Configuring Users Not Imported, Enabled, or Enrolled in Enterprise Access Management

Select the computer policy of computers to be used by inactive users.

If the Computers in This Policy Are Used Only by Users with Domain Credentials

1. Go to the General tab > Authentication.
2. Set SSO authentication fails, but Windows authentication succeeds, should the user be allowed to log in to the computer? to Yes
3. Set Allow Users to Exit and Disable Agent? to No
4. Click Save.

If Computers in This Policy Are Used by Users Without Domain Credentials

Users who have no domain credentials must exit the Imprivata agent before accessing the desktop or an application.

1. Go to the General tab > Authentication.
2. Set Allow Users to Exit and Disable Agent? to Yes
3. Click Save.

To configure authentication at shared workstations, go to the Shared Workstation tab > Windows Authentication section. Select one of the following options:

• Authenticate using Imprivata — Inactive users will still be able to access the desktop with this selection.

• BEST PRACTICE: This setting must be selected when either:
  

  • Users have Imprivata Directory credentials but no domain credentials.
  • The user's account is in a different domain than the thin client endpoint computer.
•  
• Authenticate using Windows — Inactive users with domain credentials in the same domain as the thin client endpoint computer will still be able to access the desktop with this selection.
•  

When a user logs into a thin client endpoint computer, Imprivata Enterprise Access Management automatically connects to a virtual desktop environment (when assigned in user policy and enabled in computer policy). Inactive users also have Virtual Desktop Access, but they must select a virtual desktop and manually log in. You can configure this setting by computer policy:

1. Go to the computer policy where Virtual Desktop Access is enabled, Virtual Desktops tab > Users that are not enabled option.
2. Select a virtual desktop environment. You can choose from the virtual desktop environments already enabled for this computer policy.
3. 
3. Click Save.

See Expected Behavior for details on how this selection is presented during login.

Logging Into Virtual Desktops on Enterprise Access Management-Enabled Thin Clients

When logging into a thin client endpoint computer, inactive users with access to only one virtual desktop are automatically logged in. When the inactive user has access to multiple desktops, they are prompted to choose one:

1. User 1 is not yet imported, enrolled, or enabled in Enterprise Access Management. He logs into a thin client endpoint computer.
2. User 1 is prompted to choose a virtual desktop:
3. 
3. The virtual desktop is launched. User 1 can proceed with his work.

Logging In, Logging Out, and Switching Between Users

Logging in, logging out, and switching between users is now supported for all users:

1. User 1 is not yet imported, enrolled, or enabled in Enterprise Access Management. He logs into Computer 1.
2. The desktop opens. User 1 can manually open and sign into virtual desktops and applications as needed.
3. When User 1 is done with his work, he may lock the desktop with the hotkey, click the Imprivata icon in the Windows notification area to log out, or if they do nothing, Enterprise Access Management will secure Computer 1 when inactivity-based walk-away security activates.
4. If User 1 logs into another computer, Enterprise Access Management will log out User 1 from Computer 1 and secure any applications they left unsecured on Computer 1, as configured in SSO application profiles.
4. User 2 is enabled in EAM. Regardless of how User 1 left the computer, User 2 can log into Computer 1 normally, with her username and password, or any authentication method configured in user policy and computer policy. All Enterprise Access Management features configured for this user and computer are supported.

Enterprise Access Management provides the same experience for users and inactive users, except where noted:

Features	Users enabled in EAM	Users not imported, enrolled, or enabled in EAM
Windows Notification Area	User status is indicated by the Imprivata icon in the Windows notification area.	User status is indicated in the Windows notification area: Endpoint computer is connected to the Imprivata appliance: Endpoint computer is not connected to the Imprivata appliance:
Walk-Away Security	Inactivity-based presence detection is configured in computer policy.	Inactivity-based presence detection is supported.
Single Sign-On	Supported with the Single Sign-On option for the Single Sign-On license.	Single Sign-On is not supported.
Hotkey Log Out	Logging out of Enterprise Access Management with the hot key is configured in computer policy.	Logging out of Enterprise Access Management with the hot key is supported.
Authentication Methods	Authentication methods are configured in user policy and computer policy.	Users must use their username and password to log in. Other authentication methods such as proximity card, fingerprint, or token are not supported. NOTE: You customize the error message that appears when an inactive user taps a proximity card at an endpoint computer. See Configuring Passive Proximity Card Authentication.
Application Logoff and Shutdown	To protect patient health information, applications can be profiled to log off and shut down when a user is done.	Application log off and shut down settings are supported when any user logs in or out.