;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; IfxSpPol.adm - Security Platform policies
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS MACHINE

CATEGORY !!SecurePlatformPolicies

   KEYNAME "Software\Policies\Infineon\TPM Software"

   CATEGORY !!OwnerPasswordPolicies
	
	POLICY !!OwnerPasswordMinLen
       		EXPLAIN !!OwnerPasswordMinLen_Explain
		PART !!OwnerPasswordMinLenValue_Explain TEXT
 		END PART
		PART !!OwnerPasswordMinLenValue NUMERIC SPIN 1
		DEFAULT 6
		MIN 6
		MAX 255
		VALUENAME "OwnerPwdMin"
		END PART
	END POLICY
	
	POLICY !!OwnerPasswordComplexityReqs
       		EXPLAIN !!OwnerPasswordComplexityReqs_Explain
		VALUENAME "OwnerPwdComplexityReqs"
		 VALUEON NUMERIC 1
		 VALUEOFF NUMERIC 0
	END POLICY

   END CATEGORY ;;!!OwnerPasswordPolicies

   POLICY !!PlatformEnrollment
		EXPLAIN !!PlatformEnrollment_Explain
		VALUENAME PlatformEnrollmentPol
		VALUEON NUMERIC 1
		VALUEOFF NUMERIC 0
		PART !!WizEnabledFile DROPDOWNLIST REQUIRED
			VALUENAME "PlatformEnrollment"
			ITEMLIST
				NAME !!AllowScript_Explain VALUE NUMERIC 1
				NAME !!AllowWizard_Explain VALUE NUMERIC 2 DEFAULT
			END ITEMLIST
		END PART
   END POLICY
  
   POLICY !!EnforceInitializationOfBackup
       EXPLAIN !!EnforceInitializationOfBackup_Explain
       VALUENAME "EnforceInitializationOfBackup"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

   POLICY !!BackupArchiveLocation
       EXPLAIN !!BackupArchiveLocation_Explain
	 PART !!BackupArchiveLocationFile_Explain TEXT
	 END PART
         PART !!BackupArchiveLocationFile EDITTEXT REQUIRED
	   VALUENAME "BackupArchiveLocation"
  	 END PART     
   END POLICY

   POLICY !!EnforceImmediateSystemBackup
       EXPLAIN !!EnforceImmediateSystemBackup_Explain
       VALUENAME "EnforceImmediateSystemBackup"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

   POLICY !!EmergencyTokenPublicKeyLocation
       EXPLAIN !!EmergencyTokenPublicKeyLocation_Explain
	 PART !!EmergencyTokenPublicKeyLocationFile_Explain TEXT
	 END PART
         PART !!EmergencyTokenPublicKeyLocationFile EDITTEXT REQUIRED
	   VALUENAME "EmergencyTokenPublicKeyLocation"
  	 END PART     
   END POLICY

   POLICY !!EmRecArchive
       EXPLAIN !!EmRecArchive_Explain
	 PART !!EmRecArchiveFile_Explain TEXT
	 END PART
         PART !!EmRecArchiveFile EDITTEXT REQUIRED
	   VALUENAME "EmRecArchive"
  	 END PART     
   END POLICY

   POLICY !!EnforceInitializationOfPasswordReset
       EXPLAIN !!EnforceInitializationOfPasswordReset_Explain
       VALUENAME "EnforceInitializationOfPasswordReset"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

   POLICY !!PasswordResetTokenPublicKeyLocation
       EXPLAIN !!PasswordResetTokenPublicKeyLocation_Explain
	 PART !!PasswordResetTokenPublicKeyLocationFile_Explain TEXT
	 END PART
         PART !!PasswordResetTokenPublicKeyLocationFile EDITTEXT REQUIRED
	   VALUENAME "PasswordResetTokenPublicKeyLocation"
  	 END PART     
   END POLICY

   POLICY !!CertificateRequest
		EXPLAIN !!CertificateRequest_Explain
		PART !!CertificateRequestFile_Explain TEXT
		END PART
        PART !!CertificateRequestFile EDITTEXT REQUIRED
			VALUENAME "CertificateRequest"
  		END PART     
   END POLICY

   POLICY !!TakeOwnershipRemote
       EXPLAIN !!TakeOwnershipRemote_Explain
       VALUENAME "TakeOwnershipRemote"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

   POLICY !!ReadPubSRKRemote
       EXPLAIN !!ReadPubSRKRemote_Explain
       VALUENAME "ReadPubSRKRemote"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

   POLICY !!AllowUseSystemKeysRemote
       EXPLAIN !!AllowUseSystemKeysRemote_Explain
       VALUENAME "AllowUseSystemKeysRemote"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

   POLICY !!AllowReadingNV
		EXPLAIN !!AllowReadingNV_Explain
		VALUENAME AllowReadingNVPol
		VALUEON NUMERIC 1
		VALUEOFF NUMERIC 0
		PART !!SelectOption DROPDOWNLIST REQUIRED
			VALUENAME "AllowReadingNV"
			ITEMLIST
				NAME !!LocalAdmins_Explain VALUE NUMERIC 1 DEFAULT
				NAME !!LocalRemoteAdmins_Explain VALUE NUMERIC 2 
				NAME !!LocalUsers_Explain VALUE NUMERIC 3
				NAME !!AllUsers_Explain VALUE NUMERIC 4
			END ITEMLIST
		END PART
   END POLICY

  POLICY !!DictionaryAttackThreshold
	EXPLAIN !!DictionaryAttackThreshold_Explain
	VALUENAME "DictionaryAttackThreshold_Pol" 
	 VALUEON NUMERIC 1
	 VALUEOFF NUMERIC 0
	PART !!DictionaryAttackThresholdUser_Explain1 TEXT
	END PART
	PART !!DictionaryAttackThresholdUser NUMERIC SPIN 1
	DEFAULT 5
	MIN 1
	MAX 10
	VALUENAME "DictionaryAttackThresholdUser"
	END PART
	PART !!DictionaryAttackThresholdOwner_Explain1 TEXT
	END PART
	PART !!DictionaryAttackThresholdOwner NUMERIC SPIN 1
	DEFAULT 3
	MIN 1
	MAX 10
	VALUENAME "DictionaryAttackThresholdOwner"
	END PART
  END POLICY

 POLICY !!EnableStringentPasswordFieldSecurity
       EXPLAIN !!EnableStringentPasswordFieldSecurity_Explain
       VALUENAME "EnableStringentPasswordFieldSecurity"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
 END POLICY
   
 POLICY !!PurgeKeysWhenEnteringEnergySavingStates
       EXPLAIN !!PurgeKeysWhenEnteringEnergySavingStates_Explain
       VALUENAME "PurgeKeysWhenEnteringEnergySavingStates"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
 END POLICY
   
;Allow Administrators to choose emergency recovery token
;   POLICY !!AllowChooseEmergencyRecoveryToken
;       EXPLAIN !!AllowChooseEmergencyRecoveryToken_Explain
;       VALUENAME "AllowChooseEmergencyRecoveryToken"
;	VALUEON NUMERIC 1
;	VALUEOFF NUMERIC 0
;   END POLICY

;Allow Administrators to choose Password Reset Token
;   POLICY !!AllowChoosePasswordResetToken
;       EXPLAIN !!AllowChoosePasswordResetToken_Explain
;       VALUENAME "AllowChoosePasswordResetToken"
;	VALUEON NUMERIC 1
;	VALUEOFF NUMERIC 0
;   END POLICY

END CATEGORY ;;!!SecurePlatformPolicies

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; END OF CLASS MACHINE
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS USER

CATEGORY !!SecurePlatformPolicies

   KEYNAME "Software\Policies\Infineon\TPM Software"

   CATEGORY !!BasicUserPasswordPolicies
	
	POLICY !!BUPasswordMinLen
       		EXPLAIN !!BUPasswordMinLen_Explain
		PART !!BUPasswordMinLenValue_Explain TEXT
 		END PART
		PART !!BUPasswordMinLenValue NUMERIC SPIN 1
		DEFAULT 6
		MIN 6
		MAX 255
		VALUENAME "UserPwdMin"
		END PART
	END POLICY
	
	POLICY !!BUPasswordComplexityReqs
       		EXPLAIN !!BUPasswordComplexityReqs_Explain
		VALUENAME "UserPwdComplexityReqs"
		 VALUEON NUMERIC 1
		 VALUEOFF NUMERIC 0
	END POLICY

  	POLICY !!BUPasswordMaxAge
		EXPLAIN !!BUPasswordMaxAge_Explain
		VALUENAME "BUPasswordMaxAge_Pol" 
		 VALUEON NUMERIC 1
		 VALUEOFF NUMERIC 0
		PART !!BUPasswordMaxAgeValue_Explain1 TEXT
		END PART
		PART !!BUPasswordMaxAgeValue NUMERIC SPIN 1
		DEFAULT 42
		MIN 7
		VALUENAME "BUPasswordMaxAge"
		END PART
		PART !!BUPasswordExpirationValue_Explain1 TEXT
		END PART
		PART !!BUPasswordExpirationValue NUMERIC SPIN 1
		DEFAULT 7
		MIN 1
		VALUENAME "BUPasswordExpiration"
		END PART
   	END POLICY

   END CATEGORY ;;!!BasicUserPasswordPolicies

   CATEGORY !!BasicUserPassphrasePolicies
	
	POLICY !!BUPassphraseMinLen
       		EXPLAIN !!BUPassphraseMinLen_Explain
		PART !!BUPassphraseMinLenValue_Explain TEXT
 		END PART
		PART !!BUPassphraseMinLenValue NUMERIC SPIN 1
		DEFAULT 20
		MIN 20
		MAX 255
		VALUENAME "UserPassphraseMin"
		END PART
	END POLICY

	POLICY !!BUPassphraseComplexityReqs
       		EXPLAIN !!BUPassphraseComplexityReqs_Explain
		VALUENAME "UserPassphraseComplexityReqs"
		 VALUEON NUMERIC 1
		 VALUEOFF NUMERIC 0
	END POLICY

   END CATEGORY ;;!!BasicUserPassphrasePolicies

   POLICY !!UserEnrollment
		EXPLAIN !!UserEnrollment_Explain
		VALUENAME UserEnrollmentPol
		VALUEON NUMERIC 1
		VALUEOFF NUMERIC 0
		PART !!WizEnabledFile DROPDOWNLIST REQUIRED
			VALUENAME "UserEnrollment"
			ITEMLIST
				NAME !!AllowScript_Explain VALUE NUMERIC 1
				NAME !!AllowWizard_Explain VALUE NUMERIC 2 DEFAULT
			END ITEMLIST
		END PART
   END POLICY

   POLICY !!TempDisable    
       EXPLAIN !!TempDisable_Explain
       VALUENAME "TempDisable"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

  POLICY !!SecureMailAllow
       EXPLAIN !!AllowFeature_Explain
       VALUENAME "FeatureSecureMail"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

  POLICY !!EFSAllow
       EXPLAIN !!AllowFeature_Explain
       VALUENAME "FeatureEFS"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

  POLICY !!PSDAllow
       EXPLAIN !!AllowFeature_Explain
       VALUENAME "FeaturePSD"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

  POLICY !!EnhancedAuthenticationViaBasicUserPassphrase
       EXPLAIN !!EnhancedAuthenticationViaBasicUserPassphrase_Explain
       VALUENAME "EnhancedAuthenticationViaBasicUserPassphrase"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

   POLICY !!CacheUserKey    
       EXPLAIN !!CacheUserKey_Explain
	 VALUENAME "CacheUserKey"
 	 VALUEON NUMERIC 1
	 VALUEOFF NUMERIC 0
   END POLICY

  POLICY !!EnforceEnablingOfPasswordReset
       EXPLAIN !!EnforceEnablingOfPasswordReset_Explain
       VALUENAME "EnforceEnablingOfPasswordReset"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

   POLICY !!CertificateRequest
		EXPLAIN !!CertificateRequest_Explain
		PART !!CertificateRequestFile_Explain TEXT
		END PART
        PART !!CertificateRequestFile EDITTEXT REQUIRED
			VALUENAME "CertificateRequest"
  		END PART     
   END POLICY

   POLICY !!EFSCertificateEnrollment
	EXPLAIN !!EFSCertificateEnrollment_Explain
	VALUENAME "EFSCertificateEnrollmentPol"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
	PART !!EFSCertificateEnrollmentTypes DROPDOWNLIST REQUIRED
		VALUENAME "EFSCertificateTypes"
		ITEMLIST
		 	NAME !!EFSCertificate_AllowAllTypes_Explain VALUE NUMERIC 1 DEFAULT
			NAME !!EFSCertificate_AllowDomain_Explain VALUE NUMERIC 2 
			NAME !!EFSCertificate_AllowDomainAndExternal_Explain VALUE NUMERIC 3
		END ITEMLIST
	END PART
	PART !!EFSCertificateEnrollFromURL EDITTEXT
		VALUENAME "EFSCertificateEnrollmentURL"
	END PART     
   END POLICY

  POLICY !!EFSCertificateExpirationWarningOccurrence
	EXPLAIN !!EFSCertificateExpirationWarningOccurrence_Explain
	VALUENAME "EFSCertificateExpirationWarningOccurrencePol"
    VALUEOFF NUMERIC 0
	VALUEON  NUMERIC 1
	PART !!EFSCertificateExpirationWarningOccurrenceValue_Explain1 TEXT
	END PART
	PART !!EFSCertificateExpirationWarningOccurrenceValue_Explain2 TEXT
	END PART
	PART !!EFSCertificateExpirationWarningOccurrenceValue NUMERIC SPIN 1
	DEFAULT 14
	MIN 7
	VALUENAME "EFSCertificateExpirationWarningOccurrence"
	END PART
   END POLICY

  POLICY !!EFSSelfSignedCertificateValidityYears
	EXPLAIN !!EFSSelfSignedCertificateValidityYears_Explain
	VALUENAME "EFSSelfSignedCertificateValidityYearsPol"
	VALUEOFF NUMERIC 0
	VALUEON	NUMERIC 1
	PART !!EFSSelfSignedCertificateValidityYearsValue_Explain1 TEXT
	END PART
	PART !!EFSSelfSignedCertificateValidityYearsValue NUMERIC SPIN 1
	DEFAULT 10
	MIN 1
	Max 100
	VALUENAME "EFSSelfSignedCertificateValidityYears"
	END PART
  END POLICY

   POLICY !!PSDDefaultDrive
       EXPLAIN !!PSDExplain
       VALUENAME "PSDDefaultPath"
       PART "PSD Default Drive" EDITTEXT 
             VALUENAME "PSDValueName"
       END PART
   END POLICY

  POLICY !!LimitationOfPSDDriveImageSize
	EXPLAIN !!LimitationOfPSDDriveImageSize_Explain
	VALUENAME "LimitationOfPSDDriveImageSizePol"
    VALUEOFF NUMERIC 0
	VALUEON  NUMERIC 1
	PART !!LimitationOfPSDDriveImageSizeValue_Explain TEXT
	END PART
	PART !!LimitationOfPSDDriveImageSizeValue NUMERIC SPIN 1
	DEFAULT 5000
	MIN 0
	VALUENAME "LimitationOfPSDDriveImageSize"
	END PART
   END POLICY

  POLICY !!BackupWarningOccurrence
	EXPLAIN !!BackupWarningOccurrence_Explain
    VALUENAME "BackupWarningOccurrencePol"
    VALUEOFF NUMERIC 0
	VALUEON  NUMERIC 1
	PART !!BackupWarningOccurrenceValue_Explain1 TEXT
	END PART
	PART !!BackupWarningOccurrenceValue_Explain2 TEXT
	END PART
	PART !!BackupWarningOccurrenceValue_Explain3 TEXT
	END PART
	PART !!BackupWarningOccurrenceValue NUMERIC SPIN 1
	DEFAULT 1
	MIN 1
	MAX 365
	VALUENAME "BackupWarningOccurrence"
	END PART
   END POLICY

  POLICY !!AllowKeyImportForUser
       EXPLAIN !!AllowKeyImportForUser_Explain
       VALUENAME "AllowKeyImportForUser"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

   POLICY !!StrongSigningKey
       EXPLAIN !!StrongSigningKey_Explain
       VALUENAME "StrongSigningKey"
	VALUEON NUMERIC 1
	VALUEOFF NUMERIC 0
   END POLICY

END CATEGORY ;;!!SecurePlatformPolicies

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; END OF CLASS USER
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; STRINGS FOR MACHINE POLICIES
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

[strings]
SecurePlatformPolicies="Security Platform"

OwnerPasswordPolicies="Owner Password"

OwnerPasswordMinLen="Minimum password length"
OwnerPasswordMinLen_Explain="Enabled: Enter the desired minimum Owner Password length, e.g. 6.\nThe minimum password length is valid for Owner Passwords which are set or changed subsequently.\n\nDisabled: The minimum password length is 6 characters.\n\nDefault value: Enabled, 6 characters\n\nNote: This setting also applies for random Owner Passwords managed by Trusted Computing Management Server."
OwnerPasswordMinLenValue="Minimum password length: "
OwnerPasswordMinLenValue_Explain="Please enter the minimum password length in characters"

OwnerPasswordComplexityReqs="Password must meet complexity requirements"
OwnerPasswordComplexityReqs_Explain="Enabled: Password complexity requirements are enforced for Owner Passwords which are set or changed subsequently.\nThis means that characters from 3 of the following 4 categories are required:\n- English uppercase characters (A through Z)\n- English lowercase characters (a through z)\n- Base 10 digits (0 through 9)\n- Non-alphanumeric characters (e.g. !, $, #, %)\n\nDisabled: No password complexity requirements are enforced.\n\nDefault value: Disabled\n\nNote: This setting also applies for random Owner Passwords managed by Trusted Computing Management Server."

PlatformEnrollment="Allow Platform Enrollment"
PlatformEnrollment_Explain="Enabled/Allow Management Interface and Wizard: The administrator is allowed to use the Security Platform Initialization Wizard and the management provider interface for initialization.\n\nEnabled/Allow Management Provider Interface only: The administrator can just invoke the management provider interface but cannot run the Security Platform Initialization Wizard.\n\nDisabled: The Security Platform does not allow the administrator to execute any functions.\n\nDefault value: Enabled/Allow Management Interface and Wizard"

EnforceInitializationOfBackup="Enforce configuration of Backup including Emergency Recovery"
EnforceInitializationOfBackup_Explain="Enabled: The configuration of automatic backups (including Emergency Recovery) is mandatory in the Security Platform Initialization process.\nIf the Security Platform has already been initialized without configuring automatic backups, there is no enforcement to configure automatic backups.\n\nDisabled: There is no enforcement to configure automatic backups. Backup can be configured after Security Platform Initialization via Settings Tool - Backup - Configure.\n\nDefault value: Disabled"

BackupArchiveLocation="Backup Archive location"
BackupArchiveLocation_Explain="Enabled: Enter a path including backup archive file name, e.g. \\BackupServer\SecurityPlatformShare\SPSystemBackup.xml.\nThis target path will be enforced when the feature Backup is configured.\nIf the feature Backup has already been configured, then the existing backup path is kept as long as no re-configuration is performed.\nBe sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Backup configuration will fail.\n\nDisabled: The backup target path can be freely specified when the feature Backup is configured.\n\nDefault value: Disabled"
BackupArchiveLocationFile="Location: "
BackupArchiveLocationFile_Explain="Please enter a fully qualified file name."

EnforceImmediateSystemBackup="Enforce immediate System Backup"
EnforceImmediateSystemBackup_Explain="Enabled: The System Backup Archive will be immediately updated after significant changes of Security Platform data.\nPreconditions: Automatic backups must be configured. Also writing access to the System Backup Archive must be allowed.\n\nDisabled: The System Backup Archive will not be immediately updated after significant changes of Security Platform data. If automatic backups are configured and writing access to the System Backup Archive is allowed, the archive will be updated with the next scheduled System Backup.\n\nDefault value: Enabled"

EmergencyTokenPublicKeyLocation="Use public key of Emergency Recovery Token from archive"
EmergencyTokenPublicKeyLocation_Explain="Enabled: Enter a path including archive file name, e.g. \\ServerName\FolderName\ArchiveName.xml.\nThis path will be enforced when Emergency Recovery is configured.\nIf Emergency Recovery has already been configured on a Security Platform PC, this setting will not have any effect for this PC.\nBe sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Emergency Recovery configuration will fail.\n\nDisabled: The Emergency Recovery Token or Archive path can be freely specified when Emergency Recovery is configured.\n\nDefault value: Disabled"
EmergencyTokenPublicKeyLocationFile="Location: "
EmergencyTokenPublicKeyLocationFile_Explain="Please enter a fully qualified file name."

EmRecArchive="File location for Emergency Recovery Archive"
EmRecArchive_Explain="This setting is only relevant for older versions of the Security Platform Solution Software.\n\nIn older versions, the file location for the Emergency Recovery Archive could be set explicitly during Security Platform Initialization. With this policy, the file location could be enforced.\n\nIn the current version, the file location is set automatically."
EmRecArchiveFile="Location: "
EmRecArchiveFile_Explain="Please enter a full qualified xml file name."

EnforceInitializationOfPasswordReset="Enforce configuration of Password Reset"
EnforceInitializationOfPasswordReset_Explain="Enabled: The configuration of Password Reset is mandatory in the Security Platform Initialization process.\nIf the Security Platform has already been initialized without configuring Password Reset, there is no enforcement to configure Password Reset.\n\nDisabled: There is no enforcement to configure Password Reset. Password Reset can be configured after Security Platform Initialization via Settings Tool - Password Reset - Configure.\n\nDefault value: Disabled"

PasswordResetTokenPublicKeyLocation="Use public key of Password Reset Token from archive"
PasswordResetTokenPublicKeyLocation_Explain="Enabled: Enter a path including archive file name, e.g. \\ServerName\FolderName\ArchiveName.xml.\nThis path will be enforced when Password Reset is configured.\nIf Password Reset has already been configured on a Security Platform PC, this setting will not have any effect for this PC.\nBe sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Password Reset configuration will fail.\n\nDisabled: The Password Reset Token or Archive path can be freely specified when Password Reset is configured.\n\nDefault value: Disabled"
PasswordResetTokenPublicKeyLocationFile="Location: "
PasswordResetTokenPublicKeyLocationFile_Explain="Please enter a fully qualified file name."

CertificateRequest="URL to start from wizard for certificate enrollment"
CertificateRequest_Explain="Enabled: This setting specifies the web address that is used by the Infineon Security Platform User Initialization Wizard to retrieve certificates using a web browser.\nThe page to get a certificate is only available in the User Initialization Wizard if this setting is enabled and at least one Security Platform Feature has been selected for configuration.\n\nNotes:This setting is supported as system policy to be compatible with earlier versions of the Security Platform Solution Software.\nRecommendation: Use this setting as a user policy.\nWhile this setting is independent of the certificate usage, there is also a special user policy for EFS certificates (EFS certificate type and enrollment).\n\nDisabled: The page to get a certificate is not available in the Infineon Security Platform User Initialization Wizard.\n\nDefault value: Disabled"
CertificateRequestFile="Location: "
CertificateRequestFile_Explain="Please enter a URL for the certificate request."

TakeOwnershipRemote="Allow Administrators to take ownership remotely"
TakeOwnershipRemote_Explain="Enabled: An administrator is not required to be present locally when taking  ownership on a computer. This functionality may be especially useful when performing setup of the clients in large networks.\n\nDisabled: Taking ownership remotely is not allowed.\nThis policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.\n\nDefault value: Disabled"

ReadPubSRKRemote="Allow Administrators to retrieve the SRK public key remotely"
ReadPubSRKRemote_Explain="Determines who may read the Storage Root Key's (SRK) public key stored in a Trusted Platform Module. The SRK public key requires particular protection, since the Security Platform can be identified by it.\n\nEnabled: An administrator can retrieve the SRK public key not only locally but also remotely.\n\nDisabled: Retrieving the SRK public key remotely is not allowed.\nThe migration step Automatic export and authorization requires that this setting is enabled on the migration destination computer.\nThis policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.\n\nDefault value: Disabled"

AllowUseSystemKeysRemote="Allow Administrators to use platform keys remotely"
AllowUseSystemKeysRemote_Explain="Enabled: An administrator can use platform keys not only locally but also remotely.\n\nDisabled: Using platform keys remotely is not allowed. For privacy issues, the access to these keys is resticted as discussed within the Trusted Computing Group (TCG). This way all keys which would allow an identification of your Security Platform are hidden for remote access.\nThis policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.\nNote that the Security Platform administration and operation is not restricted by this policy.\n\nDefault value: Disabled"

AllowReadingNV="Allow reading of unprotected TPM NV memory"
AllowReadingNV_Explain="Determines who may read unprotected Non-Volatile (NV) memory stored in a Trusted Platform Module 1.2. The NV memory may contain sensitive data.\n\nEnabled:Specify whether only local administrators, local and remote administrators, all local users or all users may read unprotected NV data.\n\nDisabled: No user may read unprotected NV data.\n\nThis policy is only relevant for Security Platforms with a Trusted Platform Module 1.2.\nNote that the Security Platform administration and operation is not restricted by this setting.\n\nDefault value: Enabled/Local administrators"
LocalAdmins_Explain="1 - Local administrators"
LocalRemoteAdmins_Explain="2 - Local and remote administrators"
LocalUsers_Explain="3 - All local users"
AllUsers_Explain="4 - All users"
SelectOption="Select an option to enable:\n"

DictionaryAttackThreshold="Configure dictionary attack threshold"
DictionaryAttackThreshold_Explain="Determines the number of allowed authentication attempts before dictionary attack defending measures are taken.\n\nEnabled: Specify how many authentication attempts should be allowed to Security Platform Owner and Users, before dictionary attack defending measures are taken. \n\nDisabled: The dictionary attack threshold cannot be configured. The default values are in effect.\n\nDefault value: Enabled. Owner: 3 attempts. User: 5 attempts.\n\nThis policy is only relevant for Security Platforms with an Infineon Trusted Platform Module 1.2. It needs to be set before Security Platform Initialization. Subsequent changes of this policy will only be effective after the next defense level reset."
DictionaryAttackThresholdUser="  Allowed attempts: "
DictionaryAttackThresholdUser_Explain1="Security Platform User authentication"
DictionaryAttackThresholdOwner="  Allowed attempts: "
DictionaryAttackThresholdOwner_Explain1="Security Platform Owner authentication"

EnableStringentPasswordFieldSecurity="Enable stringent password field security"
EnableStringentPasswordFieldSecurity_Explain="Enabled: The ability to cut, copy, paste and see the password in clear text is not available in password fields.\n\nDisabled: The ability to paste is available in password fields. Additionally cut and copy operation is available when the password is visible in clear text.\n\nDefault value: Disabled"

PurgeKeysWhenEnteringEnergySavingStates="Purge keys when entering energy-saving states"
PurgeKeysWhenEnteringEnergySavingStates_Explain="Enabled: Security Platform keys are purged, before the computer enters one of the energy-saving states standby (S3) or hibernation (S4). Thus the security level during energy-saving state will be raised. After coming back from the energy-saving state, Security Platform Features will require a user authentication again.\n\nDisabled: Security Platform keys are not purged.\n\nDefault value: Enabled"

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; STRINGS FOR USER POLICIES
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

BasicUserPasswordPolicies="Basic User Password"
BasicUserPassphrasePolicies="Basic User Passphrase"

BUPasswordMinLen="Minimum password length"
BUPasswordMinLen_Explain="Enabled: Enter the desired minimum Basic User Password length, e.g. 6.\nThe minimum password length is valid for Basic User Passwords which are set or changed subsequently.\n\nDisabled: The minimum password length is 6 characters.\n\nDefault value: Enabled, 6 characters"
BUPasswordMinLenValue="Minimum password length: "
BUPasswordMinLenValue_Explain="Please enter the minimum password length in characters"

BUPasswordComplexityReqs="Password must meet complexity requirements"
BUPasswordComplexityReqs_Explain="Enabled: Password complexity requirements are enforced for Basic User Passwords which are set or changed subsequently.\nThis means that characters from 3 of the following 4 categories are required:\n- English uppercase characters (A through Z)\n- English lowercase characters (a through z)\n- Base 10 digits (0 through 9)\n- Non-alphanumeric characters (e.g. !, $, #, %)\n\nDisabled: No password complexity requirements are enforced.\n\nDefault value: Disabled"

BUPasswordMaxAge="Maximum Basic User Password age"
BUPasswordMaxAge_Explain="Determines the period of time (in days) that a Basic User Password can be used before the system requires the user to change it.\n\nEnabled:\nMaximum Basic User Password age: Enter the desired maximum Basic User Password age, e.g. 42 days.\nBasic User Password expiration warning: Specify how many days before Basic User Password expiration users shall be notified, e.g. 7 days.\n\nDisabled: There is no maximum Basic User Password age, i.e. passwords do not expire.\n\nDefault value: Disabled"
BUPasswordMaxAgeValue="  Number of days: "
BUPasswordMaxAgeValue_Explain1="Maximum Basic User Password age"
BUPasswordExpirationValue="  Number of days: "
BUPasswordExpirationValue_Explain1="Basic User Password expiration warning"

BUPassphraseMinLen="Minimum passphrase length"
BUPassphraseMinLen_Explain="This policy is only relevant if Enhanced Authentication is used.\n\nEnabled: Enter the desired minimum Basic User Passphrase length, e.g. 20.\nThe minimum passphrase length is valid for Basic User Passphrases which are set or changed subsequently.\n\nDisabled: The minimum passphrase length is 20 characters.\n\nDefault value: Enabled, 20 characters"
BUPassphraseMinLenValue="Minimum passphrase length: "
BUPassphraseMinLenValue_Explain="Please enter the minimum passphrase length in characters."

BUPassphraseComplexityReqs="Passphrase must meet complexity requirements"
BUPassphraseComplexityReqs_Explain="This policy is only relevant if Enhanced Authentication is used.\n\nEnabled: Complexity requirements are enforced for Basic User Passphrases which are set or changed subsequently.\nThis means that characters from 3 of the following 4 categories are required:\n- English uppercase characters (A through Z)\n- English lowercase characters (a through z)\n- Base 10 digits (0 through 9)\n- Non-alphanumeric characters (e.g. !, $, #, %)\n\nDisabled: No complexity requirements are enforced.\n\nDefault value: Disabled"

UserEnrollment="Allow User Enrollment"
UserEnrollment_Explain="Enabled/Allow Management Interface and Wizard: The user is allowed to use the Security Platform Solution Tools (e.g. Settings Tool, User Initialization Wizard) and the management provider interface.\n\nEnabled/Allow Management Provider Interface only: The user can just invoke the management provider interface but cannot run the Security Platform Solution Tools.\n\nDisabled: The Security Platform does not allow the user to execute any functions.\n\nDefault value: Enabled/Allow Management Interface and Wizard"

TempDisable="Allow user to temporarily disable the Security Platform Feature"
TempDisable_Explain="Enabled: The Infineon Security Platform User can switch off the active Security Platform Features until the computer is rebooted the next time.\n\nDisabled: The ability to temporarily disable the Infineon Security Platform is not available in the user interface of the Security Platform Solution Software.\n\nWhen the user logs off and a different user logs on, the deactivated Security Platform Features remain deactivated until the computer gets rebooted.\n\nNote: This feature is not available on Security Platforms with a Trusted Platform Module 1.2\n\nDefault value: Enabled"

SecureMailAllow="Allow Secure e-mail configuration"
EFSAllow="Allow EFS configuration"
PSDAllow="Allow PSD configuration"
AllowFeature_Explain="Enabled: The user is allowed to configure this Security Platform Feature.\n\nDisabled: The user cannot configure this feature, but a previous configuration can be used.\n\nDefault value: Enabled"
AllowScript_Explain="Allow Management Provider interface only"
AllowWizard_Explain="Allow Management interface and wizard"

EnhancedAuthenticationViaBasicUserPassphrase="Enforce Enhanced Authentication"
EnhancedAuthenticationViaBasicUserPassphrase_Explain="Enabled: Security Platform Users must use Enhanced Authentication (with Basic User Passphrase).\n\nDisabled: Security Platform Users can decide whether they want to use Enhanced Authentication (with Basic User Passphrase) or Password Authentication (with Basic User Password).\n\nDefault value: Disabled"

CacheUserKey="Enable caching of Basic User Password"
CacheUserKey_Explain="Enabled: The Basic User Password can be cached in the Infineon Security Platform Software, thus reducing the number of required inputs of the password during the current log-on session. This minimizes the number of password prompts for the user.\n\nDisabled: The Basic User Password dialog does not offer the ability to temporarily cache the Basic User Password.\n\nDefault value: Enabled"

EnforceEnablingOfPasswordReset="Enforce enabling of Password Reset"
EnforceEnablingOfPasswordReset_Explain="Enabled: Enabling Password Reset is mandatory in the User Initialization process.\nIf a Security Platform User has already been initialized without enabling Password Reset, there is no enforcement to enable Password Reset.\n\nDisabled: There is no enforcement to enable Password Reset. Password Reset can be enabled after User Initialization via Settings Tool - Password Reset - Enable.\n\nDefault value: Disabled"

EFSCertificateEnrollment="EFS certificate type and enrollment"
EFSCertificateEnrollment_Explain="Enabled: You can restrict the EFS certificate type. You can also enable the enrollment of external EFS certificates by specifying the Certification Authority's web address.\n1.EFS certificate type: Specify whether you want to allow all certificate types (domain, external and self-signed certificates) or only certain certificate types. This restriction will apply when users are going to enroll or select certificates.\n2.Certificate request URL: Enter a CA's certificate request web address to be used for EFS certificate enrollment, e.g. https://www.companyname.com/foldername.\nThis target path will be used when an EFS certificate is requested from an external Certification Authority (CA).\nThe certificate request URL is optional. If you do not specifiy a path here, users will not be able to request external EFS certificates. If you want to enable external EFS certificates, then enter a valid path which will be accessible to all Security Platform PC's. Otherwise the EFS certificate enrollment will fail.\n\nDisabled: The EFS certificate type is not restricted. The web adress to be used to retrieve EFS certificates is not set, i.e. users cannot request external EFS certificates.\n\nNotes:\nNote that EFS certificates are not only used for EFS, but also for PSD.\nWhile this setting is valid only for EFS certificates (to be used for EFS or PSD), there is also a user policy which is independent of the certificate usage (URL to start from wizard for certificate enrollment).\n\nDefault value: Disabled"
EFSCertificateEnrollmentTypes="EFS certificate type:"
EFSCertificateEnrollFromURL ="Certificate Request URL (only relevant for external certificates)"
EFSCertificate_AllowAllTypes_Explain="Allow all types"
EFSCertificate_AllowDomain_Explain="Allow only domain certificates"
EFSCertificate_AllowDomainAndExternal_Explain="Allow only domain and external certificates"

EFSCertificateExpirationWarningOccurrence="EFS certificate expiration warning occurrence"
EFSCertificateExpirationWarningOccurrence_Explain="Enabled: Security Platform Users will be notified by a balloon before their EFS certificate expires. Specify when this notification should take place, e.g. 14 days before certificate expiration.\n\nDisabled: There is no notification of certificate expiration.\n\nDefault value: Users are notified 14 days before certification expiration."
EFSCertificateExpirationWarningOccurrenceValue="Number of days: "
EFSCertificateExpirationWarningOccurrenceValue_Explain1="Please enter the number of days to remind me"
EFSCertificateExpirationWarningOccurrenceValue_Explain2="before the EFS certificate expires."

EFSSelfSignedCertificateValidityYears="EFS self-signed certificates validity period"
EFSSelfSignedCertificateValidityYears_Explain="Enabled: Specify the length of time that self-signed EFS certificates shall be valid.\n\nDisabled: The validity period is 10 years.\n\nDefault value: Enabled with a validity period of 10 years."
EFSSelfSignedCertificateValidityYearsValue="Number of years: "
EFSSelfSignedCertificateValidityYearsValue_Explain1="Please enter the validity period of self-signed EFS certificates."

PSDDefaultDrive="File Location for Personal Secure Drive"
PSDExplain="Enabled/PSD Default Drive: This sets the drive in which the Personal Secure Drive image files will be created. Enter a valid drive letter in the edit field without any additional path. If the drive letter is invalid, users will not be able to create a Personal Secure Drive image file.\n\nDisabled: The user can select the target drive in which the Personal Secure Drive image files will be created.\n\nDefault value: Disabled"

LimitationOfPSDDriveImageSize="Minimum free space after PSD creation"
LimitationOfPSDDriveImageSize_Explain="Enabled: If a PSD is saved on the system drive (where the current operating system is located), then a defined amount of free space has to be left after PSD configuration. Specify how much free space has to be left on the system drive after PSD configuration.\n\nDisabled: There is no restriction concerning the free space on the system partition after PSD creation.\n\nExample: The policy is enabled and set to 5000 MB. The minimum PSD drive size is 20 MB for Windows Vista and 10 MB for all other Operating Systems.\nAssuming the free space before PSD creation is 5050 MB, then the maximum PSD size would be 50 MB.\nAssuming the free space is 5000 MB, then you cannot create a PSD on the system drive.\n\nDefault value: The policy is enabled and set to 5000 MB."
LimitationOfPSDDriveImageSizeValue="Minimum free space (MB): "
LimitationOfPSDDriveImageSizeValue_Explain="Please enter the minimum free space after PSD creation."

BackupWarningOccurrence="Backup warning occurrence"
BackupWarningOccurrence_Explain="Enabled: Security Platform Users will be notified by a balloon, if the backup of user-specific credentials and keys has failed (for example, because the backup location is not accessible). Specify how often this notification should take place, e.g. every 2 days after the backup failure, until the next successfull backup.\n\nDisabled: There is no notification of backup failure.\n\nDefault value: Users are notified daily."
BackupWarningOccurrenceValue="Number of days: "
BackupWarningOccurrenceValue_Explain1="Specify how often this notification should take place,"
BackupWarningOccurrenceValue_Explain2="e.g. every 2 days after the backup failure,"
BackupWarningOccurrenceValue_Explain3="until the next successfull backup."

AllowKeyImportForUser="Allow Key Import for User"
AllowKeyImportForUser_Explain="Enabled: Security Platform Users are allowed to import private keys into the Security Platform. Note that private keys are imported along with certificates via Certificate Viewer and Certificate Selection.\n\nDisabled: Security Platform Users are not allowed to import private keys into the Security Platform.\n\nDefault value: Enabled"

StrongSigningKey="Enforce strong private key protection for MS-CAPI signing keys"
StrongSigningKey_Explain="Enabled: All keys used exclusively for signing operations by the MS-CAPI interface are protected by strong private protection. In this case the key is protected by its own password that has to be entered whenever the key is being used for a signing operation.\nThis specific password can be cached to avoid repetitive input. Since this password is not related to the Basic User Key, the caching mechanism used for the Basic User Password does not affect this password.\n\nDisabled: Signing keys are not protected in a special form.\n\nDefault value: Disabled"

ActionNoOwner="Executable to start if platform is ready to take ownership"
ActionNoOwner_Explain="Executable to start if platform is ready to take ownership."
ActionNoOwnerFile="Location: "
ActionNoOwnerFile_Explain="Please enter a full qualified file name."

WizEnabledFile="Select an option to enable:\n"

AllowChooseEmergencyRecoveryToken="Allow Administrators to choose Emergency Recovery Token"
AllowChooseEmergencyRecoveryToken_Explain="Allow Administrators to choose Emergency Recovery Token"

AllowChoosePasswordResetToken="Allow Administrators to choose Password Reset Token"
AllowChoosePasswordResetToken_Explain="Allow Administrators to choose Password Reset Token"

CriticalProcessing="Allow going into sleep during critical cryptographic operation"
CriticalProcessing_Explain="Allow going into sleep during critical cryptographic operation."   











