27C65014-B660-4141-B9C4-9D35CFE99AE5

A plugin credential provider ID for the FortiAuthenticator Agent for Microsoft Windows, and a binary flag for Windows Agent plugin features.

Note: This key should not be updated manually.

dword

Auth_RdpOnly

Enable FortiAuthenticator Agent for Microsoft Windows 2FA for Remote Desktop Protocol (RDP) sessions only:

• When set to 0, local logons require 2FA.

• When set to 1, local logons do not require 2FA.

Note: This key can be absent.

dword

AvailableDomains

List of domains. It can be updated by the user, or it will be updated by the Configuration app.

Example:

ABBY.AD.FACDOM.CA:ABBY

AD.FACDOM.CA:FACDOM

.:.

multi_sz

CredentialProvidersWhiteList

List of other specific credential providers we allow alongside FortiAuthenticator Agent CP.

Note: To add multiple values for this key, enter a list of GUIDs in brackets. Optionally, you can use commas to separate the contents of the list.

Example:

Two allowed credential providers for (smartcard credential provider, iris credential provider):

{1b283861-754f-4022-ad47-a5eaaa618894}{C885AA15-1764-4293-B82A-0586ADD46B35}

Alternatively, they can be added as:

{1b283861-754f-4022-ad47-a5eaaa618894},{C885AA15-1764-4293-B82A-0586ADD46B35}

sz

DisableMSPasswordProvider

Allows to sign-in through Windows Agent only.

sz

InstallPath

Installation path for the FortiAuthenticator Agent for Microsoft Windows.

Note: This key should not be updated manually.

sz

IPluginAuthentication_Order

Order of plugins to authenticate the user.

Note: We have only one plugin for now.

multi_sz

IPluginAuthorization_Order

Reserved for future.

n/a

IPluginAuthenticationGateway_Order

Reserved for future.

n/a

IPluginFetchTokens_Order

Order of plugins to fetch tokens for the user.

Note: We have only one plugin for now.

multi_sz

IPluginEventNotifications_Order

Reserved for future.

n/a

IPluginPushNotification_Order

Order of plugins for push authentication of the user.

Note: We have only one plugin for now.

multi_sz

MaxClients

Number of connections from the Credential Provider to the (internal) FortiAuthenticator service.

dword

Motd

(Message Of The Day) Message, appears on the login screen.

sz

PluginDirectories

Installation directory for plugins. It is the installation directory for FortiAuthenticator Agent for Microsoft Windows itself.

Note: We have only one plugin for now.

multi_sz

ServicePipeName

Connection/pipe name from the Credential Provider to the (internal) FortiAuthenticator service.

sz

TileImage

Path to the "Other user" tile image on the login screen.

sz

Auth_AllowAdminOTP

Allows admin OTP on the login screen.

Example: False

sz

Auth_CacheCredPeriod

Number of days the user is allowed to login with failed OTP (related to Auth_FailAction).

dword

Auth_FailAction

Allowed to login with a failed OTP (see Auth_CacheCredPeriod and Auth_OfflineEnabled).

dword

Auth_NumRetries

Number of additional tries to connect to the FortiAuthenticator server after failure (related to Auth_Timeout).

dword

Auth_OfflineEnabled

Allow authentication, based on downloaded tokens (or allow logon on failed OTP, if Auth_FailAction is configured).

sz

Auth_OfflineSharedSecret

Shared secret for the offline storage - must match FortiAuthenticator.

Note: This key should not be updated manually.

Encrypted string

Auth_RealmBased

Forces to use realm in addition to the username for authentication (from version 3.0).

sz

Auth_Timeout

Number of seconds to wait until next retry (related to Auth_NumRetries).

dword

Dom_DefaultDomain

Domain, selected on the login screen by default (see Dom_DefaultDomainMode).

Example: FACDOM

sz

Dom_DefaultDomainMode

Mode to save and pick domains (see also Dom_DefaultDomain):

• 0: No domain should be selected

• 1: last domain

• 2: specific domain

Example: 1.

dword

Dom_IncludedInTFA

List of the domains that require OTP.

Example:

FACDOM

.

multi_sz

Dom_RealmMappings

Maps domain names to realm names (usually set up through the configuration app).

Example:

AD.FACDOM.CA:facdom

.:.

multi_sz

EU_GroupList

Exempt groups. Members of the group will not need an OTP for login.

multi_sz

EU_UserGroupCachePeriod

Number of days for which the cached groups are considered valid (related to EU_UserGroupsCached).

dword

EU_UserList

Exempt users.

Example:

FACDOM/Administrator

FACDOM/System

multi_sz

EU_UserGroupsCached

Shows if we have cached user groups or not.

sz

Gen_HostSpecificSalt

Salt for the offline storage.

Note: This key should not be updated manually.

Encrypted string

Gen_AdminName

HTTP basic access authentication user.

Example: admin

sz

Gen_CACertificateFile

Certificate for the FortiAuthenticator server.

Example: C:\\Program Files\\Fortinet\\fortinet_ca.crt

sz

Gen_FacHost

FortiAuthenticator server.

Example: http://www.facdom.ca

sz

Gen_RestAPIKey

HTTP basic access authentication password.

Note: This key should not be updated manually.

Encrypted string

Gen_ServerSubjName

FortiAuthenticator server subject name.

Example: FAC-VM1

sz

Gen_VerifyServerCert

Use certificate validation.

sz

Gen_AltFacEnabled

Alternate FortiAuthenticator server is configured.

Example: True

sz

Gen_AltAdminName

HTTP basic access authentication user for the alternate FortiAuthenticator server.

Example: admin

sz

Gen_AltCACertificateFile

Certificate for the alternate FortiAuthenticator server.

Example: C:\\Program Files\\Fortinet\\fortinet_ca_alt.crt

sz

Gen_AltFacHost

Alternate FortiAuthenticator server.

Example: 192.168.150.111

sz

Gen_AltRestAPIKey

HTTP basic access authentication password for the alternate FortiAuthenticator server.

Note: This key should not be updated manually.

Encrypted string

Gen_AltServerSubjName

FortiAuthenticator server subject name for the alternate FortiAuthenticator server.

Example: FAC-VM2

sz

Gen_AltVerifyServerCert

Use certificate validation for the alternate FortiAuthenticator server.

sz

Inf_AllowedDriftHotp

Maximum drift for HOTP tokens.

Note: This key should not be updated manually.

dword

Inf_AllowedDriftTotp

Maximum drift for TOTP tokens.

Note: This key should not be updated manually.

dword

Inf_ApiVersion

API version and date.

Note: This key should not be updated manually.

Example: 6.2.0-0525 20200513

sz

Inf_EmailSmsTokenTimeout

Email or SMS token timeout.

Note: This key should not be updated manually.

dword

Inf_IsOfflineEnabled

Offline validation is enabled or not.

Note: This key should not be updated manually.

dword

Inf_IsPushEnabled

Push authentication is enabled or not.

Note: This key should not be updated manually.

dword

Inf_MaxDurationTotp

Maximum duration for TOTP.

Note: This key should not be updated manually.

dword

Inf_MaxNumberHotp

Maximum number for HOTP.

Note: This key should not be updated manually.

dword

Inf_PreferredServer

FortiAuthenticator server that responded faster:

0: Main FortiAuthenticator

1: Alternate FortiAuthenticator

Hint: Agent may prefer this FortiAuthenticator server for the next call.

dword