This document lists late-breaking information for RSA Authentication Agent 6.1 for Microsoft Windows. Read this document before installing the software. This document contains the following sections:
This Readme may be updated. The most current version can be found on RSA SecurCare Online https://knowledge.rsasecurity.com. To print this Readme, click here.
RSA Authentication Agent 6.1 for Microsoft Windows includes the following documentation:
The following documents have been updated for the 6.1.1 product release:
The RSA Authentication Agent 6.1 for Microsoft Windows Installation and Administration Guide has been updated as follows:
The RSA SecurID for Microsoft Windows Planning Guide 1.1 has been updated as follows:
The RSA Authentication Agent 6.1 for Microsoft Windows Installation and Administration Guide and the RSA SecurID for Microsoft Windows Planning Guide 1.1 have not been reversioned for this release. However, the front matter of the RSA Authentication Agent 6.1 for Microsoft Windows Installation and Administration Guide and the RSA SecurID for Microsoft Windows Planning Guide 1.1 lists two dates of printing - the date the books were printed for the original 6.1 product release, and the date the updated books were printed for the 6.1.1 product release.
The RSA Authentication Agent for Microsoft Windows 6.1 Readme has been reversioned to RSA Authentication Agent for Microsoft Windows 6.1.1 Readme.
You can access the Installation and Administration Guide, the Planning Guide, and the Readme directly from the RSA Authentication Agent 6.1.1 for Microsoft Windows downloadable .zip file (this patch). However, you can access the Help only by installing RSA Authentication Agent 6.1.1 for Microsoft Windows.
For wireless authentication using EAP, access points must support 802.1x authentication.
To use wireless LAN with PEAP, install SP2 for Windows XP or SP1 for Windows Server 2003. If you cannot update to the current service pack, you must install Microsoft hot fix Article ID #827537 on the Windows XP client and the Windows Server 2003 host. To get the fix and installation instructions, see "Windows XP Service Pack 1 and Windows Server 2003 wireless clients are not compatible with RSA Security Extensible Authentication Protocol (EAP) type" in the Microsoft Knowledge Database at www.microsoft.com.
To install the RSA Authentication Agent 6.1.1 for Microsoft Windows patch (authagt_win_6.1.1.exe), you must be running RSA Authentication Agent 6.1 for Microsoft Windows. Install this patch ONLY on build 297 of this software. If you are not running build 297, contact RSA Security Customer Support. To verify the version number, do the following:
Important: You must install RSA Authentication Manager 6.1 for Microsoft Windows before you install the RSA Authentication Agent 6.1.1 for Microsoft Windows patch.
You can install this patch manually on each computer running RSA Authentication
Agent 6.1 for Microsoft Windows, or you
can perform a network installation. There are two types of network installations.
You can perform a network installation that automatically restarts all of the
computers running the Authentication Agent. Alternatively, you can perform a
network installation that does not automatically restart all of the computers
running the Authentication Agent.
Important: After installing the Authentication Agent 6.1.1 patch, you cannot log on to a client computer until you restart the computer. If you perform a network installation that does not automatically restart all of the computer running the Authentication Agent, you must restart the computers manually.
To install the RSA Authentication Agent 6.1.1 for Microsoft Windows patch manually:
To perform a network installation that restarts the Authentication Agent computers automatically:
Important: Before you perform the installation, all domain client computers must be running.
To perform a network installation, you must use Microsoft System Management Server (SMS). In your SMS environment, type the following command:
authagt_win_6.1.1.exe /s /v"/qn REINSTALL=ALL REINSTALLMODE=omus"
To perform a network installation that does not restart the Authentication Agent computers:
Important: Before you perform the installation, all domain client computers must be running.
To perform a network installation, you must use Microsoft System Management Server (SMS). In your SMS environment, type the following command:
authagt_win_6.1.1.exe /s /v"/qn REBOOT=ReallySuppress REINSTALL=ALL REINSTALLMODE=omus"
Important: You must disable the offline authentication feature on the Primary Authentication Manager immediately after you install this patch. Offline authentication must remain disabled for a minimum of 12 hours. Doing this enables domain client computers to receive updated offline data.
To disable offline authentication:
The RSA Authentication Agent 6.1.1 for Microsoft Windows patch resolves the following issues:
Tracking number: 25406
The patch enables the Local Authentication Client component to read passcodes
from SID800 tokens when using the Offline Days Status screen to recharge the
supply of offline days.
Tracking number: 25200 and 21153
The ability to invoke RSA Security EAP and RSA Security Protected OTP authentication
from the Desktop Logon dialog using Log on using dial-up connection does
not work. The patch fixes this problem so that both RSA Security EAP methods
are supported for remote dial-up or VPN access.
Tracking number: 24374
The RSA Authentication Agent EAP client component uses the Microsoft Windows
EAP system to save user information between authentications. Without the patch,
saved information from failed and cancelled authentication attempts is not cleared,
and the Authentication Agent does not prompt the user to authenticate with a
different user name.
Tracking number: 24199
Without the patch, clicking Clear Offline Days in the RSA Security Center
more than once causes an error that prevents the download of offline days until
the RSA Security Center is closed.
Tracking number: 24188
Without the patch, when the offline authentication feature is disabled, the
Pin Unlock feature prompts users for RSA SecurID passcodes instead of only their
PINs.
Tracking number: 23802
The patch fixes a problem that can prevent users from logging on to their Microsoft
Windows desktops. Without the patch, the workaround to the problem is to restart
the desktop computer or restart the domain controller.
Tracking number: 23586
Without the patch, when both the Domain Authentication Client component and
Local Authentication Client component are installed on the same computer, the
PIN unlock option does not work for the Local Authentication Client computer.
Tracking number: 23579
The patch fixes a security vulnerability in which desktops protected with RSA
Authentication Agent 6.1 for Microsoft Windows can be accessed by a second user
with a valid userID after the first user has locked the desktop. The vulnerablility
allows an unauthorized user to unlock an authenticated user’s desktop.
Tracking number: 18197
In RSA Authentication Agent 6.1 for Microsoft Windows, you cannot authenticate
from a computer running both the Agent Domain Authentication Client component
and the Agent Domain Server component when the Authentication Manager is unavailable,
even if up-to-date offline data for your account exists. However, you can use
your offline data to authenticate from computers running only the Agent Domain
Client component. After you install the patch, when the RSA Authentication Manager
is offline, you can successfully authenticate using offline data stored on the
domain controller.
Tracking number:19975
In RSA Authentication Agent 6.1 for Windows, you cannot authenticate offline
to a system that is suspended due to low battery power. This problem occurs
because of a misinterpretation of the change in system time associated with
the forced suspension. After you install the patch, the Agent recognizes the
suspension of the system and correctly handles the time change at restart.
Tracking number: 21693
Without the patch, when you use RSA Security EAP with PEAP, the RSA Security
EAP component inapproprietly attempts to validate the NAS IP address. Since
this address is not provided during a PEAP authentication, the authentication
fails.
Tracking number: 20546
Certain Windows applications repeatedly attempt to authenticate users even after
the user receives an "Access Denied" message from the Agent authentication
process. As a result, users are locked out of their Windows accounts. The lock-out
occurs because of the return code that the sub authentication process passes
back to Windows. In the patch, the return code has been changed from an authentication
failure to an authorization failure code. The patch fixes all known Windows
account locking issues.
Tracking number: 22190
Without the patch, alphanumeric PINs containing capital letters do not work
with RSA Security Protected OTP. This happens because the RSA Security Protected
OTP client does not correctly convert them to lowercase. Since the server treats
all PINs as lowercase, all authentication attempts using PINs with capital letters
fail. With the patch, the RSA Security Protected OTP client correctly converts
all input to lowercase before transmitting it to the Authentication Manager.
Tracking number: 21522
Without the patch, for some users, the Offline Days Status screen in the RSA
Security Center does not open when users right-click the RSA Security Center
icon in the notification area of the Windows taskbar, then click View Offline
Days.
Tracking number: 22390
Without the patch, the Never expire option for session certificates in
the RSA Security Center does not work properly.
Tracking number: 22135
Without the patch, uninstalling the Agent Remote Authentication Server component
leaves the Windows RRAS service unable to start. In the patch, the registry
setting that causes this problem has been removed.
Tracking number: 21693
The patch fixes an intermittent failure that occurs when RSA Security EAP is
used with PEAP and RADIUS Client Check.
Tracking number: 22184
Without the patch, under certain circumstances, when the Windows Agent clock
is tampered with, offline
authentication fails.
Tracking number: 22454
Without the patch, when you use RSA Security Protected OTP, users are always
allowed to select a system-generated PIN, even if the policy controlling this
option is turned off.
Tracking number: 22460
Without the patch, when the Authentication Manager rejects a user's PIN, the
RSA Security Protected OTP client does not allow the user another opportunity
to enter a valid PIN. With the patch, the Authentication Manager prompts the
user up to three times for a valid PIN.
Tracking number: 19977
With the patch, the RSA Security Protected OTP client is more specific in the
error messages it logs.
Tracking number: 22516
Without the patch, RSANetUse does not correctly map a shared drive whose
name contains spaces.
Tracking number: 20475
Without the patch, the SDEAP module occasionally spawns multiple authentication
windows.
Tracking number: 20190
The patch fixes a typographical error in the RSA Security Center.
Tracking number: 22995
With the patch, the legal notice page always appears before logon, and properly
displays the legal notice.
Tracking number: 23151
The patch fixes a compatibility issue with Citrix in which credentials are not
properly auto-submitted.
The following files are updated when you install this patch:
\windows\System32
\Program Files\RSA Security\RSA Authentication Agent\
\Program Files\Common Files\RSA Shared\
commonlogevents.dll
\Program Files\Common Files\RSA Shared\RSA Security Center
\Program Files\Common Files\RSA Shared\Authentication Framework\
\Program Files\Common Files\RSA Shared\BackendUI\
If you install RSA Sign-On Manager on a computer that hosts RSA Authentication Agent 6.1 for Microsoft Windows, RSA Sign-On Manager removes the Authentication Agent installation. If you want to install the Authentication Agent on a computer that hosts RSA Sign-On Manager, you must uninstall RSA Sign-On Manager before installing the Authentication Agent.
RSA Authentication Agent 6.1 for Microsoft Windows is not compatible with pcAnywhere.
The RSA SecurID for Microsoft Windows solution does not support smart card-based
logon. RSA Security recommends that you disable the smart card service on
client computers that host RSA Authentication Agent 6.1 for Microsoft Windows.
If the smart card service on the client computer is not disabled, smart
card authentications bypass RSA SecurID authentications.
To use RSA Authentication Agent 6.1 for Microsoft Windows and Novell on the same computer, you must install Novell before installing the Authentication Agent. When you install the Authentication Agent, the installer warns you that another GINA (the Novell GINA) is already installed. When you are prompted, choose to replace the Novell GINA with the Authentication Agent GINA.
Important: If you uninstall RSA Keon Web PassPort before you uninstall the Authentication Agent, you cannot log on to the Authentication Agent host computer.
After installing RSA Authentication Agent 6.1 for Microsoft Windows, you must complete the installation by restarting the Authentication Agent host computer. Installing the Agent modifies the registry to reference the Authentication Agent GINA (AceGina.dll) instead of the Microsoft GINA (msgina.dll).
Installing or uninstalling RSA Authenticator Utility
on a computer that also hosts RSA Authentication Agent requires additional
steps if the only Authentication Agent components installed are the Remote
Authentication Server component or the RSA Security EAP Client component.
If you manually installed only the Authentication Agent Remote Authentication
Server component or RSA Security EAP Client component, and then install
the Authenticator Utility, perform the following steps:
If you manually installed only the Authentication Agent Remote Authentication Server component or RSA Security EAP Client component, and then uninstall the Authenticator Utility, perform the following steps:
If you silently installed only the Authentication Agent Remote Authentication Server component or RSA Security EAP Client component, and then install the Authenticator Utility, silently reinstall the Authentication Agent components.
If you silently installed only the Authentication Agent Remote Authentication Server component or RSA Security EAP Client component, and then uninstall the Authenticator Utility, silently reinstall the Authentication Agent components.
If you select the Exclude user option and enter administrator in the field, when you start the domain controller in Restore mode, enter administrator as the user name, and enter the directory services Restore mode password. You create this password when you configure Microsoft Active Directory.
- Use the Cisco Installation Wizard to uninstall the Cisco software.
Important: Do not use the Microsoft Windows Add/Remove program.
- Reinstall the Cisco software without PEAP.
If you configure RSA Security EAP for use with Microsoft Windows RAS or Microsoft Windows IAS, the following applies:
By default, user names entered without a domain, or with a domain specified in the format domain\user name
authenticate to the Authentication Manager as the plain user name.If your system uses multiple domains, you can use the RSA Security Center on the remote server computer to enable the option Send user name to RSA Authentication Manager in "domain\user name" format. This option passes the local domain, or user-specified domain, to the Authentication Manager. To enable this option:
- In the left pane of the RSA Security Center, click Configuration > Remote > EAP.
The Remote EAP Configuration page opens in the right pane.- On the Remote EAP Configuration page, under Authentication Settings, click Settings.
- On the Authentication Settings page, select the option Send user name to RSA Authentication Manager in "domain\user name" format.
Note: For this option to work, the user accounts in the Authentication Manager must be configured with the domain name included in the user name.
If a user enters a user name in the format username@domain (referred to as the User Principal Name or UPN), by default, the UPN is converted to the format domain\username, and the domain will always be included. You cannot suppress the domain name if this format is used.
If you need to pass UPN format names to the Authentication Manager, you must change the registry setting.
HKEY_LOCAL_MACHINE\Software\RSA Authentication Agent\Current Version\Settings\SDRAS\ConvertEapFQNames from the default setting 1 to the setting 0. If you change the setting in this way, UPN names are not be converted by EAP and are passed to the Authentication Manager verbatim.However, IAS attempts to convert UPN names to domain format to check user names against remote access policies. If the users are not Windows users, you must reconfigure the remote access policy so that it does not require Windows authentication. Normally, IAS can convert the UPN format names, but in some situations you may need to define a domain stripping policy for the User-Name attribute. For help with realm names, see the Windows IAS documentation.
To change the machine name of an Authentication Agent host computer:
- On the Authentication Agent host computer, set the RSA SecurID challenge to None.
- Change the machine name.
- Set the challenge to a setting other than None, and select the challenge group based on the new machine name.
If you have already changed the machine name of an Authentication Agent host computer without performing the preventative steps listed above, perform the following steps:
- Restart the Authentication Agent host computer in Safe mode.
- Log on as an administrator.
- Set the challenge to None.
- Restart the computer.
- Log on as an administrator.
- Set the challenge to a setting other than None, and select the challenge group based on the new machine name.
To change the static IP address of an Agent host computer:
Change the IP address of the Authentication Agent host computer, then restart the computer.
RSA Authentication Agent and RSA Authentication Manager do not support leading zeros (for example, 0123) in PINs used for PINPads and software tokens. If a user creates a PIN that contains leading zeros, the PIN is rejected by the Authentication Manager and the system reprompts the user for a passcode. However, the system does not issue a message saying that the PIN is invalid.
Setting the session certificate time-out parameter should determine when users' authentication sessions expire, and therefore, when users are reprompted for RSA SecurID passcodes. You can set the session certificate expiration time from 5 minutes to 1,440 minutes (one day). The default expiration for the session certificate is 5 minutes. However, for some operations, the Kerberos renewal ticket, one of the Microsoft domain settings, overrides the session certificate. Therefore, users are reprompted for RSA SecurID passcodes when the Kerberos renewal ticket expires and not when the session certificate expires. The default expiration time for the Kerberos renewal ticket is 10 days.
Although the RSA Authentication Manager allows the @ sign as part of a user name, Windows Active Directory does not.
When you use a connected RSA SecurID Authenticator SID800 USB token, the Time Remaining field on the RSA Security Center View USB Token page shows that the tokencode is valid for a greater amount of time than it is actually valid. Regardless of how long a tokencode has displayed, every time you reopen the View USB Token page, the Time Remaining field starts a new count instead of beginning the count at the actual amount of time the tokencode remains valid. Therefore, the Time Remaining field and the actual time the tokencode remains valid may differ by as much as 60 seconds.
When a user downloads offline data, his or her user name is added to a file on the user's local computer. This file is named challengedinfo.dat and is stored, by default, in C:\Documents and Settings\All Users\Application Data\RSA Security\Domain on Domain Authentication Client hosts and in C:\Documents and Settings\All Users\Application Data\RSA Security\Local on local authentication component hosts. The file contains a list of local users to be challenged for RSA SecurID passcodes when they authenticate offline. If you change an offline domain user’s challenge status, for example, by removing the user from a challenge group, you also need to delete the user’s name from the challengedinfo.dat file on the user’s computer. Otherwise, the user still receives a challenge when attempting to access the desktop using a domain account. Be certain to delete all instances of a user's name from the file.
After you import a software token to a domain client computer, you must log off of the domain client computer and log on again to enable the software token. If you are working from a remote session, you must restart the computer.
If you set the challenge for domain users on the RSA Security Center Challenge Settings page to All users, the following erroneous behavior occurs:
The Exclude user option is ignored. Under ordinary circumstances, this option exempts the domain controller administrator from challenge when logging on to the domain controller in Directory Services Restore Mode (DSRM).
The administrator is unable to log on to the domain controller in DSRM.
To enable the administrator to log on to the domain controller in Directory Services Restore Mode while the challenge for domain users is set to All users, you must select Disable local users' access to this computer on the RSA Security Center Windows Logon Settings page on the domain controller. The administrator can then log on to the domain controller in DSRM by entering a valid RSA SecurID passcode and the DSRM password when prompted.
If you enable domain client registration in the RSA Security Center, and then change the remove:security policies for a domain client computer, you must restart the client computer for the security policies to take effect.
If domain authentication fails on a domain authentication client computer running Windows XP SP2, and the firewall on the client computer was initially turned off, check the firewall settings. Although the firewall service on Windows XP SP2 clients may have been stopped, the service may restart itself and prevent the Domain Authentication Client component from communicating with the Domain Authentication Server component on the domain controller. If this occurs, domain authentication for online users fails. Domain authentication for offline users succeeds, but Active Directory passcodes cannot be communicated, and the prompt for the Active Directory password takes longer than usual to appear. To prevent this situation, disable, rather than stop, the firewall service on the domain authentication client. If you do not want to shut down the firewall on the client computer, make sure TCP port 2334 is part of the firewall exception list. Although the port may have been added to the list initially, it may have removed itself from the list.
If you enable cross-domain trust between a protected domain and an unprotected domain, you must assign users different user names for each domain. Otherwise, when the user attempts to authenticate with a Windows password to the unprotected domain, authentication fails.
In a hierarchical domain environment, you cannot log on to an unprotected
parent domain from a protected child domain as an administrator, even when
the administrator is not in a challenge group. To facilitate logging on
to an unprotected parent domain as an administrator from a protected child
domain, you must install and configure the RSA Authentication Agent Domain
Server component on the parent domain controller.
RSA Security EAP Protected OTP (EAP-32) and RSA Security EAP (EAP 15) are
not supported on Microsoft Windows 2000 platforms.
Remote access authentication with wireless PEAP does not support RSA SecurID authenticators set for 180 second intervals.
When a computer comes out of hibernation during a wireless connection, the connection can be restored immediately, without waiting for the user to authenticate back into the existing Microsoft Windows session. For greater security, disable hibernation on users' computers and instruct users to log off the network before leaving their desks.
If you are running an active session:
This stops the system from reprompting.
Edit the registry to remove the cached EAP information for the authenticating user.
The next RSA Security prompt you see should be a user name dialog box. For more information, see Microsoft Knowledge Base article #823731 "How to remove cached user credentials that are used for PEAP authentication in Windows XP." This information applies to all RSA Security EAP protocols even if PEAP is not used.
If you are not running an active session:
This clears the EAP registry data.
If the system prompts you again, ignore the prompts until you can perform the next step.
This stops the reprompting.
The next RSA Security prompt you see should be a user name dialog box. For more information, see Microsoft Knowledge Base article #823731 "How to remove cached user credentials that are used for PEAP authentication in Windows XP." This information applies to all RSA Security EAP protocols even if PEAP is not used.
After initially installing the local authentication client component on a computer, some Authentication Agent features do not work when you are remotely connected to the network unless you do one of the following:
You can configure RSA Authentication Agent to automatically authenticate
users to protected domains after they have authenticated offline. Users
can automatically authenticate for as long as the offline session certificate
remains valid. By default, session certificates remain valid for 5 minutes.
After the system validates the user's offline authentication, it issues
the user a new session certificate, also valid for 5 minutes. Therefore,
by default, users can access domain resources for up to 10 minutes after
an initial offline authentication.
If, during authentication, the system prompts the user to recharge offline days, then notifies the user that the recharge failed, determine whether the user's RSA SecurID token is about to expire. If a user authenticates with an RSA SecurID token that is set to expire before the user's offline days expire, the system prompts the user to recharge offline logon days. However, it is not possible to recharge offline days under this circumstance, and attempts to do so fail.
If you reset the number of offline days to a number that is less than the number that was previously set (for example, if you change the number of offline days to 5 from 10), offline users continue to have the greater number of offline days (in this example, 10) until those days expire. When offline users recharge their offline days, the RSA Authentication Manager downloads the new number of offline days (in this example, 5).
Once a user downloads offline days, the user can successfully authenticate offline even after the trust between the domain controller and the RSA Authentication Manager is broken. The authentication events are not recorded on the RSA Authentication Manager.
If you clear offline data from an Authentication Agent host, but RSA Security Center still shows available offline days, instruct the user to restart RSA Security Center.
For Windows XP platforms, remove your RSA SecurID Authenticator SID800 USB token from your computer before you run a terminal services session to the computer. If you leave the token connected to the computer and then run a terminal services session to the computer, you need to restart the computer before you can log on to it again.
The first time you use the RSA Security Center to enable tracing and specify a log file as the tracing destination, the system continues to log GINA tracing to the default location, aceclient.log, instead of the specified destination. To solve the problem, restart the computer.
When you set the tracing destination to Log File, then authenticate remotely using dial-up networking, by default the Authentication Agent creates a tracing log file on the client computer with the incorrect filename AceClient.log. The file should be named AceAgent.log. To apply the correct filename, restart the remote authentication server computer.
If you use a software token to log on as an alternate user, RSANetUse fails to map drives.
On Local Authentication Client computers, policy settings are updated every two hours. On Domain Authentication Client computers, policy settings are updated every four hours. Therefore, when you enable Windows password integration on a client computer, Windows password integration will not work until the policy has been updated. However, if you cannot wait until the policy is updated automatically, you can force a policy update by restarting the client computer.
Workstation Unlock with RSA SecurID PIN (Quick Workstation Unlock) does not work if you reset your PIN to a character length that is not the same as the former PIN. Although the PIN Unlock screen appears, you are not able to unlock your workstation using your new PIN. If you experience this problem, click Force Logoff, and then unlock the workstation by entering your user name and RSA SecurID passcode.
The section "Authentication Environment Options" in the RSA SecurID Wireless Authentication Solution Guide says that by default, the environment is configured so that authentication occurs on behalf of network access devices. This is true for RSA RADIUS Server environments. However, for Microsoft IAS RADIUS Server environments, by default, authentication does not occur on behalf of network access devices.
RSA Authentication Agent 6.1 for Microsoft Windows complies with Microsoft branding requirements with the following exceptions. The titles and title numbers in this section pertain to the Microsoft compliance documentation.
RSA Authentication Agent 6.1 for Microsoft Windows installs the following shared files in SystemFolder:
Installing the files elsewhere makes the Authentication Agent incompatible
with legacy RSA Security products that share these files. The Authentication
Agent also installs unshared files inherited from previous versions of the Authentication
Agent to SystemFolder.
The Authentication Agent installs the following files to WindowsFolder\Help:
The RSA Authentication Agent installation deviates from certification requirements in the following ways:
Installation sends duplicate files to the destination area of the .msi
file. However, the RSA Authentication Agent requires individual instances
of all files regardless of whether they are duplicates.
RSA Authentication Agent 6.1 for Microsoft Windows documents all assigned navigation keys in the interface with underlines.
The RSA Authentication Agent 6.1 for Microsoft Windows installation modifies a HKEY_CURRENT_USER value. However, the modification results from Microsoft Windows Installer and not from the Authentication Agent software.
The sdagentsvc service opens the default Microsoft Windows station and desktop. However, it does not present a user interface or accept user input or Windows messages.
RSA Authentication Agent 6.1 for Microsoft Windows does not support the side-by-side shared files requirement because doing so would disable the backward compatibility of legacy Agents. Therefore, the following files are installed under the /program files folder/RSA Security/RSA Authentication Agent directory:
The following files must remain in the /system32 directory to ensure backward compatibility with legacy agents:
The RSA Authentication Agent 6.1 for Microsoft Windows uninstaller removes all "non-shared" .dll files and services. It also removes all registry keys associated with the Authentication Agent that are not user configuration settings that must be maintained for future installations. The uninstall does not remove the following files:
The sdcatool writes to a registry key other than HKCU. However, the sdcatool is designed to affect the system as a whole, and not individual users.
RSA SecurCare Online: https://knowledge.rsasecurity.com
Customer Support Information: www.rsasecurity.com/support
RSA Secured Partner Solutions Directory: www.rsasecured.com
© 2006 RSA Security Inc. All rights reserved.
ACE/Agent, ACE/Server, Because Knowledge is Security, BSAFE, ClearTrust, Confidence Inspired, e-Titlement, IntelliAccess, Keon, RC2, RC4, RC5, RSA, the RSA logo, RSA Secured, the RSA Secured logo, RSA Security, SecurCare, SecurID, SecurWorld, Smart Rules, The Most Trusted Name in e-Security, Transaction Authority, and Virtual Business Units are either registered trademarks or trademarks of RSA Security Inc. in the United States and other countries. All other goods and services mentioned are trademarks of their respective companies.