

Protector Suite
QL Edition

Protector Suite - QL Edition enhances the security and convenience of your computer.

Protector Suite QL supports fingerprint logon, power-on fingerprint authentication, and other features, depending on your installation.

  • Fingerprint logon
  • Fast User Switching
  • Power-on security
  • (optional) Registering forms (web pages, dialogs) - Password Bank Registering forms (web pages, dialogs) - Password Bank
  • (optional) Application launcher
  • (optional) File encryption - My Safe
  • (optional) File encryption - File Safe

ThinkVantage Fingerprint Software

ThinkVantage Fingerprint Software greatly enhances your convenience when using your computer.

ThinkVantage Fingerprint Software supports

  • Fingerprint logon
  • Power-on security


Fingerprint Tutorial

To help you use the sensor correctly, we have created a tutorial that allows you to practice swiping your finger correctly and create fingerprint samples.

To run the tutorial:

Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Fingerprint Tutorial.

It can also be run from the fingerprint enrollment wizard.

Various icons provide feedback on what to do and what to improve during scanning.

Learn how to:

Use the sensor correctly

The video in the tutorial shows the correct movement of the finger across the sensor:
  • Position the last knuckle joint above the sensor.
  • Maintain finger contact with the sensor while sliding the finger towards you in a straight line.
  • Make sure that the finger remains flat.
On the next page, try creating four samples of your fingerprint. If the samples do not match, we recommend that you repeat the tutorial..

Note: The biometric operations in the tutorial automatically time out after 2 minutes of inactivity to prevent excessive power consumption.


Responses from the Fingerprint Device

Icons are used as prompts, notifications, and warnings.

Swipe your finger.
Prompts the user to start the swipe action.
Wait, the sensor is working.
Tells the user that the sensor is busy.
There was a problem capturing the fingerprint. Please, repeat.
Prompts the user to repeat the action.
Fingerprint operation succeeded.
The fingerprint was successfully matched or - in tutorial mode - a good sample was created.
The finger cannot be matched.
Notifies the user that verification failed.
Your finger was positioned too far to the left (or too far to the right). Position your finger in the center of the sensor.
Warns the user that the movement was not correct.
The movement was skewed.
Warns the user that the movement was not correct.
The movement was too fast.
Warns the user that the movement was not correct.
The movement was too short.
Warns the user that the movement was not correct.


Control Center

To display Control center

  • Go to Start > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.

    OR

  • Swipe your finger to display the Biomenu and select Control Center.

    • OR

  • Or right-click on the tray icon and select Control Center.

The Control Center contains various functions for fingerprint management and setting up your fingerprint software. The available options depend on the software status, hardware used, and installed applications:

Fingerprints

Learn how to enroll, edit or delete users' fingerprints and import/export data.

Enroll or Edit Fingerprints

Runs the fingerprint enrollment wizard. You can enroll/delete fingerprints for the current user and, if power-on security is implemented, also manage their presence in the fingerprint device memory. After you enroll your fingerprints, they are associated with your user name and password. The next time you can use your fingerprints instead of typing your user name and password. The features differ according to administrative privileges of the current user. In the secure mode (see Security mode in System Settings) users set as fingerprint administrators can enroll or edit fingerprints for all users. In the convenient mode, users can enroll or edit only their own fingerprints.

Delete

The features differ according to administrative privileges of the current user. In the secure mode (see Security mode in System Settings), only users set as fingerprint administrators can delete users' fingerprints. Learn how to delete fingerprints .

Import or Export User Data

Existing user data (including fingerprints, encryption keys, logon credentials) can be exported to the a *.vtp file (a user passport file) and imported back into your fingerprint software. The *.vtp file is encrypted and protected by a password defined during export. You cannot import a passport of an existing user. In this case it is necessary to delete the user passport first. You cannot import a passport of an existing user. In this case it is necessary to first delete the user.

Tip: We recommend exporting your passport for backup purposes.

Settings

Learn how to modify user and software settings.

System Settings

Opens the Protector Suite QL ThinkVantage Fingerprint Software Settings dialog containing various options for setting up the product. Most of these settings can be modified only by administrators and affects all users.

User Settings

Opens the User Settings dialog containing user specific options for setting up Protector Suite QL ThinkVantage Fingerprint Software.

Power-on Security

The memory of your fingerprint device is limited and usually can hold up to 21 fingerprints. You can decide which fingerprints are present in device memory and can be used for verification on computer startup, or create new fingerprints to be used only for power-on authentication.

Fingerprint Storage Inspector

Opens the Fingerprint Storage Inspector dialog where you can see the contents of your fingerprint storage.

HelpTutorial

Introduction

Displays the Introduction dialog with basic information about Protector Suite QL ThinkVantage Fingerprint Software features.

Tutorial

Runs the fingerprint tutorial which teaches you how to enroll your fingerprints. This tutorial is highly recommended for first-time users of this technology. The quality of enrolled fingerprints is extremely important. High quality fingerprint enrollment will increase your satisfaction with the product.

Help

Displays this help. The help files in other languages (depending on your installation) are located in the mui sub folder of your installation folder.

If you are using Windows Vista, click Elevate administrative privileges for user to get administrative rights to make changes in System Settings and manage or modify other users accounts (e.g. enroll or delete fingerprints of other users).

Help icon

Displays this help. The help files in other languages (depending on your installation) are located in the mui sub folder of your installation folder.

About icon

Displays information about software version.


Fingerprint Enrollment

Fingerprint Enrollment Wizard

Use the Enroll or Edit Fingerprints wizard to enroll new or edit existing fingerprint samples.
Fingerprint enrollment is a process of creating correspondence between your user name, password and your fingerprints (computerized so that reconstructing the original image is not possible) together with automatically generated security keys. All the data is stored in a user passport.

It is recommended that you use the Fingerprint tutorial at least once before you start the actual fingerprint enrollment.

Learn how to:

Enroll a new user (first use)

You must enroll your finger to be able to start using the software. Users with administrative privileges can also enroll and manage fingerprints of other users.
  1. Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
  2. Select Fingerprints > Enroll or Edit Fingerprints.

    It may be necessary to select an enrollment type before enrolling the first fingerprint in the Protector Suite QLThinkVantage Fingerprint Software installation. In this situation, the wizard name is changed to Initialize and the enrollment is started automatically after selecting the enrollment type.

  3. (In the Secure mode - see Security mode in System Settings), a list of existing passports is displayed. Select the user and click Enroll button to enroll a new user.)
  4. The Enrollment Wizard screen is displayed.
  5. To enroll a new fingerprint:
    • Select a finger to enroll by clicking the box above the finger.
    • Swipe the selected finger over the fingerprint sensor. Three successful images are required to enroll one fingerprint.
    To delete a fingerprint:
    • Select a finger to delete by clicking the box above the finger.
    • Click OK.
  6. Swipe your finger over the sensor or enter your Windows/Advanced security backup password, and click on Next.
  7. (Optional) If enrollment to the device was selected and your system configuration supports power-on security, all enrolled fingerprints will be also used for power-on security.
  8. (Optional)If enrollment to hard drive is selected and your system configuration supports power-on security, enrolled fingerprints will be also used for power-on security.
  9. Because of the device memory limitation, maximum number of fingerprints that can be stored is 21. If some of the enrolled fingerprints in the passports are not assigned for power-on security in the device (e.g. another device is connected), Power-on button is displayed above each finger. The Power-on button is displayed in a "depressed" state by default. The corresponding finger will be used for power-on security. If you do not want to use a finger for power-on security, but only for logon, click the Power-on button to delete it from the device memory.
  10. Click Next to finish the enrollment or to set additional options settings (such as Advanced security, see below).

Note: If you do not use a Windows password, you will be prompted to define a new (non-empty) one. This is not necessary, but a password improves the security of your software.

Enroll or edit fingerprints of an existing user

  1. Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
    OR
    Swipe your finger to display the Biomenu and select Control Center.
  2. Select Fingerprints > Enroll or Edit Fingerprints.

    3. Click on Edit. (In the Secure mode - see Security mode in System Settings, a list of existing passports is displayed. Select the user passport you want to edit and click on Edit.)
  3. The Enrollment Wizard screen is displayed.
  4. Swipe your finger over the sensor or enter your Windows/Advanced security backup password, and click on Next.
  5. To enroll a new fingerprint:
    • Select a finger to enroll by clicking the box above the finger.
    • Swipe the selected finger over the fingerprint sensor. Three successful images are required to enroll one fingerprint.
    To delete a fingerprint:
    • Select a finger to delete by clicking the box above the finger.
    • Click OK.
  6. Click Next to finish the enrollment or to set additional options settings (such as Advanced security, see below).

Delete fingerprints of an existing user

  1. Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
    OR
    Swipe your finger to display the Biomenu and select Control Center.
  2. Select Fingerprints > Enroll and Edit Fingerprints.
  3. Click the button with a fingerprint icon above the finger you want to delete.
  4. Confirm the operation in the message box.

Delete a user passport (all user data)

  1. Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
    OR
    Swipe your finger to display the Biomenu and select Control Center.
  2. Select Fingerprints > Delete.
  3. Swipe your finger to verify and confirm deleting the current passport. In the Secure mode - see Security mode in System Settings, a list of existing passports is displayed. Select a passport and confirm deleting.

Import or Export a user passport

  1. Go to Start > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
    OR
    Swipe your finger to display the Biomenu and select Control Center.
  2. Select Fingerprints > Import or Export User Data.
  3. To import a passport:
    • Click Import.
    • Browse for the passport file (*.vtp).
    • Enter the password (defined during export).
    To export a passport:
    • Click on Export (In the Secure mode, a list of existing passports is displayed. Select the passport that you want to export and click Export).
    • Select the destination file (*.vtp).
    • Define a password which will protect the exported data.
    • Verify the finger (contained in the passport you are exporting).

Enable advanced security (optional)

For computers containing a special chip for additional encryption (TPM - Trusted Platform Module), the security of your fingerprint software can be increased by additional encryption performed by this chip.
  1. Launch the Enrollment Wizard (Go to Start > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > User Enrollment).
  2. In the Advanced Security dialog after enrollment, check the Enable Advanced Security for the current user.
  3. Set the Advanced Security type.
  4. Set a backup password. This backup password may be used to bypass the fingerprint authentication. We recommend using a strong, complex password. If you do not define the backup password, you can lose your data in the event of authentication hardware failure.

For fingerprints added for power-on security, you must perform the operations described on the finalization page:

  1. Power off your computer.
  2. Turn your computer back on.
  3. Swipe your finger when prompted. Enter your power-on password(s) when prompted. (This creates a connection between your fingers and password(s).)

Note: Biometric operations (enrollment, verification, tutorial) time out after approximately 2 minutes of inactivity to prevent excessive power consumption. In the event of a timeout, simply restart the process.


Sensor Scrolling Feature

You can use your fingerprint sensor for scrolling through the Biomenu and any Windows application instead of the mouse wheel. You can set options for scrolling (speed, acceleration) and the default scrolling hot key.
To turn the scrolling on/off, press the hotkey.
This hotkey is not defined after Protector Suite QL installation.

Learn how to:

Set the hotkey or adjust the scrolling speed

  1. Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
    OR
    Swipe your finger to display the Biomenu and select Control Center.
  2. Select Settings > System Settings.
  3. Select the Scrolling tab.
    • Click the Test Scroll button to test scrolling with selected values.
    • Speed - Move the slider to adjust the scrolling speed. This sets how much will the cursor move when you move your finger over the sensor.
    • Acceleration - Move the slider to set the scrolling acceleration. The faster you swipe over the sensor, the faster will be the scrolling.
    • To set the scroll switch hotkey, set focus to the Scroll Switch Hotkey field. Press the key(s) you want to use for turning the scroll feature on/off.
  4. Click OK to close the dialog.

Note: Scrolling is temporarily blocked when an operation which requires fingerprint verification (e.g. opening User Settings)is invoked.


Biomenu

The Biomenu provides a quick access to Protector Suite QL's features and settings. Available items depend on installed components.

Swipe an enrolled finger over the sensor to display the Biomenu.

To display the Biomenu in a situation when finger verification invokes another action (e.g. a registered page is replayed), hold Shift when using the sensor.

Lock computer

The first menu item contains the Lock computer command which locks your computer. Swipe your finger over the sensor to unlock the computer again.

Registered Sites(optional)

Displays a list of your web pages registered by Password Bank. To display and fill in a registered page in your default web browser, click the web page name in the list.

Register(optional)

Registers a new window (dialog or web page).

Lock/unlock My Safe

Opens or closes My Safe folder.

Lock all archives (optional)

Will lock all File Safe archives that are currently opened. This item will be displayed only when at least two archives are unlocked.

Control Center

Displays the Control Center dialog.

Help

Displays this help. To display context-sensitive help, press F1 in the dialog for which you need help.

The Biomenu is available in several skins. To view or change skins, open the Control Center > Settings > User Settings, swipe your finger to verify and go to the Biomenu skin tab


Help

ThinkVantage Fingerprint Software Settings

Protector Suite Settings

Protector Suite QLThinkVantage Fingerprint Software settings are accessible from the Control Center. The items in the Settings vary according to your system, installation and administrative privileges of the current user.

System Settings

System Settings contain settings common for all users. Access to these settings is limited to administrators.

User Settings

User Settings contain user specific settings. These settings are protected by your fingerprint.

Power-on Security

Power-on security allows fingerprints to be used for user authentication at computer startup.

Fingerprint Storage Inspector

Opens the Fingerprint Storage Inspector dialog where you can see the contents of your fingerprint device memory (if applicable).


Power-on Security

The power-on security feature prevents unauthorized access to the user's computer at the BIOS level. Computers with power-on security enabled will not load the operating system from the hard drive without successful fingerprint authentication. Fingerprint samples are stored in the memory of your fingerprint device. During computer boot, you are asked for a fingerprint authentication. You have a limited time to swipe a finger over the sensor. The computer will boot only if the scanned fingerprint matches a sample stored in the memory of the device. After successful verification, the boot process continues normally.

Enabling Power-on Security

Options for working with power-on security are displayed only if your computer supports this feature (supported mainly in laptops). In most configurations, power-on security is enabled automatically after enrolling the first user.

Learn how to:

To disable/enable the power-on security:

  1. Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
    OR
    Swipe your finger to display the Biomenu and select Control Center.
  2. Select Settings > Power-on Security. (The wizard will be displayed only in the event that your device supports power-on security.)
  3. Select Replace the power-on and hard drive passwords with the fingerprint reader.
  4. Click on Finish.

To enable power-on security single sign-on:

Power-on security can be configured to interoperate with the fingerprint logon. If a fingerprint used for BIOS power-on security feature matches a fingerprint on an existing passport, the corresponding user is logged on automatically without having to enter the Windows password or swipe a second time.

  1. Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
    OR
    Swipe your finger to display the Biomenu and select Control Center.
  2. Select Settings > System Settings.
  3. Select the Logon tab.
  4. Check the Allow power-on security single sign-on check box. (Logon support must be enabled for this option to be accessible.)

Note: Your hardware must support Power-on security to use this single sign-on feature. You must have administrative privileges to change settings.

Fingerprint Management

Fingerprints are added during enrollment.

If enrollment to your hard disk is set, more options are available in the Power-on Security dialog. Fingerprints in the power-on security memory are listed in the Authorized fingerprints for power-on security window. You can remove fingers from the power-on security memory here. For adding fingerprints to power-on security, please see Fingerprint Enrollment > Enroll a new user.


Fingerprint Reader Infopanel

The fingerprint reader infopanel contains information about your sensor and a test window for fingerprint scanning. You can use this dialog to get details about your sensor in the event of a hardware problem for communication with the technical support etc.

To display the Fingerprint Reader Infopanel

  1. Select Start > Control Panel
  2. Click on the Fingerprint Sensor icon. Fingerprint Reader Infopanel dialog will appear.
    • Select the Version tab to display information about your sensor (such as device type, name, version etc.).
      To export the information to a text file click on Save and choose a location where the file will be saved (FingerprintSensorVersion.txt by default).
    • Select the Finger Test tab to see test images of the scanned fingerprints when swiping your finger over the sensor.
  3. Click Close to close the dialog window.


Fingerprint Logon

Fingerprint Logon allows you to logon to Windows or unlock the computer using your fingerprint.

The standard Windows logon can still be enabled if desired or disabled in order to eliminate the security risks of stolen passwords.

Protector Suite QLThinkVantage Fingerprint Software also interoperates with the Novell network logon. In order for the Protector Suite QLThinkVantage Fingerprint Software to log you on automatically to a Novell network, your Windows user name and password must match your Novell user name and password. The following Novell clients do not work with Protector Suite QLThinkVantage Fingerprint Software: 4.83, 4.90


Password Bank

Password Bank is an optional feature of Protector Suite.

When installed, the Password Bank stores registrations (user names, passwords and other settings) of your web sites and password dialogs so that you can access frequently visited web pages and applications (web mail, bank accounts,e-commerce, etc.) securely, without the hassle of re-entering user names, passwords and form data. You enter the required information only once, during web page or password dialog registration. When the window is displayed again, you can replay the data by using the sensor. Registered web sites can also be accessed also directly from the Biomenu.


Application Launcher

The Application Launcher is an optional feature of the Protector Suite QL software.

When installed, it enables you to launch registered applications by simply swiping your finger over the sensor.


File Safe

File Safe is an optional feature of Protector Suite QL.

File Safe allows you to store your files in an encrypted archive on your hard drive. Encrypted archives can contain files or folders and are protected by fingerprint verification or a password if you set it when you are creating an archive. When a File Safe archive is unlocked, you can work with the archive file as with a standard folder (delete, copy, or rename files, etc.). Drag and drop is also supported. You can simply copy and paste or drag your files to your unlocked archive and when you lock it again, your files will be encrypted. When only one file is encrypted in an archive and it is unlocked, clicking on the file will launch it. You can also share your encrypted archives with other users that have enrolled fingerprints.


Advanced Security

Security in the Protector Suite QLThinkVantage Fingerprint Software can be increased by additional encryption. Possible types of this encryption depend on your hardware. Advanced security can be enabled (or later disabled) per user at the end of the fingerprint enrollment wizard. Types of encryption can be changed in this dialog to adjust the necessary level of security and user convenience in your installation.

Fingerprint Reader Key

Hardware-based security. User secret data will be protected by a secure key stored inside fingerprint reader and released only on successful finger match. Data are encrypted using the key stored in fingerprint device.

Fingerprint Reader Key with TPM

Improved hardware-based security. Encrypted channel between TPM Security Chip and Fingerprint Reader further enhances security of user secret data. Recommended for highest security.

TPM Key without PIN

User secret data will be protected by the TPM Security Chip. Recommended for higher convenience.

TPM Key with PIN

User secret data will be protected by the TPM Security Chip with PIN. Requires the user to enter a PIN during every identity verification. Recommended for high security.


Help

Credential Providers

When using Windows Vista, rights of users must be elevated before changing System Settings. Click on Elevate administrative privileges for user and when Vista User Account Control dialog appears, click Allow. The Control Center dialog will reappear without the shied icon. Your user rights are now elevated and you are authorized to access and change System Settings.

What are Credential Providers?

Credential Providers register credentials entered by users and verify them to the system. The ways how users enter their credentials differ according to the Credential Provider. The Microsoft Password Provider requires user name and password, the Fingerprint Provider swiping users' finger over the sensor. The list of credential providers will vary according to configuration of a particular system.

Configuring Credential Providers

The manner of user verification for the following features can be defined by configuring the Credential Providers:

  • Logon will affect how users will authenticate when logging into the system (e.g. by fingerprint only, by name and password, etc.)
  • Unlock will affect how users will authenticate when unlocking the computer
  • Run as administrator is a feature of Windows Vista when a user logged as a limited user can authenticate as an administrator to run a restricted application.
  • Password will set what type of authentication is required when the user password is being changed.

To configure provider settings:

Select a Provider from the list and click on Details.

  • On will turn the Provider on. For example, when On is set for the Fingerprint Provider in the Logon section, users will be prompted to authenticate by swiping their finger over the sensor when logging into the computer.
  • Off will turn the Provider off. For example, when in Logon section Microsoft Password Provider is set to Off and the Fingerprint Provider to On, only fingerprint verification will be allowed on logon.
  • Wrapped - for a user the wrapped Provider seems to be still On, but control of its functions will be taken over by the Provider that is set to On
    When a provider is wrapped the following features can be used:
    Select Mark enrolled user pictures to display a specific user icon to mark that a provider is wrapped. If not selected, the icon will appear as usual.
    Select Allow users self-enroll in logon to allow users (that have a valid password but no fingerprints enrolled) to enroll when logging into the computer in case fingerprint verification is required.

The Fingerprint Provider cannot be set as wrapped but can wrap other providers (such as Microsoft Password Provider).


Selecting Enrollment Type

Your authentication data can be stored either to your hard disk, or directly to your fingerprint device.

Some fingerprint devices allow advanced security by additional encryption. This means that your data will be protected by a software encryption key generated by your fingerprint software together with a hardware encryption key obtained directly from your device. Your data cannot be accessed without the corresponding fingerprint device.

Enrollment to the hard disk is necessary for users who plan to enroll more than 21 fingerprints. In this case, authentication information is stored in registry encrypted by keys generated by software.


Elevate users rights in Windows Vista

Elevate administrative privileges for user

Elevate administrative privileges for user

for Windows Vista only

If you want to access and make changes in System Settings or manage and modify other users accounts (e.g. to be able to enroll or delete fingerprints of other users), you need to elevate your administrative rights, i.e. verify yourself as an authorized user.

  1. Click Elevate administrative privileges for user
  2. When Vista User Account Control dialog appears, enter your credentials to authenticate to the system (or just allow the program to continue if you are already logged as an administrator).
  3. The Control Center dialog will reappear without the shied icon. Your administrative rights are now elevated. Now you can access Settings > System Settings and make changes.

You must repeat this procedure each time you run the Control Center dialog.


Fingerprint Storage Inspector

Fingerprint storage inspector is a tool for viewing and editing contents of the storage in your fingerprint reader device. All the records stored in your device are shown.

This feature is available only when enrollment to device is used.

For each fingerprint, its description is shown together with information about its usage for power-on security (pre-boot authentication), applications (e.g. Logon), and advanced security status (TPM or no advanced security).

To remove fingerprints from the device:
  • Select the record you want to delete and click the Remove button. The list of records will be updated to reflect the change.
  • After you remove all unnecessary records, click the OK button to make the changes permanent or click Cancel to discard the changes.

At least one fingerprint must remain for each passport. To manage or delete the whole passport, use the Enroll or Edit fingerprints wizard.

Note: The authorization to remove fingerprints is defined in the Security mode policies settings (see Security mode in System Settings). Some rights may be restricted to fingerprint administrators only.


Scrolling

You can set the speed and acceleration of the scrolling. The default scroll switch hotkey can also be changed.

To perform scrolling setup:

  1. Open the Control Center, select Settings - System Settings.
  2. Select Scrolling.
    • Speed - Move the slider to adjust how fast scrolling occurs when you move your finger on the sensor.
    • Acceleration - Move the slider to set the scrolling acceleration.
    Click the Test Scroll button to test scrolling with selected values.
  3. To set the scroll switch hotkey, set focus to the Scroll Switch Hotkey field. Press the key(s) you want to use for turning the scroll feature on/off.


Changing Windows Logon Password

Windows logon password can be changed both by a user (through the control panel or ctrl+alt+del dialog) or by an administrator (through password reset). There is no difference between both types of password change with respect to Protector Suite QLThinkVantage Fingerprint Software. The scenarios differ according to what type of user account is used and the way the user logs on to the computer. This applies to Windows 2000 and XP and Windows Vista (on Windows Vista the functionality is similar but the different GUI is displayed).

When a local user account is used on a computer in a workgroup or in a domain, there are two possible scenarios:

  1. A user logs on using the Windows user name and password and the password is then changed:
    • The user locks the computer or logs off.
    • The user swipes an enrolled fingerprint.
    • A warning is displayed that a wrong user name or password is used.
    • The user must enter the new password. This password is then stored into the fingerprint passport, the passport is updated and the user is logged on to the computer. The fingerprint logon will proceed as usual the next time.
  2. A user logs on using an enrolled fingerprint and the password is then changed:
    • The password is stored into the fingerprint passport. There is no need to enter the new password again later.
    • The user locks or logs off.
    • User swipes enrolled fingerprint.
    • The computer is unlocked or the user is logged on.

When a domain user account is used in a domain:

    User logs on using the Windows user name and password or an enrolled fingerprint. The password is then changed:
    • The user locks the computer or logs off.
    • The user swipes an enrolled fingerprint.
    • A warning is displayed that a wrong user name or password is used.
    • The user must enter the new password. This password is then stored into the fingerprint passport, the passport is updated and the user is logged on to the computer. The fingerprint logon will proceed as usual the next time.

Special cases:

    “User must change password at next logon” is set or password expiration is defined on domain.
    • On a client computer a user logs on using enrolled fingerprint.
    • A dialog prompting the user to change their password will appear. This password is then stored into the fingerprint passport, the passport is updated and the user is logged on to the computer. The fingerprint logon will proceed as usual the next time.


Help

Security Mode Policies

Policies in the Secure and Convenient mode are preset and cannot be modified. Only policies in the Custom mode can be changed.
In the Convenient mode, all users can create, edit or delete their own fingerprint passport.
In the Secure mode only fingerprint administrators have an unrestricted access to all fingerprint management functions (e.g. creating, deleting fingerprint passports for all users), including Fingerprint Storage Inspector and Power-on Security administration.
Custom mode polices settings can be set up differently for fingerprints administrators and limited users.

Learn how to:

Choose a security mode:

  1. Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
    OR
    Swipe your finger to display the Biomenu and select Control Center.
  2. Select Settings > System Settings.
  3. Select the Security Mode tab.
  4. Choose a mode:
    • Secure mode. In the Secure mode only a fingerprint administrator has an unrestricted access to all fingerprint management functions (e.g. creating, deleting fingerprint passports for all users), including Fingerprint Storage Inspector and Power-on Security administration.
    • Convenient mode. In the Convenient mode, all users share the same rights. For example, all users can create, edit or delete their own fingerprint passport.
    • Custom mode. Custom mode polices settings can be set up differently for an administrator and limited users.
  5. Click OK to close the dialogs.

Edit policies in the Custom mode:

  1. Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
    OR
    Swipe your finger to display the Biomenu and select Control Center.
  2. Select Settings > System Settings.
  3. Select the Security Mode tab.
  4. Click the Custom mode radio button, then click on Details . The policies window will appear. See details of policies below.
  5. Click the Change button (or double-click) to edit the policy settings.
  6. Click OK to close the dialogs.

    7. Policies can be defined differently for a Fingerprint Administrator and a Limited user accounts. Select Allow/Deny to set rights for each user group. You can copy polices settings from the Convenient or Secure mode to the Custom mode and then edit them further. This is convenient when you would like to make just a few changes to the polices settings.

Copy Policies:

You can copy policies settings from the Convenient or Secure mode to the Custom mode and then edit them further. This is convenient when you would like to make just a few changes to the policies settings.

  1. Go to Start menu > Programs > Protector Suite QL ThinkVantage > ThinkVantage Fingerprint Software > Control Center.
    OR
    Swipe your finger to display the Biomenu and select Control Center.
  2. Select Settings > System Settings.
  3. Select the Security Mode tab.
  4. Click the Custom mode radio button, then click on Details . The policies window will appear. See details of policies below.
  5. Click the Copy button to copy the policies settings.
  6. Choose the Secure or Convenient mode and the policies settings will copy from the selected mode.
  7. Click the Change button (or double-click) to edit the policy settings. See details of policies below.
  8. Click OK to close the dialogs.

Details of Policies:

Enrollment:
  • Delete other users: Allows a fingerprint passport to be deleted for any user enrolled on this computer. No verification is required before passports are deleted.
  • Delete self: After verification allows a fingerprint passport to be deleted for the currently logged on user.
  • Edit other users: Allows a fingerprint passport to be edited for any user enrolled on this computer, e.g. adding or deleting enrolled fingerprints.
  • Edit self: Allows a fingerprint passport to be edited for the currently logged on user, e.g. adding or deleting enrolled fingerprints.
  • Enroll other users: Allows other users to enroll fingerprints. Only users with a valid Windows account can be enrolled.
  • Enroll self: Allows the currently logged on user to enroll fingerprints.
  • Enroll users without scanning fingerprints: Allows users to be enrolled without scanning their fingerprints. Users will be prompted to scan their fingerprints the next time they logon.
  • Export other users: Allows a fingerprint passport to be exported for any user enrolled on this computer.
  • Export self: Allows a fingerprint passport to be exported for the currently logged on user.
  • Import other users: Allows a fingerprint passport to be imported for any user enrolled on this computer.
  • Import self: Allows a fingerprint passport to be imported for the currently logged on user.
  • Reveal password: Allows the user's Windows password to be revealed during the fingerprint enrollment.
Fingerprint Storage Inspector:
  • Delete any fingerprints: Allows to delete any fingerprints from your device. (The Use Fingerprint Storage Inspector policy must be enabled for this policy to take effect.)
  • Delete unused fingerprints: Allows fingerprint records that do not belong to any locally enrolled user to be deleted, e.g. from previous installation. (The Use Fingerprint Storage Inspector policy must be enabled for this policy to take effect.)
  • Delete other users’ fingerprints: Allows fingerprints of other users to be deleted. However, at least one fingerprint must remain enrolled for each user. (The Use Fingerprint Storage Inspector policy must be enabled for this policy to take effect.)
  • Use Fingerprint Storage Inspector: Allows use of the Fingerprint Storage Inspector, i.e. users can delete only their own fingerprints (except for the last one, i.e. at least one fingerprint must remain enrolled).
Power-on Security:
  • Enable/Disable Power-on security: Allows Power-on security to be enabled or disabled on this computer.
  • Add fingerprints to Power-on security: Allows fingerprints to be added to Power-on security during enrollment. If disabled, enrolled fingerprints cannot be used for Power-on security verification.


Help

System Settings

System settings are accessible from the Control Center under the Settings folder. Only an administrator can change the system settings.

If using Windows Vista, click Elevate administrative privileges for user in the Control Center dialog to authorize yourself to access and change the System Settings.

General

You can disable displaying the Control Center on Windows startup.

Logon

    Select or deselect the following options:
  • Fingerprint Logon - When this option is selected the fingerprint logon to your computer is enabled.
      • If you are using Windows Vista, click on Details. to see settings of credential providers , i.e. ways how users authentication to the system is managed.
    • Do not show CTRL+ALT+DEL message - The standard Windows CTRL+ALT+DEL message will not be displayed. Only a hint to swipe a finger will be shown. (The logon dialog for entering user name/domain/password can be invoked by pressing CTRL+ALT+DEL so that users are able to log on using user name and password.)
    • Allow to bypass logon using Windows password- If this option is checked, the standard Windows logon can be used. If unchecked, only users defined as fingerprint administrators (see Security Mode below) can logon using user name and password.
    • Allow user self-enrollment on logon - users are allowed to enroll their fingers themselves when logging in the computer.
  • Fast User Switching - When this option is selected, biometric fast user switching controlled by your fingerprint is enabled (if supported on your system). When fast user switching is supported but not enabled, you will be asked to enable it on your system. Fast user switching cannot be enabled when the computer is a member of a domain.
  • Standard Windows logon - When this option is selected the fingerprint logon is disabled and the standard Windows logon is used.
  • Allow power-on security single sign-on - Select this option to perform power-on and logon fingerprint authentication in one step. User verified at BIOS level is automatically logged on to Windows.

If you change your Windows logon password through the control panel (ctrl+alt+del dialog), or the administrator updates it via active directory, you must logon with the new password to update the Fingerprint Logon credentials. The credentials will not be updated until you log off and on or restart your computer. Locking and unlocking the computer or switching the users will not enable the update.

Security Mode

Protector Suite QL ThinkVantage Fingerprint Software can operate in three security modes:
Secure mode, Convenient mode, and Custom mode.

The security modes differ in rights granted to users. These rights include e.g. permissions to enroll users, delete or edit fingerprints.

Click on Details to see the settings of security policies in each mode. Only policies in the Custom mode can be edited. Learn more about Security Mode policies.

Administrators' Groups

    Contains a list of local or domain security groups of users defined as "fingerprint administrators" . These users are granted administrative rights for managing Protector Suite QL ThinkVantage Fingerprint Software. Their rights are defined in the Security mode policies (see below).

Sound

Select sounds used when a fingerprint software operations succeeds or fails. You can use your default system sounds, disable sounds, or browse for your favorite audio file (.wav format).

Biometry

Biometric settings allow you to modify the level of security settings of the fingerprint sensor. A reboot is required each time you make any changes.
  • Intruder Lockout
    • Lockout count: sets how many unsuccessful attempts for verification (finger swipes) are allowed before the device is locked.
    • Lockout time: sets for how much time the device will stay locked. After this time the fingerprint sensor can be used again.
  • Biometric Performance

    • This will set up how accurately a fingerprint scan must match the enrolled samples. Please note that using the lowest level may compromise the security of the device. The highest level, however, requires a perfect match with the enrolled sample and may result in repeated unsuccessful verifications also for the authorized users. The medium level is recommended and is set up as default.

Scrolling

You can use your fingerprint sensor for scrolling through the Biomenu instead of the mouse wheel. You can set options for scrolling (speed, acceleration) and the default scrolling hot key.
Learn how to change the settings.

TPM (optional)

This page is displayed when a third party TPM management application is detected. TPM initialization enables usage of the TPM security module by the Advanced Security feature.


Tray Icon

The tray icon provides quick access to the following Protector Suite features.

  • Edit Fingerprints
    Opens the fingerprint enrollment wizard to register additional fingers. You can launch this wizard also from the Control Center by selecting Fingerprints - Enroll or Edit Fingerprints.
  • Don't Use Sensor/Use Sensor
    Allows detaching your fingerprint device if necessary for another application. This command temporarily frees the device only for the current user session. (The device can be used only exclusively by one application at a time.)
  • Control Center
    Opens the Control Center.
  • Help
    Opens this help.
  • About
    Displays information about the program and its version.


User Settings

General

Check the Show icon in tray check box to display the tray icon which gives you quick access to some Protector Suite QL functions.

Biomenu Skin

Select a skin (appearance) for the Protector Suite's Biomenu. A sample is displayed on the right side of the page. (Skin preview is not supported on Windows 2000.)

Password Bank

(optional)

This dialog consists of two parts. The first part is visible to all users. It contains user user specificings of hints displayed to inform a user about possible actions of the Password Bank.
The second part is visible only to administrators. If you want to install Password Bank's support for a browser, check the corresponding check box.

Registrations

(optional)

Select a registration from the list and click one of the buttons - Rename to rename the registration, Edit to edit the registration, Delete to delete the registration. Click Export to export your registrations for use on another computer or backup, and Import to import registrations from an export file.

My Safe

My Safe page displays the status and size of My Safe folder. The free and used space is also displayed for unlocked safe. The set of buttons allows performing various actions with My Safe folder. Change My Safe status (lock or unlock My Safe) to enable disabled buttons.

File Safe

You can set or modify the password protecting your files stored in encrypted File Safe archives. This password will protect all your archives that are set to be protected by the Global Backup Password. It is recommended to use a backup password because if you do not there is no way how to access the files stored in the File Safe archive when fingerprint verification is not possible (in the event of finger injury, device problem, etc.). Use a strong password, i.e. at least eight characters long, including non-alphanumeric characters etc. Changing this password does not affect already created File Safe archive(s). The archives currently locked will still use the old password. Learn more about File Safe.

Applications

Displays applications that can be launched by your fingerprints. At least one enrolled finger must remain unassigned to display the Biomenu. The maximum number of applications you can launch this way is equal to number of enrolled fingers - 1. See Application launcher to learn how to create an association between enrolled fingers and apapplications.