Centralized management of global system settings

Use the Global System Properties dialog box to centrally manage global system settings and configure password policy settings.

Note: You can only change the settings when you are logged on to the Shared Domain.

The dialog box has the following tabs:

Updates — Contains settings related to updates, upgrades, and licenses. Only administrators with Manage Updates and Upgrades permissions can change these settings.
Change Management — Contains an option for enforcing an approval workflow. Only administrators with unrestricted permissions (superusers) can change this setting.
Password Policy — Contains settings for password strength, password expiration, failed logons, and actions related to temporary and long-term inactivity. Only administrators with Manage Administrator permissions can change these settings.
Global Options — Contains options for showing users in the Home view.
Also contains an option for authorizing McAfee® Global Threat Intelligence™ (McAfee GTI) and McAfee® Threat Intelligence Exchange (TIE) usage. Only administrators with unrestricted permissions can enable McAfee GTI and Threat Intelligence Exchange.
Logon Banner — Contains the settings and text entry for the message displayed to all administrators in the Select a Management Server logon screen.
Note: The text from the banner also appears in the logon window of the SMC Appliance console and Web Portal.

Global System Properties dialog box — Updates tab

Use this tab to define settings for dynamic updates, engine upgrades, and licenses.

Option	Definition
Enable Sending Proof-of-License Codes to FORCEPOINT Servers	When selected, allows you to select settings for dynamic updates, and engine and license upgrades.
Dynamic Updates	Specifies the dynamic updates options: Do Not Check for Updates. You are not notified of new dynamic updates. Notify When Updates Become Available. You receive an alert when a new dynamic update becomes available. You must manually download and activate the update. Notify and Automatically Download Updates. You receive an alert when a new dynamic update becomes available. The SMC also automatically downloads the update. You must manually activate the update. Automatically Download and Activate Updates The SMC automatically downloads and activates the new dynamic updates.
Notify When Updates Have Been Activated (Optional)	You receive an alert when the dynamic updates have been activated. This option becomes available when you select Automatically Download and Activate Updates. You must refresh the policies before the updates take effect. If Refresh Policies After Update Activation is selected, the policies are refreshed automatically. Otherwise, you must refresh the policies manually.
Refresh Policies After Update Activation (Optional)	The SMC automatically refreshes the policies after activating the dynamic updates. This option becomes available when you select Automatically Download and Activate Updates.
Remote Upgrades for Engines	Specifies new engine upgrade options: Do Not Check for Engine Upgrades. You are not notified of new engine upgrades. Notify When Engine Upgrades Become Available. You receive an alert when a new engine upgrade becomes available. You must manually download and install the update. Notify and Automatically Download Engine Upgrades. You receive an alert when a new engine upgrade becomes available. The SMC automatically downloads the new engine upgrade. You must manually install the update.
Generate and Install New Licenses Automatically (Optional)	When selected, automatically regenerates and installs the licenses required for upgrading SMC components to a major new release.
Check for Updates	Specifies how often to check for updates.

Global System Properties dialog box — Change Management tab

Use this tab to enforce an approval workflow for all engines.

Option	Definition
Require Approval for Changes in NGFW Engine Configuration	When selected, all changes to engine configurations and policies must be approved before the changes are committed and transferred to the engines. Administrators with permissions to approve changes and administrators with unrestricted permissions (superusers) can approve changes.
Allow Administrators to Approve Their Own Changes	When selected, the same administrator who made the changes can approve the changes.

Global System Properties dialog box — Password Policy tab

Use this tab to change settings for password strength, password expiration, failed logons, and actions related to temporary and long-term inactivity in the administrator password policy.

Option	Definition
Enforce Password Settings for All the Administrators and Web Portal Users	When selected, enforces the password settings for all administrators and Web Portal users.

Option	Definition
Logon Options section
Only one Logon Session for Each User	When selected, an administrator or Web Portal user can open only a single session at a time to the Management Client or to the Web Portal.
Lock Out After Failed Logon Attempts	When selected, administrator accounts are locked when the maximum number of failed logon attempts in the specified length of time is reached.
Maximum Number of Failed Logon Attempts	The maximum number of failed logon attempts. The default is 8 attempts.
In	The length of time for counting the number of failed logon attempts. Select the time unit from the drop-down list. The default is 30 minutes.
Delay Logon After Failed Logon Attempts	When selected, administrators or Web Portal users are temporarily prevented from logging on when the maximum number of failed logon attempts is reached.
Delay for	The length of the logon delay. Select the time unit from the drop-down list. The default is 30 minutes.
After Maximum Number of Failed Logon Attempts	The maximum number of failed logon attempts. The default is 6 attempts. This option is selected by default.
Disable Accounts That Have Been Inactive For	When selected, administrator or Web Portal user accounts that have not been used for the specified length of time are automatically disabled. Select the time unit from the drop-down list. The default is 3 months.
Lock the Management Client Window After the User Session is Idle for	When selected, the Management Client window is locked when an administrator has been idle for the specified length of time. Select the time unit from the drop-down list. The default is 15 minutes.
Hide the Management Client Window Content	When selected, the content of the Management Client window is hidden when the screen is locked.
Close the Management Client	When selected, the Management Client is automatically closed when the screen is locked.
Allow Logon Only From Listed IP Addresses	When selected, administrators or Web Portal users can only log on from hosts that have the listed IP addresses. You can enter up to 170 IP addresses.
Add	Adds an IP address to the list.
Remove	Removes the selected IP address from the list.

Option	Definition
Password Age and Expiration section
Require Password Change After First Logon	When selected, the administrator or Web Portal user must change the password after the first time they log on.
Minimum Time Before Next Password Change	When selected, the administrator or Web Portal user password cannot be changed again before the specified length of time. Select the time unit from the drop-down list. The default is 3 days.
Password Expired After	When selected, specifies the length of time after which administrator or Web Portal user passwords expire and must be changed. Select the time unit from the drop-down list. The default is 3 months.
Notify User When Password Expires in	When selected, the administrator or Web Portal user is notified that the password is about to expire the specified length of time before expiration. Select the time unit from the drop-down list. The default is 7 days.
Disable Account Automatically After Password Expiration	When selected, the administrator or Web Portal user account is automatically disabled when the password expires.
Limit Reuse of Previous Passwords (Number of Previous Passwords)	When selected, the administrator or Web Portal user cannot use a password that has already been used in the specified number of previous passwords. The default is 8.

Option	Definition
Password Complexity Requirements section
Minimum Number of Characters in Password	When selected, administrator or Web Portal user passwords must contain the specified minimum number of characters. The default is 10 characters. This option is selected by default.
Minimum Number of Required Characters	When selected, administrator or Web Portal user passwords must contain the specified minimum number of required characters. Note: The total number of required characters must not be larger than the value of the Minimum Number of Characters in Password option. This option is selected by default.
Uppercase	The minimum number of required uppercase letters. The default is 0.
Lowercase	The minimum number of required lowercase letters. The default is 1.
Special Characters	The minimum number of special characters. Special characters include the following characters: !@#$%^&*() The default is 0.
Numbers	The minimum number of required numeric characters. The default is 1.
Maximum of Same Characters Between Previous and New Password	When selected, administrator or Web Portal user passwords must not have more than the specified number of characters in common with the previous password. The default is 4 characters.
Reset to Default	Discards the changes and reverts to the default settings.

Global System Properties dialog box — Global Options tab

Use this tab to show users in the Home view. You can also authorize McAfee® Global Threat Intelligence™ (McAfee GTI) and McAfee® Threat Intelligence Exchange (TIE) usage.

Option	Definition
Enable McAfee Global Threat Intelligence (GTI) and McAfee Threat Intelligence Exchange (TIE) usage	When selected, enables McAfee GTI and McAfee TIE usage.
Show Users in the Home View	When selected, users that have been recently active are shown in the Home view.
Retrieve Information for Users Active	A user is considered active if they have generated log data. Select the time period to retrieve the information. The longer the time period, the greater the performance impact.
Display Users as	User Names — The name of the user is shown. The information is shown as it is shown in the logs. Source IP Addresses — If user name information is not available, or cannot be shown due to privacy legislation, you can show only the source IP address of the user.
Show Users From These Networks (Only if Display Users as is Source IP Addresses	If you want to show users as source IP addresses, select the networks where your users are located.

Global System Properties dialog box — Banners tab

Use this tab to create logon banners and export banners.

Option	Definition
Show Logon Banner	When selected, the specified banner is shown to all administrators before they log on to the Management Client.
Banner text box	Specifies the text for the logon banner. You can use HTML to format the text.
Include Export Banner	When selected, the specified banner is added at the beginning of each exported XML file or HTML file to indicate that the export contains sensitive or classified data.
Banner text box	Specifies the text for the export banner. Only plain text is supported.