hmLoadTopic({
hmKeywords:"2FA,Two Factor Authentication",
hmTitle:"Two-Factor Authentication",
hmDescription:"Two-Factor Authentication (2FA) provides a more secure method to log into and access ESET PROTECT Web Console. Users with 2FA enabled will be required to log into ESET PROTECT...",
hmPrevLink:"admin_ar_assign_user_a_permission_set.html",
hmNextLink:"admin_ar_permissions_sets.html",
hmParentLink:"admin_ar_users.html",
hmBreadCrumbs:"<a href=\"using.html\">Using ESET PROTECT On-Prem<\/a> &gt; <a href=\"working_with_era.html\">ESET PROTECT On-Prem Main Menu<\/a> &gt; <a href=\"admin.html\">More<\/a> &gt; <a href=\"admin_access_rights.html\">Access Rights<\/a> &gt; <a href=\"admin_ar_users.html\">Users<\/a>",
hmTitlePath:"Using ESET PROTECT On-Prem > ESET PROTECT On-Prem Main Menu > More > Access Rights > Users > Two-Factor Authentication",
hmHeader:"<h1 class=\"p_Heading1\"><span class=\"f_Heading1\">Two-Factor Authentication<\/span><\/h1>\n\r",
hmBody:"<p class=\"p_Normal\">Two-Factor Authentication (2FA) provides a more secure method to log into and access ESET PROTECT Web Console. Users with 2FA enabled will be required to log into ESET PROTECT On-Prem using <a href=\"https:\/\/support.eset.com\/kb3287\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">ESET Secure Authentication<\/a> or a third-party authenticator.<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\">There is no limit to the number of users who can log into ESET PROTECT On-Prem via 2FA.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_UI\">HTTP Proxy<\/span><span class=\"f_NormalList\"> settings are not applied for communication with Two-Factor Authentication (2FA).<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>You can enable 2FA also for the Administrator account.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">Prerequisites<\/span><\/h2>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><span class=\"f_NormalList\">To enable 2FA for another user, the current user needs the <\/span><span class=\"f_UI\">Write<\/span><span class=\"f_NormalList\"> permission over that user. When 2FA is enabled, a user needs to configure 2FA themselves before logging in. Users will receive a link via text message (SMS), which they can open in their phone\'s web browser to view instructions for configuring 2FA.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>2FA does not work without direct network access to <a href=\"https:\/\/support.eset.com\/kb332\/#esa\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">ESET 2FA servers<\/a>. Allowing at least specific 2FA servers in the firewall is necessary. If the proxy is set up in the <span class=\"f_UI\">More<\/span> &gt; <span class=\"f_UI\">Settings<\/span> &gt; <span class=\"f_UI\">Advanced Settings<\/span> &gt; <span class=\"f_UI\">HTTP Proxy<\/span>, it does not apply for the 2FA.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">Enable Two-Factor Authentication for a Web Console user<\/span><\/h2>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span>Create a new user or use an existing one.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span>Click <span class=\"f_UI\">More<\/span> &gt; <span class=\"f_UI\">Users<\/span> in the ESET PROTECT Web Console.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">3.<\/span>Click the user and select <span class=\"f_UI\">Two-Factor Authentication<\/span> &gt; <img alt=\"Enable\" title=\"Enable\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/apply_default.png\"\/><span class=\"f_UI\">Enable<\/span> and select the option you want to use:<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 13px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><img alt=\"ESET Secure Authentication\" title=\"ESET Secure Authentication\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_eset.png\"\/><span class=\"f_NormalList\"> <\/span><span class=\"f_UI\">ESET Secure Authentication<\/span><span class=\"f_NormalList\">—2FA provided by ESET using <a href=\"https:\/\/www.eset.com\/us\/business\/solutions\/multi-factor-authentication\/\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">ESET Secure Authentication<\/a> technology. You do not need to deploy or install ESET Secure Authentication within your environment, as ESET PROTECT On-Prem automatically connects to ESET servers to authenticate users who log into your ESET PROTECT Web Console.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 32px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span><img alt=\"Third-party authenticator\" title=\"Third-party authenticator\" width=\"16\" height=\"16\" style=\"margin:0;width:16px;height:16px;border:none\" src=\".\/images\/icon_license_owner.png\"\/> <span class=\"f_UI\">Third-party authenticator<\/span>—You can use a third-party authentication client which supports the required TOTP protocol. We have tested the following applications: <a href=\"https:\/\/www.google.com\/search?q=google+authenticator\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">Google Authenticator<\/a>, <a href=\"https:\/\/www.microsoft.com\/en-us\/security\/mobile-authenticator-app\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">Microsoft Authenticator<\/a> or <a href=\"https:\/\/authy.com\/\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">Authy<\/a>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">4.<\/span>When the user logs in the next time, type the user\'s phone number when prompted.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">5.<\/span><a href=\"https:\/\/support.eset.com\/kb3297\/\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">Install ESET Secure Authentication mobile app<\/a> or a third-party authentication application on the user\'s mobile phone using the link from SMS or QR code.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">6.<\/span>When you install the app using the token, your ESET PROTECT On-Prem is added to the app.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">7.<\/span>Proceed to login and type the one-time password from the mobile app to the Web Console when prompted. A new one-time password is generated every 30 seconds.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">8.<\/span>Optionally, select the <span class=\"f_UI\">Remember this device<\/span> check box to authorize your device not to request 2FA for every login.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 0;\"><table class=\"Table_note\" >\n\r<tr class=\"Table_note\">\n\r<td class=\"Table_note\" style=\"width:4px; background-color:#3DAAE1;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_note\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Note\" title=\"Note\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/note.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_note\"><p class=\"p_Normal\">You can forget remembered devices for the active user in <a href=\"user_settings.html#remembered_devices\" class=\"topiclink\">User settings<\/a>.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">9.<\/span>Click <span class=\"f_UI\">Submit<\/span>.<\/p>\n\r<h2 class=\"p_Heading2\" style=\"page-break-after: avoid;\"><span class=\"f_Heading2\">Troubleshooting<\/span><\/h2>\n\r<p class=\"p_Normal\">The user will be locked after typing the one-time password incorrectly ten times. The Administrator can unlock the user in <span class=\"f_UI\">More<\/span> &gt; <span class=\"f_UI\">Users<\/span> &gt; click the user and select <span class=\"f_UI\">Unlock<\/span>.<\/p>\n\r<p class=\"p_Normal\">If a Web Console user cannot log into the Web Console with 2FA, follow these steps:<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">1.<\/span><a href=\"https:\/\/help.eset.com\/getHelp?product=protect_install&amp;version=13.0&amp;lang=en-US&amp;topic=db_backup\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">Back up the ESET PROTECT database<\/a>.<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 20px; margin-left: 0;\"><span class=\"f_Normal\" style=\"display:inline-block;width:20px;margin-left:-20px\">2.<\/span>Select the applicable option:<\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 13px; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>The phone number set up for 2FA is accessible:<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">a)<\/span><span class=\"f_NormalList\">During the Web Console login, click <\/span><span class=\"f_UI\">Reset Token<\/span><span class=\"f_NormalList\"> in the 2FA window.<\/span><\/p>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 39px; margin-left: 0;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">b)<\/span>A verification SMS is sent to the phone number set up for 2FA.<\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 13px;\"><table class=\"Table_warning\" >\n\r<tr class=\"Table_warning\">\n\r<td class=\"Table_warning\" style=\"width:4px; background-color:#E04239;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_warning\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Warning\" title=\"Warning\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/warning.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_warning\"><p class=\"p_Normal\">You cannot change the phone number stored in the ESET PROTECT database. If the phone is inaccessible, follow the steps below.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_Normal\" style=\"text-indent: 0; padding-left: 13px; margin-left: 0;\"><span class=\"f_Normal\" style=\"font-family: Arial,\'Lucida Sans Unicode\',\'Lucida Grande\',\'Lucida Sans\';display:inline-block;width:13px;margin-left:-13px\">&#8226;<\/span>The phone number set up for 2FA is inaccessible (the phone is lost, damaged, etc.)<\/p>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">a)<\/span><span class=\"f_NormalList\"><a href=\"https:\/\/support.eset.com\/kb7808\" target=\"_blank\" onclick=\"return HMTrackTopiclink(this);\" class=\"weblink\">Reset the Web Console password<\/a> to disable 2FA on the Administrator account.<\/span><\/p>\n\r<p class=\"p_NormalList\" style=\"page-break-inside: avoid; page-break-after: avoid;\"><span class=\"f_NormalList\">&nbsp;<\/span><\/p>\n\r<div style=\"text-align: left; text-indent: 0; padding: 0 0 0 0; margin: 0 0 10px 13px;\"><table class=\"Table_note\" >\n\r<tr class=\"Table_note\">\n\r<td class=\"Table_note\" style=\"width:4px; background-color:#3DAAE1;\"><br \/>\n\r<\/td>\n\r<td class=\"Table_note\" style=\"width:20px;\"><p class=\"p_Normal\"><img alt=\"Note\" title=\"Note\" width=\"20\" height=\"20\" style=\"margin:2px 0 0 0;width:20px;height:20px;border:none\" src=\".\/images\/note.svg\"\/><\/p>\n\r<\/td>\n\r<td class=\"Table_note\"><p class=\"p_Normal\">Other ESET PROTECT On-Prem user accounts 2FA state remains unaffected.<\/p>\n\r<\/td>\n\r<\/tr>\n\r<\/table>\n\r<\/div>\n\r<p class=\"p_NormalList\" style=\"text-indent: 0; page-break-inside: avoid; page-break-after: avoid; padding-left: 20px; margin-left: 19px;\"><span class=\"f_NormalList\" style=\"display:inline-block;width:20px;margin-left:-20px\">b)<\/span><span class=\"f_NormalList\">The user can log into the Web Console without 2FA and then re-enable 2FA after logging in.<\/span><\/p>"
})
