<?xml version="1.0" encoding="utf-8"?>
<policyDefinitionResources revision="1.0" schemaVersion="1.0">
  <displayName></displayName>
  <description></description>
  <resources>
    <stringTable><string id="SUPPORTED_SP_NONE"></string>
      <string id="WizEnabledFile">Select an option to enable:
</string>
      <string id="SecurePlatformPolicies">Security Platform</string>
      <string id="SecurePlatformPolicies_Explain">Allows configuration of various Security Platform Settings.</string>
      <string id="AllVersionsSettings">All Versions Settings</string>
      <string id="AllVersionsSettings_Explain">Contains settings that are valid both for the stand-alone computer version and for the server version.</string>
      <string id="StandaloneVersion">Stand-alone Computer Version Settings</string>
      <string id="StandaloneVersion_Explain">Contains settings that are valid only for the stand-alone computer version.</string>
      <string id="PreviousProductVersion">Previous Product Versions Settings</string>
      <string id="PreviousProductVersion_Explain">Contains settings that are valid only for previous product versions.</string>
      <string id="OwnerPasswordPolicies">Owner Password</string>
      <string id="OwnerPasswordPolicies_Explain">Contains settings concerning Owner Passwords</string>
      <string id="BasicUserPasswordPolicies">Basic User Password</string>
      <string id="BasicUserPasswordPolicies_Explain">Contains settings concerning Basic User Passwords</string>
      <string id="BasicUserPassphrasePolicies">Basic User Passphrase</string>
      <string id="BasicUserPassphrasePolicies_Explain">Contains settings concerning Basic User Passphrases</string>
      <string id="PrepareTPMEnrollment">Prepare TPM enrollment</string>
      <string id="PrepareTPMEnrollment_Explain">Enabled: On not initialized platforms which have a disabled Trusted Platform Module and support the Physical Presence Interface (PPI), the Trusted Platform Module is automatically prepared to be enabled. The users will be guided to complete the enabling.

Disabled: The Trusted Platform Module is not prepared to be enabled automatically.

Default value: Disabled</string>
      <string id="PrepareTPMEnrollment_DropDown">Select an option to enable:
</string>
      <string id="PrepareTPMEnrollment_Explain1">Balloon and Message Box</string>
      <string id="PrepareTPMEnrollment_Explain2">Message Box</string>
      <string id="PrepareTPMEnrollment_Explain3">Pre-Logon Message Box</string>
      <string id="PrepareTPMEnrollment_CheckBox">Administrators only</string>
      <string id="AllowUseSystemKeysRemote">Allow administrators to use platform keys remotely</string>
      <string id="AllowUseSystemKeysRemote_Explain">Enabled: An administrator can use platform keys not only locally but also remotely.

Disabled: Using platform keys remotely is not allowed. For privacy issues, the access to these keys is restricted as discussed within the Trusted Computing Group (TCG). This way all keys which would allow an identification of your Security Platform are hidden for remote access.
This policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.
Note that the Security Platform administration and operation is not restricted by this policy.

Default value: Disabled</string>
      <string id="AllowReadingNV">Allow reading of unprotected TPM NV memory</string>
      <string id="AllowReadingNV_Explain">Determines who may read unprotected Non-Volatile (NV) memory stored in a Trusted Platform Module 1.2. The NV memory may contain sensitive data.

Enabled:Specify whether only local administrators, local and remote administrators, all local users or all users may read unprotected NV data.

Disabled: No user may read unprotected NV data.

This policy is only relevant for Security Platforms with a Trusted Platform Module 1.2.
Note that the Security Platform administration and operation is not restricted by this setting.

Default value: Enabled/Local administrators</string>
      <string id="LocalAdmins_Explain">1 - Local administrators</string>
      <string id="LocalRemoteAdmins_Explain">2 - Local and remote administrators</string>
      <string id="LocalUsers_Explain">3 - All local users</string>
      <string id="AllUsers_Explain">4 - All users</string>
      <string id="SelectOption">Select an option to enable:
</string>
      <string id="DictionaryAttackThreshold">Configure dictionary attack threshold</string>
      <string id="DictionaryAttackThreshold_Explain">Determines the number of allowed Trusted Platform Module authentication attempts, before dictionary attack defending measures are taken.

Enabled: Specify how many authentication attempts should be allowed for keys (e.g. used for Security Platform User authentication), owner, and for the access of sealed data (e.g. used by Windows BitLocker in combination with PIN), before dictionary attack defending measures are taken.  

Disabled: The dictionary attack threshold cannot be configured. The default values are in effect.

Default value: Enabled. Owner: 3 attempts. Key: 5 attempts. Data: 10 attempts.

This policy is only relevant for Security Platforms with an Infineon Trusted Platform Module 1.2. It needs to be set before Security Platform Initialization. Subsequent changes of this policy will only be effective after the next defense level reset.
If this policy is not configured, then the same settings can be set individually for each platform in stand-alone mode via Initialization Wizard. In this case no defense level reset is needed for the settings to be effective.
Note that all Security Platform users share the number of allowed user authentication attempts. Consider this if there are multiple parallel users on a system (e.g. using Fast User Switching).</string>
      <string id="DictionaryAttackThresholdUser"> Allowed attempts: </string>
      <string id="DictionaryAttackThresholdUser_Explain1">Key authentication</string>
      <string id="DictionaryAttackThresholdOwner"> Allowed attempts: </string>
      <string id="DictionaryAttackThresholdOwner_Explain1">Owner authentication</string>
      <string id="DictionaryAttackThresholdData"> Allowed attempts: </string>
      <string id="DictionaryAttackThresholdData_Explain1">Data authentication</string>
      <string id="EnableStringentPasswordFieldSecurity">Enable stringent password field security</string>
      <string id="EnableStringentPasswordFieldSecurity_Explain">Enabled: The ability to cut, copy, paste and see secret data (e.g. passwords or secrets) in clear text is not available.

Disabled: The ability to paste is available. Additionally cut and copy operation is available when secret data (e.g. passwords or secrets) is visible in clear text.

Default value: Disabled</string>
      <string id="PurgeKeysWhenEnteringEnergySavingStates">Purge keys when entering energy-saving states</string>
      <string id="PurgeKeysWhenEnteringEnergySavingStates_Explain">Enabled: Security Platform keys are purged, before the computer enters one of the energy-saving states standby (S3) or hibernation (S4). Thus the security level during energy-saving state will be raised. After coming back from the energy-saving state, Security Platform Features will require a user authentication again.

Disabled: Security Platform keys are not purged.

Default value: Enabled</string>
      <string id="EnhancedAuthenticationProviders">Enhanced Authentication providers</string>
      <string id="EnhancedAuthenticationProviders_Explain">Enabled: Enter an Enhanced Authentication provider class ID (CLSID), or multiple CLSIDs separated by semicolons.
Only the providers specified here will be accepted to utilize Enhanced Authentication on client systems which are not yet set-up.
If you do not know an Enhanced Authentication provider's class ID, then please contact the Enhanced Authentication provider manufacturer.
ClassID Example: {76D8D888-B5AC-49FC-9408-8A45D37F3AC6}

Disabled: No Enhanced Authentication providers can be specified. Enhanced Authentication cannot be utilized on client systems which are not yet set-up.

Default value: In server mode, same behavior as if disabled. In stand-alone mode, same behavior as in former product versions, i.e. installed providers can be used.</string>
      <string id="EnhancedAuthenticationProviders_Explain1">Please enter one or multiple CLSID(s).</string>
      <string id="EnhancedAuthenticationProviders_Explain2">CLSID(s):</string>
      <string id="TakeOwnershipRemote">Allow administrators to take ownership remotely</string>
      <string id="TakeOwnershipRemote_Explain">Enabled: An administrator is not required to be present locally when taking ownership on a computer. This functionality may be especially useful when performing setup of the clients in large networks.

Disabled: Taking ownership remotely is not allowed.
This policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.

Default value: Disabled</string>
      <string id="ReadPubSRKRemote">Allow administrators to retrieve the SRK public key remotely</string>
      <string id="ReadPubSRKRemote_Explain">Determines who may read the Storage Root Key's (SRK) public key stored in a Trusted Platform Module. The SRK public key requires particular protection, since the Security Platform can be identified by it.

Enabled: An administrator can retrieve the SRK public key not only locally but also remotely.

Disabled: Retrieving the SRK public key remotely is not allowed.
The migration step Automatic export and authorization requires that this setting is enabled on the migration destination computer.
This policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.

Default value: Disabled</string>
      <string id="OwnerPasswordMinLen">Minimum password length</string>
      <string id="OwnerPasswordMinLen_Explain">Enabled: Enter the desired minimum Owner Password length, e.g. 6.
The minimum password length is valid for Owner Passwords which are set or changed subsequently.

Disabled: The minimum password length is 6 characters.

Default value: Enabled, 6 characters

Note: This setting applies only for Owner Passwords set on a stand-alone Security Platform. The minimum password length for Owner Passwords set via Trusted Computing Management Server is set by the Trusted Computing Management Server policy with the same name.</string>
      <string id="OwnerPasswordMinLenValue">Minimum password length: </string>
      <string id="OwnerPasswordMinLenValue_Explain">Please enter the minimum password length in characters</string>
      <string id="OwnerPasswordComplexityReqs">Password must meet complexity requirements</string>
      <string id="OwnerPasswordComplexityReqs_Explain">Enabled: Password complexity requirements are enforced for Owner Passwords which are set or changed subsequently.
This means that characters from 3 of the following 4 categories are required:
- English uppercase characters (A through Z)
- English lowercase characters (a through z)
- Base 10 digits (0 through 9)
- Non-alphanumeric characters (e.g. !, $, #, %)

Disabled: No password complexity requirements are enforced.

Default value: Disabled

Note: This setting applies only for Owner Passwords set on a stand-alone Security Platform. The complexity requirements for Owner Passwords set via Trusted Computing Management Server are set by the Trusted Computing Management Server policy with the same name.</string>
      <string id="PlatformEnrollment">Allow platform enrollment</string>
      <string id="PlatformEnrollment_Explain">Enabled/Allow Management Provider and Wizard: Platforms can be initialized via Management Provider interface, Quick Initialization Wizard or Initialization Wizard.

Enabled/Allow Management Provider only:
Platforms can be initialized only via Management Provider interface.

Disabled: Platforms cannot be initialized.

Default value: Enabled/Allow Management Provider and Wizard.</string>
      <string id="EnforceInitializationOfBackup">Enforce configuration of Backup including Emergency Recovery</string>
      <string id="EnforceInitializationOfBackup_Explain">Enabled: The configuration of automatic backups (including Emergency Recovery) is mandatory in the Security Platform Initialization process.
If the Security Platform has already been initialized without configuring automatic backups, there is no enforcement to configure automatic backups.

Disabled: There is no enforcement to configure automatic backups. Backup can be configured after Security Platform Initialization via Settings Tool - Backup - Configure.

Default value: Disabled</string>
      <string id="BackupArchiveLocation">Backup archive location</string>
      <string id="BackupArchiveLocation_Explain">Enabled: Enter a path including backup archive file name, e.g. \\BackupServer\SecurityPlatformShare\SPSystemBackup.xml.
This target path will be enforced when the feature Backup is configured.
If the feature Backup has already been configured, then the existing backup path is kept as long as no re-configuration is performed.
Be sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Backup configuration will fail.

Disabled: The backup target path can be freely specified when the feature Backup is configured.

Default value: Disabled</string>
      <string id="BackupArchiveLocationFile">Location: </string>
      <string id="BackupArchiveLocationFile_Explain">Please enter a fully qualified file name.</string>
      <string id="EnforceImmediateSystemBackup">Enforce immediate System Backup</string>
      <string id="EnforceImmediateSystemBackup_Explain">Enabled: The System Backup Archive will be immediately updated after significant changes of Security Platform data.
Preconditions: Automatic backups must be configured. Also writing access to the System Backup Archive must be allowed.

Disabled: The System Backup Archive will not be immediately updated after significant changes of Security Platform data. If automatic backups are configured and writing access to the System Backup Archive is allowed, the archive will be updated with the next scheduled System Backup.

Default value: Enabled</string>
      <string id="EmergencyTokenPublicKeyLocation">Use public key of Emergency Recovery Token from archive</string>
      <string id="EmergencyTokenPublicKeyLocation_Explain">Enabled: Enter a path including public key file name, e.g. \\ServerName\FolderName\FileName.xml.
This path will be enforced when Emergency Recovery is configured.
If Emergency Recovery has already been configured on a Security Platform PC, this setting will not have any effect for this PC.
Be sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Emergency Recovery configuration will fail.
See also 'How to create a public key archive file from a token file' FAQ entry in the Security Platform Solution Help.

Disabled: The Emergency Recovery Token can be created or selected when Emergency Recovery is configured.

Default value: Disabled</string>
      <string id="EmergencyTokenPublicKeyLocationFile">Location: </string>
      <string id="EmergencyTokenPublicKeyLocationFile_Explain">Please enter a fully qualified file name.</string>
      <string id="EnforceInitializationOfPasswordReset">Enforce configuration of Password Reset</string>
      <string id="EnforceInitializationOfPasswordReset_Explain">Enabled: The configuration of Password Reset is mandatory in the Security Platform Initialization process.
If the Security Platform has already been initialized without configuring Password Reset, there is no enforcement to configure Password Reset.

Disabled: There is no enforcement to configure Password Reset. Password Reset can be configured after Security Platform Initialization via Settings Tool - Password Reset - Configure.

Default value: Disabled</string>
      <string id="PasswordResetTokenPublicKeyLocation">Use public key of Password Reset Token from archive</string>
      <string id="PasswordResetTokenPublicKeyLocation_Explain">Enabled: Enter a path including public key file name, e.g. \\ServerName\FolderName\FileName.xml.
This path will be enforced when Password Reset is configured.
If Password Reset has already been configured on a Security Platform PC, this setting will not have any effect for this PC.
Be sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Password Reset configuration will fail.
See also 'How to create a public key archive file from a token file' FAQ entry in the Security Platform Solution Help.

Disabled: The Password Reset Token can be created or selected when Password Reset is configured.

Default value: Disabled</string>
      <string id="PasswordResetTokenPublicKeyLocationFile">Location: </string>
      <string id="PasswordResetTokenPublicKeyLocationFile_Explain">Please enter a fully qualified file name.</string>
      <string id="EmRecArchive">File location for Emergency Recovery Archive</string>
      <string id="EmRecArchive_Explain">This setting is only relevant for older versions of the Security Platform Solution Software.

In older versions, the file location for the Emergency Recovery Archive could be set explicitly during Security Platform Initialization. With this policy, the file location could be enforced.

In the current version, the file location is set automatically.</string>
      <string id="EmRecArchiveFile">Location: </string>
      <string id="EmRecArchiveFile_Explain">Please enter a full qualified xml file name.</string>
      <string id="CertificateRequest">URL to start from wizard for certificate enrollment</string>
      <string id="CertificateRequest_Explain">Enabled: This setting specifies the web address that is used by the Infineon Security Platform User Initialization Wizard to retrieve certificates using a web browser.
The page to get a certificate is only available in the User Initialization Wizard if this setting is enabled and at least one Security Platform Feature has been selected for configuration.

Notes:This setting is supported as system policy to be compatible with earlier versions of the Security Platform Solution Software.
Recommendation: Use this setting as a user policy.
While this setting is independent of the certificate usage, there is also a special user policy for EFS certificates (EFS certificate type and enrollment).

Disabled: The page to get a certificate is not available in the Infineon Security Platform User Initialization Wizard.

Default value: Disabled</string>
      <string id="CertificateRequestFile">Location: </string>
      <string id="CertificateRequestFile_Explain">Please enter a URL for the certificate request.</string>
      <string id="BUPasswordMinLen">Minimum password length</string>
      <string id="BUPasswordMinLen_Explain">Enabled: Enter the desired minimum Basic User Password length, e.g. 6.
The minimum password length is valid for Basic User Passwords which are set or changed subsequently.

Disabled: The minimum password length is 6 characters.

Default value: Enabled, 6 characters</string>
      <string id="BUPasswordMinLenValue">Minimum password length: </string>
      <string id="BUPasswordMinLenValue_Explain">Please enter the minimum password length in characters</string>
      <string id="BUPasswordComplexityReqs">Password must meet complexity requirements</string>
      <string id="BUPasswordComplexityReqs_Explain">Enabled: Password complexity requirements are enforced for Basic User Passwords which are set or changed subsequently.
This means that characters from 3 of the following 4 categories are required:
- English uppercase characters (A through Z)
- English lowercase characters (a through z)
- Base 10 digits (0 through 9)
- Non-alphanumeric characters (e.g. !, $, #, %)

Disabled: No password complexity requirements are enforced.

Default value: Disabled</string>
      <string id="BUPasswordMaxAge">Maximum Basic User Password age</string>
      <string id="BUPasswordMaxAge_Explain">Determines the period of time (in days) that a Basic User Password can be used before the system requires the user to change it.

Enabled:
Maximum Basic User Password age: Enter the desired maximum Basic User Password age, e.g. 42 days.
Basic User Password expiration warning: Specify how many days before Basic User Password expiration users shall be notified, e.g. 7 days.

Disabled: There is no maximum Basic User Password age, i.e. passwords do not expire.

Default value: Disabled</string>
      <string id="BUPasswordMaxAgeValue">Number of days: </string>
      <string id="BUPasswordMaxAgeValue_Explain1">Maximum Basic User Password age</string>
      <string id="BUPasswordExpirationValue">Number of days: </string>
      <string id="BUPasswordExpirationValue_Explain1">Basic User Password expiration warning</string>
      <string id="BUPassphraseMinLen">Minimum passphrase length</string>
      <string id="BUPassphraseMinLen_Explain">This policy is only relevant if Enhanced Authentication is used.

Enabled: Enter the desired minimum Basic User Passphrase length, e.g. 20.
The minimum passphrase length is valid for Basic User Passphrases which are set or changed subsequently.

Disabled: The minimum passphrase length is 20 characters.

Default value: Enabled, 20 characters</string>
      <string id="BUPassphraseMinLenValue">Minimum passphrase length: </string>
      <string id="BUPassphraseMinLenValue_Explain">Please enter the minimum passphrase length in characters.</string>
      <string id="BUPassphraseComplexityReqs">Passphrase must meet complexity requirements</string>
      <string id="BUPassphraseComplexityReqs_Explain">This policy is only relevant if Enhanced Authentication is used.

Enabled: Complexity requirements are enforced for Basic User Passphrases which are set or changed subsequently.
This means that characters from 3 of the following 4 categories are required:
- English uppercase characters (A through Z)
- English lowercase characters (a through z)
- Base 10 digits (0 through 9)
- Non-alphanumeric characters (e.g. !, $, #, %)

Disabled: No complexity requirements are enforced.

Default value: Disabled</string>
      <string id="QuickInitialization">Control Quick Initialization</string>
      <string id="QuickInitializationt_Explain">Enabled/Allow: Quick Initialization Wizard or Security Platform Initialization Wizard and User Initialization Wizard can be used to initialize platforms and users.

Enabled/Enforce: Quick Initialization Wizard must be used to initialize platforms and/or users. Also available features (EFS, PSD) must be initially configured with Quick Initialization Wizard.

Disabled: Quick Initialization Wizard cannot be used to initialize platforms and users. Security Platform Initialization Wizard and User Initialization Wizard must be used instead.

Default value: Enabled/Allow</string>
      <string id="QuickInitialization_Enforce_Explain">Enforce</string>
      <string id="QuickInitialization_Allow_Explain">Allow</string>
      <string id="NonMigratableBUK">Creation of non-migratable Basic User Key</string>
      <string id="NonMigratableBUK_Explain">Enabled/On demand: Users are prompted to create their non-migratable Basic User Key, when they are going to use Infineon TPM Strong Cryptographic Provider for the first time. Note that the Strong Cryptographic Provider requires a non-migratable Basic User Key.

Enabled/Automatic: For new users, the non-migratable Basic User Key is automatically created during user initialization. For users who are already initialized, the non-migratable Basic User Key is created on demand.

Disabled: No non-migratable Basic User Key is created, i.e. the Infineon TPM Strong Cryptographic Provider cannot be used.

Default value: Enabled/On demand</string>
      <string id="NonMigratableBUK_OnDemand_Explain">On demand</string>
      <string id="NonMigratableBUK_Automatic_Explain">Automatic</string>
      <string id="TempDisable">Allow user to temporarily disable the Security Platform Features</string>
      <string id="TempDisable_Explain">Enabled: The Infineon Security Platform User can switch off the active Security Platform Features until the computer is rebooted the next time.

Disabled: The ability to temporarily disable the Infineon Security Platform is not available in the user interface of the Security Platform Solution Software.

This policy is only relevant for Security Platforms with an Infineon Trusted Platform Module 1.1.
When the user logs off and a different user logs on, the deactivated Security Platform Features remain deactivated until the computer gets rebooted.

Default value: Enabled</string>
      <string id="SecureMailAllow">Allow secure e-mail configuration</string>
      <string id="EFSAllow">Allow EFS configuration</string>
      <string id="PSDAllow">Allow PSD configuration</string>
      <string id="AllowFeature_Explain">Enabled: The user is allowed to configure this Security Platform Feature.

Disabled: The user cannot configure this feature, but a previous configuration can be used.

Default value: Enabled</string>
      <string id="AllowScript_Explain">Allow Management Provider only</string>
      <string id="AllowWizard_Explain">Allow Management Provider and Wizard</string>
      <string id="EnforceEnablingOfPasswordReset">Enforce enabling of Password Reset</string>
      <string id="EnforceEnablingOfPasswordReset_Explain">Enabled: Enabling Password Reset is mandatory in the User Initialization process.
If a Security Platform User has already been initialized without enabling Password Reset, there is no enforcement to enable Password Reset.

Disabled: There is no enforcement to enable Password Reset. Password Reset can be enabled after User Initialization via Settings Tool - Password Reset - Enable.

Default value: Disabled</string>
      <string id="EnhancedAuthenticationViaBasicUserPassphrase">Enforce Enhanced Authentication</string>
      <string id="EnhancedAuthenticationViaBasicUserPassphrase_Explain">Enabled: Security Platform Users must use Enhanced Authentication (with Basic User Passphrase).

Disabled: Security Platform Users can decide whether they want to use Enhanced Authentication (with Basic User Passphrase) or Password Authentication (with Basic User Password).

Default value: Disabled</string>
      <string id="CacheUserKey">Enable caching of Basic User Password</string>
      <string id="CacheUserKey_Explain">Enabled: The Basic User Password can be cached in the Infineon Security Platform Software, thus reducing the number of required inputs of the password during the current log-on session. This minimizes the number of password prompts for the user.

Disabled: The Basic User Password dialog does not offer the ability to temporarily cache the Basic User Password.

Default value: Enabled</string>
      <string id="EFSCertificateEnrollment">EFS certificate type and enrollment</string>
      <string id="EFSCertificateEnrollment_Explain">Enabled: You can restrict the EFS certificate type. You can also enable the enrollment of external EFS certificates by specifying the Certification Authority's web address.
1.EFS certificate type: Specify whether you want to allow all certificate types (domain, external and self-signed certificates) or only certain certificate types. This restriction will apply when users are going to enroll or select certificates.
2.Certificate request URL: Enter a CA's certificate request web address to be used for EFS certificate enrollment, e.g. https://www.companyname.com/foldername.
This target path will be used when an EFS certificate is requested from an external Certification Authority (CA).
The certificate request URL is optional. If you do not specifiy a path here, users will not be able to request external EFS certificates. If you want to enable external EFS certificates, then enter a valid path which will be accessible to all Security Platform PC's. Otherwise the EFS certificate enrollment will fail.

Disabled: The EFS certificate type is not restricted. The web adress to be used to retrieve EFS certificates is not set, i.e. users cannot request external EFS certificates.

Notes:
Note that EFS certificates are not only used for EFS, but also for PSD.
While this setting is valid only for EFS certificates (to be used for EFS or PSD), there is also a user policy which is independent of the certificate usage (URL to start from wizard for certificate enrollment).

Default value: Disabled</string>
      <string id="EFSCertificateEnrollmentTypes">EFS certificate type:</string>
      <string id="EFSCertificateEnrollFromURL">Certificate Request URL (only relevant for external certificates)</string>
      <string id="EFSCertificate_AllowAllTypes_Explain">Allow all types</string>
      <string id="EFSCertificate_AllowDomain_Explain">Allow only domain certificates</string>
      <string id="EFSCertificate_AllowDomainAndExternal_Explain">Allow only domain and external certificates</string>
      <string id="EFSCertificateExpirationWarningOccurrence">EFS certificate expiration warning occurrence</string>
      <string id="EFSCertificateExpirationWarningOccurrence_Explain">Enabled: Security Platform Users will be notified by a balloon before their EFS certificate expires. Specify when this notification should take place, e.g. 14 days before certificate expiration.

Disabled: There is no notification of certificate expiration.

Default value: Users are notified 14 days before certification expiration.</string>
      <string id="EFSCertificateExpirationWarningOccurrenceValue">Number of days: </string>
      <string id="EFSCertificateExpirationWarningOccurrenceValue_Explain1">Please enter the number of days to remind me</string>
      <string id="EFSCertificateExpirationWarningOccurrenceValue_Explain2">before the EFS certificate expires.</string>
      <string id="EFSSelfSignedCertificateValidityYears">EFS self-signed certificates validity period</string>
      <string id="EFSSelfSignedCertificateValidityYears_Explain">Enabled: Specify the length of time that self-signed EFS certificates shall be valid.

Disabled: The validity period is 10 years.

Default value: Enabled with a validity period of 10 years.</string>
      <string id="EFSSelfSignedCertificateValidityYearsValue">Number of years: </string>
      <string id="EFSSelfSignedCertificateValidityYearsValue_Explain1">Please enter the validity period of self-signed EFS certificates.</string>
      <string id="PSDDefaultDrive">File location for Personal Secure Drive</string>
      <string id="PSDExplain">Enabled/PSD Default Drive: This sets the drive in which the Personal Secure Drive image files will be created. Enter a valid drive letter in the edit field, including a colon but without any additional path (e.g. C:). If the drive letter is invalid, users will not be able to create a Personal Secure Drive image file.

Disabled: The user can select the target drive in which the Personal Secure Drive image files will be created.

Default value: Disabled</string>
      <string id="LimitationOfPSDDriveImageSize">Minimum free space after PSD creation</string>
      <string id="LimitationOfPSDDriveImageSize_Explain">Enabled: If a PSD is saved on the system drive (where the current operating system is located), then a defined amount of free space has to be left after PSD configuration. Specify how much free space has to be left on the system drive after PSD configuration.

Disabled: There is no restriction concerning the free space on the system partition after PSD creation.

Example: The policy is enabled and set to 5000 MB. This means that you need at least 5010 MB free space on your system drive, because the minimum PSD drive size is 10 MB.
Assuming the free space before PSD creation is 5050 MB, then the maximum PSD size would be 50 MB.
Assuming the free space is 5000 MB, then you cannot create a PSD on the system drive.

Default value: The policy is enabled and set to 5000 MB.</string>
      <string id="LimitationOfPSDDriveImageSizeValue">Minimum free space (MB): </string>
      <string id="LimitationOfPSDDriveImageSizeValue_Explain">Please enter the minimum free space after PSD creation.</string>
      <string id="AllowKeyImportForUser">Allow key import for User</string>
      <string id="AllowKeyImportForUser_Explain">Enabled: Security Platform Users are allowed to import private keys into the Security Platform. Note that private keys are imported along with certificates via Certificate Viewer and Certificate Selection.

Disabled: Security Platform Users are not allowed to import private keys into the Security Platform.

Default value: Enabled</string>
      <string id="StrongSigningKey">Enforce strong private key protection for MS-CAPI signing keys</string>
      <string id="StrongSigningKey_Explain">Enabled: All keys used exclusively for signing operations by the MS-CAPI interface are protected by strong private protection. In this case the key is protected by its own password that has to be entered whenever the key is being used for a signing operation.
This specific password can be cached to avoid repetitive input. Since this password is not related to the Basic User Key, the caching mechanism used for the Basic User Password does not affect this password.

Disabled: Signing keys are not protected in a special form.

Default value: Disabled</string>
      <string id="BackupWarningOccurrence">Backup warning occurrence</string>
      <string id="BackupWarningOccurrence_Explain">Enabled: Security Platform Users will be notified by a balloon, if the backup of user-specific credentials and keys has failed (for example, because the backup location is not accessible). Specify how often this notification should take place, e.g. every 2 days after the backup failure, until the next successfull backup.

Disabled: There is no notification of backup failure.

Default value: Users are notified daily.</string>
      <string id="BackupWarningOccurrenceValue">Number of days: </string>
      <string id="BackupWarningOccurrenceValue_Explain1">Specify how often this notification should take place,</string>
      <string id="BackupWarningOccurrenceValue_Explain2">e.g. every 2 days after the backup failure,</string>
      <string id="BackupWarningOccurrenceValue_Explain3">until the next successfull backup.</string>
      <string id="UserEnrollment">Allow user enrollment</string>
      <string id="UserEnrollment_Explain">Enabled/Allow Management Provider and Wizard: Users can be initialized via Management Provider interface, Quick Initialization Wizard or User Initialization Wizard .

Enabled/Allow Management Provider only: Users can be initialized only via Management Provider interface.

Disabled: Users cannot be initialized.

Default value: Enabled/Allow Management Provider Interface and Wizard.</string>
      
      
    </stringTable>
    <presentationTable>
      <presentation id="PrepareTPMEnrollment" />
      <presentation id="AllowUseSystemKeysRemote" />
      <presentation id="AllowReadingNV">
        <dropdownList refId="SelectOption">Select an option to enable:
</dropdownList>
      </presentation>
      <presentation id="DictionaryAttackThreshold">
        <text>Key authentication</text>
        <decimalTextBox refId="DictionaryAttackThresholdUser" defaultValue="5" spinStep="1"> Allowed attempts: </decimalTextBox>
        <text>Owner authentication</text>
        <decimalTextBox refId="DictionaryAttackThresholdOwner" defaultValue="3" spinStep="1"> Allowed attempts: </decimalTextBox>
        <text>Data authentication</text>
        <decimalTextBox refId="DictionaryAttackThresholdData" defaultValue="10" spinStep="1"> Allowed attempts: </decimalTextBox>
      </presentation>
      <presentation id="EnableStringentPasswordFieldSecurity" />
      <presentation id="PurgeKeysWhenEnteringEnergySavingStates" />
      <presentation id="EnhancedAuthenticationProviders">
        <text>Please enter one or multiple CLSID(s).</text>
        <textBox refId="EnhancedAuthenticationProviders_Explain2">
          <label>CLSID(s):</label>
        </textBox>
      </presentation>
      <presentation id="TakeOwnershipRemote" />
      <presentation id="ReadPubSRKRemote" />
      <presentation id="OwnerPasswordMinLen">
        <text>Please enter the minimum password length in characters</text>
        <decimalTextBox refId="OwnerPasswordMinLenValue" defaultValue="6" spinStep="1">Minimum password length: </decimalTextBox>
      </presentation>
      <presentation id="OwnerPasswordComplexityReqs" />
      <presentation id="PlatformEnrollment">
        <dropdownList refId="WizEnabledFile" defaultItem="1">Select an option to enable:
</dropdownList>
      </presentation>
      <presentation id="EnforceInitializationOfBackup" />
      <presentation id="BackupArchiveLocation">
        <text>Please enter a fully qualified file name.</text>
        <textBox refId="BackupArchiveLocationFile">
          <label>Location: </label>
        </textBox>
      </presentation>
      <presentation id="EnforceImmediateSystemBackup" />
      <presentation id="EmergencyTokenPublicKeyLocation">
        <text>Please enter a fully qualified file name.</text>
        <textBox refId="EmergencyTokenPublicKeyLocationFile">
          <label>Location: </label>
        </textBox>
      </presentation>
      <presentation id="EnforceInitializationOfPasswordReset" />
      <presentation id="PasswordResetTokenPublicKeyLocation">
        <text>Please enter a fully qualified file name.</text>
        <textBox refId="PasswordResetTokenPublicKeyLocationFile">
          <label>Location: </label>
        </textBox>
      </presentation>
      <presentation id="EmRecArchive">
        <text>Please enter a full qualified xml file name.</text>
        <textBox refId="EmRecArchiveFile">
          <label>Location: </label>
        </textBox>
      </presentation>
      <presentation id="CertificateRequest">
        <text>Please enter a URL for the certificate request.</text>
        <textBox refId="CertificateRequestFile">
          <label>Location: </label>
        </textBox>
      </presentation>
      <presentation id="BUPasswordMinLen">
        <text>Please enter the minimum password length in characters</text>
        <decimalTextBox refId="BUPasswordMinLenValue" defaultValue="6" spinStep="1">Minimum password length: </decimalTextBox>
      </presentation>
      <presentation id="BUPasswordComplexityReqs" />
      <presentation id="BUPasswordMaxAge">
        <text>Maximum Basic User Password age</text>
        <decimalTextBox refId="BUPasswordMaxAgeValue" defaultValue="42" spinStep="1">Number of days: </decimalTextBox>
        <text>Basic User Password expiration warning</text>
        <decimalTextBox refId="BUPasswordExpirationValue" defaultValue="7" spinStep="1">Number of days: </decimalTextBox>
      </presentation>
      <presentation id="BUPassphraseMinLen">
        <text>Please enter the minimum passphrase length in characters.</text>
        <decimalTextBox refId="BUPassphraseMinLenValue" defaultValue="20" spinStep="1">Minimum passphrase length: </decimalTextBox>
      </presentation>
      <presentation id="BUPassphraseComplexityReqs" />
      <presentation id="QuickInitialization">
        <dropdownList refId="WizEnabledFile" defaultItem="1">Select an option to enable:
</dropdownList>
      </presentation>
      <presentation id="NonMigratableBUK">
        <dropdownList refId="WizEnabledFile" defaultItem="1">Select an option to enable:
</dropdownList>
      </presentation>
      <presentation id="TempDisable" />
      <presentation id="SecureMailAllow" />
      <presentation id="EFSAllow" />
      <presentation id="PSDAllow" />
      <presentation id="EnforceEnablingOfPasswordReset" />
      <presentation id="EnhancedAuthenticationViaBasicUserPassphrase" />
      <presentation id="CacheUserKey" />
      <presentation id="CertificateRequest_1">
        <text>Please enter a URL for the certificate request.</text>
        <textBox refId="CertificateRequestFile">
          <label>Location: </label>
        </textBox>
      </presentation>
      <presentation id="EFSCertificateEnrollment">
        <dropdownList refId="EFSCertificateEnrollmentTypes">EFS certificate type:</dropdownList>
        <textBox refId="EFSCertificateEnrollFromURL">
          <label>Certificate Request URL (only relevant for external certificates)</label>
        </textBox>
      </presentation>
      <presentation id="EFSCertificateExpirationWarningOccurrence">
        <text>Please enter the number of days to remind me</text>
        <text>before the EFS certificate expires.</text>
        <decimalTextBox refId="EFSCertificateExpirationWarningOccurrenceValue" defaultValue="14" spinStep="1">Number of days: </decimalTextBox>
      </presentation>
      <presentation id="EFSSelfSignedCertificateValidityYears">
        <text>Please enter the validity period of self-signed EFS certificates.</text>
        <decimalTextBox refId="EFSSelfSignedCertificateValidityYearsValue" defaultValue="10" spinStep="1">Number of years: </decimalTextBox>
      </presentation>
      <presentation id="PSDDefaultDrive">
        <textBox refId="PSDDefaultDrive">
          <label>PSD Default Drive</label>
        </textBox>
      </presentation>
      <presentation id="LimitationOfPSDDriveImageSize">
        <text>Please enter the minimum free space after PSD creation.</text>
        <decimalTextBox refId="LimitationOfPSDDriveImageSizeValue" defaultValue="5000" spinStep="1">Minimum free space (MB): </decimalTextBox>
      </presentation>
      <presentation id="AllowKeyImportForUser" />
      <presentation id="StrongSigningKey" />
      <presentation id="UserEnrollment">
        <dropdownList refId="WizEnabledFile" defaultItem="1">Select an option to enable:
</dropdownList>
      </presentation>
      <presentation id="BackupWarningOccurrence">
        <text>Specify how often this notification should take place,</text>
        <text>e.g. every 2 days after the backup failure,</text>
        <text>until the next successfull backup.</text>
        <decimalTextBox refId="BackupWarningOccurrenceValue" defaultValue="1" spinStep="1">Number of days: </decimalTextBox>
      </presentation>
    </presentationTable>
  </resources>
</policyDefinitionResources>