Configuring Walk-Away Security for Unattended Workstations

A notification can be displayed to let users know who is currently logged into Enterprise Access Management on a shared workstation.

When a user taps a proximity card at an idle workstation:

• If the user is not the currently logged-in user, she will be authenticated, displacing the current user.
• If the user is the current user, she inadvertently logs herself out.

To display a notification:

1. Go the Walk-Away Security tab, and open Advanced settings.

2. Enable Display a notification of the current signed-in user after 60 seconds of inactivity.

3. If required, update the amount of time to wait before the notification is displayed.

You can configure workstations to show a warning, and then lock automatically, when Enterprise Access Management fails to detect activity after a specified period of time. At the configured time, a countdown to locking the workstation starts.

A locked workstation displays the standard Windows login screen and requires re-authentication to unlock the desktop.

Set Lock Times and Warnings for Inactive Computers

To set warning and locks times for inactive computers:

1. Open the Walk-Away Security tab.

2. Go to the Inactivity detection > Keyboard and mouse section.

3. Use Lock workstation after and Show activity warning to specify the required values.

4. If required, adjust the Imprivata ID inactivity and warning thresholds.

   These values manage desktop locking when the phone is detected, but there is no keyboard and mouse activity.

   For example – the phone is detected after the user logs in, but the user leaves the workstation without their phone.

Configure Inactivity Behavior for Application Profiles

You can also configure inactivity behavior for specific application profiles. Application activity tracking monitors the state of one or two specified applications, such as Epic Hyperdrive or Google Chrome and locks the workstation faster when the user logs off or the application becomes idle, overriding the standard keyboard and mouse inactivity thresholds. This prevents unauthorized access when users walk away without explicitly locking their workstations.

To control the appearance of the warning screen, see Warning Behavior.

To configure application activity tracking:

1. Open the Walk-Away Security tab.

2. If it is not enabled, configure keyboard and mouse inactivity.

3. Open Advanced settings, and go to the Application activity tracking section.

4. Under inactivity target app1, select an application profile. For example, Epic Hyperspace.

5. Under Target app 1 state, select one of the following:

   1. User is logged off

   2. Application is not running

   3. User is logged off OR Application is not running.

6. Repeat steps 4 and 5 of this procedure for inactivity target app 2, if needed.

7. Specify a period of time after which the workstation is locked, and click Save. The application-specific lock time should be configured to be less than the standard keyboard and mouse inactivity threshold.

Manage Inactivity Detection for Video Conferencing and Presentation Applications

During the use of video conferencing and presentation applications, keyboard and mouse input might be minimal. Even though the user is actively using the workstation, the lack of input can result in an inactivity timeout. To prevent unnecessary user disruption, you can override the existing inactivity detection thresholds for the following desktop applications only:

• Microsoft Teams

• Webex

• Zoom

• Microsoft PowerPoint (Slide Show view)

To configure inactivity detection thresholds for conferencing and presentation applications:

1. Click Advanced Settings, and go to the Video conferencing and presentation applications section.

2. From the Presentation and meeting mode list, select the required locking behavior.

3. In Keep workstation unlocked for, specify a duration for which the workstation remains unlocked when video conferencing and presentation applications are being used. Be sure that the value is greater than the keyboard and mouse inactivity threshold.

4. If a lock warning is being used, specify how long it should remain visible before the workstation is locked in Lock warning.

The settings in the Advanced settings > Proximity card lock behavior section of the Walk-Away Security tab let you to customize settings for users who authenticate to this computer by proximity card.

Proximity cards require a number of settings, all of which are detailed in Authentication for Smart Cards with Microsoft Active Directory (AD) Certificates.

The Lock and warning behavior > Warning behavior section of the Walk-Away Security tab lets you configure two types of warnings to notify the user that the workstation is going to lock when the countdown reaches 0:00.

1. Select the type of warning to use for this computer policy.

   The inactivity times configured in Inactivity-Based Presence Detection are enforced.

2. (Optional) Click Customize the warning and lock display text to modify the default warning behavior.

When a computer reaches the Lock workstation time set in Inactivity-Based Presence Detection, Enterprise Access Management can obscure the desktop, or you can select an application to remain visible on the desktop for monitoring purposes. These settings are configured in the Lock and warning behavior > Lock behavior section. Obscure the desktop is selected by default.

Under transparent screen lock conditions, the computer display continues to show the active application while the computer is locked. The authentication dialog opens when:

• A user presses any key on the keyboard.

• A user moves the mouse, if the Ignore mouse movement option is not selected.

Configuring Transparent Screen Lock

During transparent screen lock, the computer display continues to show the selected application while the computer is locked. The authentication dialog opens when a user satisfies the Transparent Screen Lock Workflow. In case one of these conditions occurs by accident, you can set the dialog box to close and return to the transparent screen lock state after a pre-defined period.

To configure the transparent screen lock:

1. In the Lock and warning behavior section of the Walk-Away Security tab, select Desktop remains visible (transparent screen lock).

2. Click Customize the warning and lock display text. The Customization tab opens.

3. In the Walk-away security section, select whether the transparent screen lock indicator bar is displayed at the top or the bottom of all displays.

   The screen lock extends to both monitors of a dual monitor configuration.

Transparent Screen Lock Workflow

• A desktop may be locked in a number of ways:

• • EAM inactivity lock (configurable in user policy)

  • User taps proximity card on proximity card reader (configurable in user policy)

  • User presses the Imprivata Hot Key (configurable in user policy)

  • User removes smart card from the reader (configurable in Windows policy)

  • User selects Logout from the Imprivata agent menu

• The desktop remains visible while in the lock state. It is not a snapshot of the desktop. Application updates and other desktop activity are visible to users.

• EAM prompts the user to authenticate when user activity is detected:

• • Typing on the keyboard

  • Clicking a mouse button or moving the mouse (computer policy can be configured to ignore mouse movement)

  • Tapping proximity card on the reader

• When the Imprivata authentication dialog opens:

• If the user does nothing, the authentication dialog is dismissed after a configurable period of inactivity from 5 seconds to 10 minutes.

• The user can dismiss the dialog by pressing the Esc key or clicking Cancel.

• Users can authenticate by whatever method is allowed in the user policy, subject to computer policy overrides.

• If the user authentication is successful, the desktop is unlocked and the user gains access to the desktop.