;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; IfxSpPol.adm - Security Platform policies
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;


CLASS MACHINE
CATEGORY !!SecurePlatformPolicies
	KEYNAME "Software\Policies\Infineon\TPM Software"
	#if VERSION > 3
	EXPLAIN !!SecurePlatformPolicies_Explain
	#endif	
	CATEGORY !!AllVersionsSettings
		#if VERSION > 3
		EXPLAIN !!AllVersionsSettings_Explain
		#endif

		POLICY !!PrepareTPMEnrollment
			EXPLAIN !!PrepareTPMEnrollment_Explain
			VALUENAME PrepareTPMEnrollmentPol
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY
		
		POLICY !!AllowUseSystemKeysRemote
			EXPLAIN !!AllowUseSystemKeysRemote_Explain
			VALUENAME "AllowUseSystemKeysRemote"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!AllowReadingNV
			EXPLAIN !!AllowReadingNV_Explain
			VALUENAME AllowReadingNVPol
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
			PART !!SelectOption DROPDOWNLIST REQUIRED
				VALUENAME "AllowReadingNV"
				ITEMLIST
					NAME !!LocalAdmins_Explain VALUE NUMERIC 1 DEFAULT
					NAME !!LocalRemoteAdmins_Explain VALUE NUMERIC 2 
					NAME !!LocalUsers_Explain VALUE NUMERIC 3
					NAME !!AllUsers_Explain VALUE NUMERIC 4
				END ITEMLIST
			END PART
		END POLICY

		POLICY !!DictionaryAttackThreshold
			EXPLAIN !!DictionaryAttackThreshold_Explain
			VALUENAME "DictionaryAttackThreshold_Pol" 
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
			PART !!DictionaryAttackThresholdUser_Explain1 TEXT
			END PART
			PART !!DictionaryAttackThresholdUser NUMERIC SPIN 1
				DEFAULT 5
				MIN 1
				MAX 10
				VALUENAME "DictionaryAttackThresholdUser"
			END PART
			PART !!DictionaryAttackThresholdOwner_Explain1 TEXT
			END PART
			PART !!DictionaryAttackThresholdOwner NUMERIC SPIN 1
				DEFAULT 3
				MIN 1
				MAX 10
				VALUENAME "DictionaryAttackThresholdOwner"
			END PART
			PART !!DictionaryAttackThresholdData_Explain1 TEXT
			END PART
			PART !!DictionaryAttackThresholdData NUMERIC SPIN 1
				DEFAULT 10
				MIN 1
				MAX 10
				VALUENAME "DictionaryAttackThresholdData"
			END PART
		END POLICY

		POLICY !!EnableStringentPasswordFieldSecurity
			EXPLAIN !!EnableStringentPasswordFieldSecurity_Explain
			VALUENAME "EnableStringentPasswordFieldSecurity"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY
		
		POLICY !!PurgeKeysWhenEnteringEnergySavingStates
			EXPLAIN !!PurgeKeysWhenEnteringEnergySavingStates_Explain
			VALUENAME "PurgeKeysWhenEnteringEnergySavingStates"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!EnhancedAuthenticationProviders
			EXPLAIN !!EnhancedAuthenticationProviders_Explain
			VALUENAME "EnhancedAuthenticationProvidersPol"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
			PART !!EnhancedAuthenticationProviders_Explain1 TEXT
			END PART
			PART !!EnhancedAuthenticationProviders_Explain2 EDITTEXT REQUIRED
				VALUENAME "EnhancedAuthenticationProviders"
			END PART		 
		END POLICY
		
		POLICY !!TakeOwnershipRemote
			EXPLAIN !!TakeOwnershipRemote_Explain
			VALUENAME "TakeOwnershipRemote"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!ReadPubSRKRemote
			EXPLAIN !!ReadPubSRKRemote_Explain
			VALUENAME "ReadPubSRKRemote"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY	

	END CATEGORY ;;!! AllVersionsSettings
	
	CATEGORY !!StandaloneVersion
		#if VERSION > 3
		EXPLAIN !!StandaloneVersion_Explain
		#endif
	
		CATEGORY !!OwnerPasswordPolicies
			#if VERSION > 3
			EXPLAIN !!OwnerPasswordPolicies_Explain
			#endif
			
			POLICY !!OwnerPasswordMinLen
				EXPLAIN !!OwnerPasswordMinLen_Explain
				PART !!OwnerPasswordMinLenValue_Explain TEXT
				END PART
				PART !!OwnerPasswordMinLenValue NUMERIC SPIN 1
					DEFAULT 6
					MIN 6
					MAX 255
					VALUENAME "OwnerPwdMin"
				END PART
			END POLICY

			POLICY !!OwnerPasswordComplexityReqs
				EXPLAIN !!OwnerPasswordComplexityReqs_Explain
				VALUENAME "OwnerPwdComplexityReqs"
				VALUEON NUMERIC 1
				VALUEOFF NUMERIC 0
			END POLICY

		END CATEGORY ;;!!OwnerPasswordPolicies

		POLICY !!PlatformEnrollment
			EXPLAIN !!PlatformEnrollment_Explain
			VALUENAME PlatformEnrollmentPol
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
			PART !!WizEnabledFile DROPDOWNLIST REQUIRED
				VALUENAME "PlatformEnrollment"
				ITEMLIST
					NAME !!AllowScript_Explain VALUE NUMERIC 1
					NAME !!AllowWizard_Explain VALUE NUMERIC 2 DEFAULT
				END ITEMLIST
			END PART
		END POLICY

		POLICY !!EnforceInitializationOfBackup
			EXPLAIN !!EnforceInitializationOfBackup_Explain
			VALUENAME "EnforceInitializationOfBackup"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!BackupArchiveLocation
			EXPLAIN !!BackupArchiveLocation_Explain
			PART !!BackupArchiveLocationFile_Explain TEXT
			END PART
			PART !!BackupArchiveLocationFile EDITTEXT REQUIRED
				VALUENAME "BackupArchiveLocation"
			END PART		 
		END POLICY

		POLICY !!EnforceImmediateSystemBackup
			EXPLAIN !!EnforceImmediateSystemBackup_Explain
			VALUENAME "EnforceImmediateSystemBackup"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY
		
		POLICY !!EmergencyTokenPublicKeyLocation
			EXPLAIN !!EmergencyTokenPublicKeyLocation_Explain
			PART !!EmergencyTokenPublicKeyLocationFile_Explain TEXT
			END PART
			PART !!EmergencyTokenPublicKeyLocationFile EDITTEXT REQUIRED
				VALUENAME "EmergencyTokenPublicKeyLocation"
			END PART		 
		END POLICY

		POLICY !!EnforceInitializationOfPasswordReset
			EXPLAIN !!EnforceInitializationOfPasswordReset_Explain
			VALUENAME "EnforceInitializationOfPasswordReset"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!PasswordResetTokenPublicKeyLocation
			EXPLAIN !!PasswordResetTokenPublicKeyLocation_Explain
			PART !!PasswordResetTokenPublicKeyLocationFile_Explain TEXT
			END PART
			PART !!PasswordResetTokenPublicKeyLocationFile EDITTEXT REQUIRED
				VALUENAME "PasswordResetTokenPublicKeyLocation"
			END PART		 
		END POLICY

	END CATEGORY ;;!!StandaloneVersion
	
	CATEGORY !!PreviousProductVersion
		#if VERSION > 3
		EXPLAIN !!PreviousProductVersion_Explain
		#endif
		
		POLICY !!EmRecArchive
			EXPLAIN !!EmRecArchive_Explain
			PART !!EmRecArchiveFile_Explain TEXT
			END PART
			PART !!EmRecArchiveFile EDITTEXT REQUIRED
			VALUENAME "EmRecArchive"
			END PART		 
		END POLICY
		
		POLICY !!CertificateRequest
			EXPLAIN !!CertificateRequest_Explain
			PART !!CertificateRequestFile_Explain TEXT
			END PART
			PART !!CertificateRequestFile EDITTEXT REQUIRED
			VALUENAME "CertificateRequest"
			END PART		 
		END POLICY

	END CATEGORY ;;!!PreviousProductVersion

END CATEGORY ;;!!SecurePlatformPolicies

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; END OF CLASS MACHINE
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CLASS USER

CATEGORY !!SecurePlatformPolicies
	KEYNAME "Software\Policies\Infineon\TPM Software"
	#if VERSION > 3
	EXPLAIN !!SecurePlatformPolicies_Explain
	#endif

	CATEGORY !!AllVersionsSettings
		#if VERSION > 3
		EXPLAIN !!AllVersionsSettings_Explain
		#endif
	
		CATEGORY !!BasicUserPasswordPolicies
		
			#if VERSION > 3
			EXPLAIN !!BasicUserPasswordPolicies_Explain
			#endif
			POLICY !!BUPasswordMinLen
				EXPLAIN !!BUPasswordMinLen_Explain
				PART !!BUPasswordMinLenValue_Explain TEXT
				END PART
				PART !!BUPasswordMinLenValue NUMERIC SPIN 1
					DEFAULT 6
					MIN 6
					MAX 255
					VALUENAME "UserPwdMin"
				END PART
			END POLICY
			
			POLICY !!BUPasswordComplexityReqs
				EXPLAIN !!BUPasswordComplexityReqs_Explain
				VALUENAME "UserPwdComplexityReqs"
				VALUEON NUMERIC 1
				VALUEOFF NUMERIC 0
			END POLICY

			POLICY !!BUPasswordMaxAge
				EXPLAIN !!BUPasswordMaxAge_Explain
				VALUENAME "BUPasswordMaxAge_Pol" 
				VALUEON NUMERIC 1
				VALUEOFF NUMERIC 0
				PART !!BUPasswordMaxAgeValue_Explain1 TEXT
				END PART
				PART !!BUPasswordMaxAgeValue NUMERIC SPIN 1
					DEFAULT 42
					MIN 7
					VALUENAME "BUPasswordMaxAge"
				END PART
				PART !!BUPasswordExpirationValue_Explain1 TEXT
				END PART
				PART !!BUPasswordExpirationValue NUMERIC SPIN 1
					DEFAULT 7
					MIN 1
					VALUENAME "BUPasswordExpiration"
				END PART
			END POLICY

		END CATEGORY ;;!!BasicUserPasswordPolicies

		CATEGORY !!BasicUserPassphrasePolicies
		
			#if VERSION > 3
			EXPLAIN !!BasicUserPassphrasePolicies_Explain
			#endif
			POLICY !!BUPassphraseMinLen
				EXPLAIN !!BUPassphraseMinLen_Explain
				PART !!BUPassphraseMinLenValue_Explain TEXT
				END PART
				PART !!BUPassphraseMinLenValue NUMERIC SPIN 1
					DEFAULT 20
					MIN 20
					MAX 255
					VALUENAME "UserPassphraseMin"
				END PART
			END POLICY

			POLICY !!BUPassphraseComplexityReqs
				EXPLAIN !!BUPassphraseComplexityReqs_Explain
				VALUENAME "UserPassphraseComplexityReqs"
				VALUEON NUMERIC 1
				VALUEOFF NUMERIC 0
			END POLICY

		END CATEGORY ;;!!BasicUserPassphrasePolicies

		POLICY !!QuickInitialization
			EXPLAIN !!QuickInitializationt_Explain
			VALUENAME QuickInitializationPol
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
			PART !!WizEnabledFile DROPDOWNLIST REQUIRED
				VALUENAME "QuickInitialization"
				ITEMLIST
					NAME !!QuickInitialization_Enforce_Explain VALUE NUMERIC 1
					NAME !!QuickInitialization_Allow_Explain VALUE NUMERIC 2 DEFAULT				
				END ITEMLIST
			END PART
		END POLICY
		
		POLICY !!NonMigratableBUK
			EXPLAIN !!NonMigratableBUK_Explain
			VALUENAME NonMigratableBUKPol
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
			PART !!WizEnabledFile DROPDOWNLIST REQUIRED
				VALUENAME "NonMigratableBUK"
				ITEMLIST
					NAME !!NonMigratableBUK_Automatic_Explain VALUE NUMERIC 1
					NAME !!NonMigratableBUK_OnDemand_Explain VALUE NUMERIC 2 DEFAULT					
				END ITEMLIST
			END PART
		END POLICY

		POLICY !!TempDisable
			EXPLAIN !!TempDisable_Explain
			VALUENAME "TempDisable"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!SecureMailAllow
			EXPLAIN !!AllowFeature_Explain
			VALUENAME "FeatureSecureMail"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!EFSAllow
			EXPLAIN !!AllowFeature_Explain
			VALUENAME "FeatureEFS"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!PSDAllow
			EXPLAIN !!AllowFeature_Explain
			VALUENAME "FeaturePSD"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!EnforceEnablingOfPasswordReset
			EXPLAIN !!EnforceEnablingOfPasswordReset_Explain
			VALUENAME "EnforceEnablingOfPasswordReset"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!EnhancedAuthenticationViaBasicUserPassphrase
			EXPLAIN !!EnhancedAuthenticationViaBasicUserPassphrase_Explain
			VALUENAME "EnhancedAuthenticationViaBasicUserPassphrase"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!CacheUserKey
			EXPLAIN !!CacheUserKey_Explain
			VALUENAME "CacheUserKey"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!CertificateRequest
			EXPLAIN !!CertificateRequest_Explain
			PART !!CertificateRequestFile_Explain TEXT
			END PART
			PART !!CertificateRequestFile EDITTEXT REQUIRED
				VALUENAME "CertificateRequest"
			END PART		 
		END POLICY

		POLICY !!EFSCertificateEnrollment
			EXPLAIN !!EFSCertificateEnrollment_Explain
			VALUENAME "EFSCertificateEnrollmentPol"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
			PART !!EFSCertificateEnrollmentTypes DROPDOWNLIST REQUIRED
				VALUENAME "EFSCertificateTypes"
				ITEMLIST
					NAME !!EFSCertificate_AllowAllTypes_Explain VALUE NUMERIC 1 DEFAULT
					NAME !!EFSCertificate_AllowDomain_Explain VALUE NUMERIC 2 
					NAME !!EFSCertificate_AllowDomainAndExternal_Explain VALUE NUMERIC 3
				END ITEMLIST
			END PART
			PART !!EFSCertificateEnrollFromURL EDITTEXT
				VALUENAME "EFSCertificateEnrollmentURL"
			END PART		 
		END POLICY

		POLICY !!EFSCertificateExpirationWarningOccurrence
			EXPLAIN !!EFSCertificateExpirationWarningOccurrence_Explain
			VALUENAME "EFSCertificateExpirationWarningOccurrencePol"
			VALUEOFF NUMERIC 0
			VALUEON	NUMERIC 1
			PART !!EFSCertificateExpirationWarningOccurrenceValue_Explain1 TEXT
			END PART
			PART !!EFSCertificateExpirationWarningOccurrenceValue_Explain2 TEXT
			END PART
			PART !!EFSCertificateExpirationWarningOccurrenceValue NUMERIC SPIN 1
				DEFAULT 14
				MIN 7
				VALUENAME "EFSCertificateExpirationWarningOccurrence"
			END PART
		END POLICY

 		POLICY !!EFSSelfSignedCertificateValidityYears
			EXPLAIN !!EFSSelfSignedCertificateValidityYears_Explain
			VALUENAME "EFSSelfSignedCertificateValidityYearsPol"
			VALUEOFF NUMERIC 0
			VALUEON	NUMERIC 1
			PART !!EFSSelfSignedCertificateValidityYearsValue_Explain1 TEXT
			END PART
			PART !!EFSSelfSignedCertificateValidityYearsValue NUMERIC SPIN 1
				DEFAULT 10
				MIN 1
				Max 100
			VALUENAME "EFSSelfSignedCertificateValidityYears"
			END PART
 		END POLICY

		POLICY !!PSDDefaultDrive
			EXPLAIN !!PSDExplain
			VALUENAME "PSDDefaultPath"
			PART "PSD Default Drive" EDITTEXT 
				VALUENAME "PSDValueName"
			END PART
		END POLICY

		POLICY !!LimitationOfPSDDriveImageSize
			EXPLAIN !!LimitationOfPSDDriveImageSize_Explain
			VALUENAME "LimitationOfPSDDriveImageSizePol"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
			PART !!LimitationOfPSDDriveImageSizeValue_Explain TEXT
			END PART
			PART !!LimitationOfPSDDriveImageSizeValue NUMERIC SPIN 1
				DEFAULT 5000
				MIN 0
				VALUENAME "LimitationOfPSDDriveImageSize"
			END PART
		END POLICY

		POLICY !!AllowKeyImportForUser
			EXPLAIN !!AllowKeyImportForUser_Explain
			VALUENAME "AllowKeyImportForUser"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

		POLICY !!StrongSigningKey
			EXPLAIN !!StrongSigningKey_Explain
			VALUENAME "StrongSigningKey"
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
		END POLICY

	END CATEGORY ;;!! AllVersionsSettings

	CATEGORY !!StandaloneVersion

		#if VERSION > 3
		EXPLAIN !!StandaloneVersion_Explain
		#endif

		POLICY !!UserEnrollment
			EXPLAIN !!UserEnrollment_Explain
			VALUENAME UserEnrollmentPol
			VALUEON NUMERIC 1
			VALUEOFF NUMERIC 0
			PART !!WizEnabledFile DROPDOWNLIST REQUIRED
				VALUENAME "UserEnrollment"
				ITEMLIST
					NAME !!AllowScript_Explain VALUE NUMERIC 1
					NAME !!AllowWizard_Explain VALUE NUMERIC 2 DEFAULT
				END ITEMLIST
			END PART
		END POLICY

		POLICY !!BackupWarningOccurrence
			EXPLAIN !!BackupWarningOccurrence_Explain
			VALUENAME "BackupWarningOccurrencePol"
			VALUEOFF NUMERIC 0
			VALUEON	NUMERIC 1
			PART !!BackupWarningOccurrenceValue_Explain1 TEXT
			END PART
			PART !!BackupWarningOccurrenceValue_Explain2 TEXT
			END PART
			PART !!BackupWarningOccurrenceValue_Explain3 TEXT
			END PART
			PART !!BackupWarningOccurrenceValue NUMERIC SPIN 1
				DEFAULT 1
				MIN 1
				MAX 365
				VALUENAME "BackupWarningOccurrence"
			END PART
		END POLICY

	END CATEGORY ;;!!StandaloneVersion
	
END CATEGORY ;;!!SecurePlatformPolicies

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; END OF CLASS USER
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; STRINGS
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

[strings]

;; COMMON STRINGS 

WizEnabledFile="Select an option to enable:\n"

;; FOLDER NAMES

SecurePlatformPolicies="Security Platform"
SecurePlatformPolicies_Explain="Allows configuration of various Security Platform Settings."

AllVersionsSettings="All Versions Settings"
AllVersionsSettings_Explain="Contains settings that are valid both for the stand-alone computer version and for the server version."

StandaloneVersion="Stand-alone Computer Version Settings"
StandaloneVersion_Explain="Contains settings that are valid only for the stand-alone computer version."

PreviousProductVersion="Previous Product Versions Settings"
PreviousProductVersion_Explain="Contains settings that are valid only for previous product versions."

OwnerPasswordPolicies="Owner Password"
OwnerPasswordPolicies_Explain="Contains settings concerning Owner Passwords"

BasicUserPasswordPolicies="Basic User Password"
BasicUserPasswordPolicies_Explain="Contains settings concerning Basic User Passwords"

BasicUserPassphrasePolicies="Basic User Passphrase"
BasicUserPassphrasePolicies_Explain="Contains settings concerning Basic User Passphrases"

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; COMPUTER CONFIGURATION
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

;; COMPUTER CONFIGURATION - ALL VERSIONS SETTINGS

PrepareTPMEnrollment="Prepare TPM enrollment"
PrepareTPMEnrollment_Explain="Enabled: On not initialized platforms which have a disabled Trusted Platform Module and support the Physical Presence Interface (PPI), the Trusted Platform Module is automatically prepared to be enabled. The users will be guided to complete the enabling.\n\nDisabled: The Trusted Platform Module is not prepared to be enabled automatically.\n\nDefault value: Disabled"
PrepareTPMEnrollment_DropDown="Select an option to enable:\n"
PrepareTPMEnrollment_Explain1="Balloon and Message Box"
PrepareTPMEnrollment_Explain2="Message Box"
PrepareTPMEnrollment_Explain3="Pre-Logon Message Box"
PrepareTPMEnrollment_CheckBox="Administrators only"

AllowUseSystemKeysRemote="Allow administrators to use platform keys remotely"
AllowUseSystemKeysRemote_Explain="Enabled: An administrator can use platform keys not only locally but also remotely.\n\nDisabled: Using platform keys remotely is not allowed. For privacy issues, the access to these keys is restricted as discussed within the Trusted Computing Group (TCG). This way all keys which would allow an identification of your Security Platform are hidden for remote access.\nThis policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.\nNote that the Security Platform administration and operation is not restricted by this policy.\n\nDefault value: Disabled"

AllowReadingNV="Allow reading of unprotected TPM NV memory"
AllowReadingNV_Explain="Determines who may read unprotected Non-Volatile (NV) memory stored in a Trusted Platform Module 1.2. The NV memory may contain sensitive data.\n\nEnabled:Specify whether only local administrators, local and remote administrators, all local users or all users may read unprotected NV data.\n\nDisabled: No user may read unprotected NV data.\n\nThis policy is only relevant for Security Platforms with a Trusted Platform Module 1.2.\nNote that the Security Platform administration and operation is not restricted by this setting.\n\nDefault value: Enabled/Local administrators"
LocalAdmins_Explain="1 - Local administrators"
LocalRemoteAdmins_Explain="2 - Local and remote administrators"
LocalUsers_Explain="3 - All local users"
AllUsers_Explain="4 - All users"
SelectOption="Select an option to enable:\n"

DictionaryAttackThreshold="Configure dictionary attack threshold"
DictionaryAttackThreshold_Explain="Determines the number of allowed Trusted Platform Module authentication attempts, before dictionary attack defending measures are taken.\n\nEnabled: Specify how many authentication attempts should be allowed for keys (e.g. used for Security Platform User authentication), owner, and for the access of sealed data (e.g. used by Windows BitLocker in combination with PIN), before dictionary attack defending measures are taken.  \n\nDisabled: The dictionary attack threshold cannot be configured. The default values are in effect.\n\nDefault value: Enabled. Owner: 3 attempts. Key: 5 attempts. Data: 10 attempts.\n\nThis policy is only relevant for Security Platforms with an Infineon Trusted Platform Module 1.2. It needs to be set before Security Platform Initialization. Subsequent changes of this policy will only be effective after the next defense level reset.\nIf this policy is not configured, then the same settings can be set individually for each platform in stand-alone mode via Initialization Wizard. In this case no defense level reset is needed for the settings to be effective.\nNote that all Security Platform users share the number of allowed user authentication attempts. Consider this if there are multiple parallel users on a system (e.g. using Fast User Switching)."
DictionaryAttackThresholdUser=" Allowed attempts: "
DictionaryAttackThresholdUser_Explain1="Key authentication"
DictionaryAttackThresholdOwner=" Allowed attempts: "
DictionaryAttackThresholdOwner_Explain1="Owner authentication"
DictionaryAttackThresholdData=" Allowed attempts: "
DictionaryAttackThresholdData_Explain1="Data authentication"

EnableStringentPasswordFieldSecurity="Enable stringent password field security"
EnableStringentPasswordFieldSecurity_Explain="Enabled: The ability to cut, copy, paste and see secret data (e.g. passwords or secrets) in clear text is not available.\n\nDisabled: The ability to paste is available. Additionally cut and copy operation is available when secret data (e.g. passwords or secrets) is visible in clear text.\n\nDefault value: Disabled"

PurgeKeysWhenEnteringEnergySavingStates="Purge keys when entering energy-saving states"
PurgeKeysWhenEnteringEnergySavingStates_Explain="Enabled: Security Platform keys are purged, before the computer enters one of the energy-saving states standby (S3) or hibernation (S4). Thus the security level during energy-saving state will be raised. After coming back from the energy-saving state, Security Platform Features will require a user authentication again.\n\nDisabled: Security Platform keys are not purged.\n\nDefault value: Enabled"

EnhancedAuthenticationProviders="Enhanced Authentication providers"
EnhancedAuthenticationProviders_Explain="Enabled: Enter an Enhanced Authentication provider class ID (CLSID), or multiple CLSIDs separated by semicolons.\nOnly the providers specified here will be accepted to utilize Enhanced Authentication on client systems which are not yet set-up.\nIf you do not know an Enhanced Authentication provider's class ID, then please contact the Enhanced Authentication provider manufacturer.\nClassID Example: {76D8D888-B5AC-49FC-9408-8A45D37F3AC6}\n\nDisabled: No Enhanced Authentication providers can be specified. Enhanced Authentication cannot be utilized on client systems which are not yet set-up.\n\nDefault value: In server mode, same behavior as if disabled. In stand-alone mode, same behavior as in former product versions, i.e. installed providers can be used."
EnhancedAuthenticationProviders_Explain1="Please enter one or multiple CLSID(s)."
EnhancedAuthenticationProviders_Explain2="CLSID(s):"

TakeOwnershipRemote="Allow administrators to take ownership remotely"
TakeOwnershipRemote_Explain="Enabled: An administrator is not required to be present locally when taking ownership on a computer. This functionality may be especially useful when performing setup of the clients in large networks.\n\nDisabled: Taking ownership remotely is not allowed.\nThis policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.\n\nDefault value: Disabled"

ReadPubSRKRemote="Allow administrators to retrieve the SRK public key remotely"
ReadPubSRKRemote_Explain="Determines who may read the Storage Root Key's (SRK) public key stored in a Trusted Platform Module. The SRK public key requires particular protection, since the Security Platform can be identified by it.\n\nEnabled: An administrator can retrieve the SRK public key not only locally but also remotely.\n\nDisabled: Retrieving the SRK public key remotely is not allowed.\nThe migration step Automatic export and authorization requires that this setting is enabled on the migration destination computer.\nThis policy requires that all involved computers are members of trusted domains. It is only relevant for operating systems that support domain membership.\n\nDefault value: Disabled"

;; COMPUTER CONFIGURATION - STAND-ALONE COMPUTER VERSION SETTINGS - OWNER PASSWORD

OwnerPasswordMinLen="Minimum password length"
OwnerPasswordMinLen_Explain="Enabled: Enter the desired minimum Owner Password length, e.g. 6.\nThe minimum password length is valid for Owner Passwords which are set or changed subsequently.\n\nDisabled: The minimum password length is 6 characters.\n\nDefault value: Enabled, 6 characters\n\nNote: This setting applies only for Owner Passwords set on a stand-alone Security Platform. The minimum password length for Owner Passwords set via Trusted Computing Management Server is set by the Trusted Computing Management Server policy with the same name."
OwnerPasswordMinLenValue="Minimum password length: "
OwnerPasswordMinLenValue_Explain="Please enter the minimum password length in characters"

OwnerPasswordComplexityReqs="Password must meet complexity requirements"
OwnerPasswordComplexityReqs_Explain="Enabled: Password complexity requirements are enforced for Owner Passwords which are set or changed subsequently.\nThis means that characters from 3 of the following 4 categories are required:\n- English uppercase characters (A through Z)\n- English lowercase characters (a through z)\n- Base 10 digits (0 through 9)\n- Non-alphanumeric characters (e.g. !, $, #, %)\n\nDisabled: No password complexity requirements are enforced.\n\nDefault value: Disabled\n\nNote: This setting applies only for Owner Passwords set on a stand-alone Security Platform. The complexity requirements for Owner Passwords set via Trusted Computing Management Server are set by the Trusted Computing Management Server policy with the same name."

;; COMPUTER CONFIGURATION - STAND-ALONE COMPUTER VERSION SETTINGS

PlatformEnrollment="Allow platform enrollment"
PlatformEnrollment_Explain="Enabled/Allow Management Provider and Wizard: Platforms can be initialized via Management Provider interface, Quick Initialization Wizard or Initialization Wizard.\n\nEnabled/Allow Management Provider only:\nPlatforms can be initialized only via Management Provider interface.\n\nDisabled: Platforms cannot be initialized.\n\nDefault value: Enabled/Allow Management Provider and Wizard."

EnforceInitializationOfBackup="Enforce configuration of Backup including Emergency Recovery"
EnforceInitializationOfBackup_Explain="Enabled: The configuration of automatic backups (including Emergency Recovery) is mandatory in the Security Platform Initialization process.\nIf the Security Platform has already been initialized without configuring automatic backups, there is no enforcement to configure automatic backups.\n\nDisabled: There is no enforcement to configure automatic backups. Backup can be configured after Security Platform Initialization via Settings Tool - Backup - Configure.\n\nDefault value: Disabled"

BackupArchiveLocation="Backup archive location"
BackupArchiveLocation_Explain="Enabled: Enter a path including backup archive file name, e.g. \\BackupServer\SecurityPlatformShare\SPSystemBackup.xml.\nThis target path will be enforced when the feature Backup is configured.\nIf the feature Backup has already been configured, then the existing backup path is kept as long as no re-configuration is performed.\nBe sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Backup configuration will fail.\n\nDisabled: The backup target path can be freely specified when the feature Backup is configured.\n\nDefault value: Disabled"
BackupArchiveLocationFile="Location: "
BackupArchiveLocationFile_Explain="Please enter a fully qualified file name."

EnforceImmediateSystemBackup="Enforce immediate System Backup"
EnforceImmediateSystemBackup_Explain="Enabled: The System Backup Archive will be immediately updated after significant changes of Security Platform data.\nPreconditions: Automatic backups must be configured. Also writing access to the System Backup Archive must be allowed.\n\nDisabled: The System Backup Archive will not be immediately updated after significant changes of Security Platform data. If automatic backups are configured and writing access to the System Backup Archive is allowed, the archive will be updated with the next scheduled System Backup.\n\nDefault value: Enabled"

EmergencyTokenPublicKeyLocation="Use public key of Emergency Recovery Token from archive"
EmergencyTokenPublicKeyLocation_Explain="Enabled: Enter a path including public key file name, e.g. \\ServerName\FolderName\FileName.xml.\nThis path will be enforced when Emergency Recovery is configured.\nIf Emergency Recovery has already been configured on a Security Platform PC, this setting will not have any effect for this PC.\nBe sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Emergency Recovery configuration will fail.\nSee also 'How to create a public key archive file from a token file' FAQ entry in the Security Platform Solution Help.\n\nDisabled: The Emergency Recovery Token can be created or selected when Emergency Recovery is configured.\n\nDefault value: Disabled"
EmergencyTokenPublicKeyLocationFile="Location: "
EmergencyTokenPublicKeyLocationFile_Explain="Please enter a fully qualified file name."

EnforceInitializationOfPasswordReset="Enforce configuration of Password Reset"
EnforceInitializationOfPasswordReset_Explain="Enabled: The configuration of Password Reset is mandatory in the Security Platform Initialization process.\nIf the Security Platform has already been initialized without configuring Password Reset, there is no enforcement to configure Password Reset.\n\nDisabled: There is no enforcement to configure Password Reset. Password Reset can be configured after Security Platform Initialization via Settings Tool - Password Reset - Configure.\n\nDefault value: Disabled"

PasswordResetTokenPublicKeyLocation="Use public key of Password Reset Token from archive"
PasswordResetTokenPublicKeyLocation_Explain="Enabled: Enter a path including public key file name, e.g. \\ServerName\FolderName\FileName.xml.\nThis path will be enforced when Password Reset is configured.\nIf Password Reset has already been configured on a Security Platform PC, this setting will not have any effect for this PC.\nBe sure to enter a valid path which will be accessible to all Security Platform PC's. Otherwise the Password Reset configuration will fail.\nSee also 'How to create a public key archive file from a token file' FAQ entry in the Security Platform Solution Help.\n\nDisabled: The Password Reset Token can be created or selected when Password Reset is configured.\n\nDefault value: Disabled"
PasswordResetTokenPublicKeyLocationFile="Location: "
PasswordResetTokenPublicKeyLocationFile_Explain="Please enter a fully qualified file name."

;; COMPUTER CONFIGURATION - PREVIOUS PRODUCT VERSIONS SETTINGS

EmRecArchive="File location for Emergency Recovery Archive"
EmRecArchive_Explain="This setting is only relevant for older versions of the Security Platform Solution Software.\n\nIn older versions, the file location for the Emergency Recovery Archive could be set explicitly during Security Platform Initialization. With this policy, the file location could be enforced.\n\nIn the current version, the file location is set automatically."
EmRecArchiveFile="Location: "
EmRecArchiveFile_Explain="Please enter a full qualified xml file name."

CertificateRequest="URL to start from wizard for certificate enrollment"
CertificateRequest_Explain="Enabled: This setting specifies the web address that is used by the Infineon Security Platform User Initialization Wizard to retrieve certificates using a web browser.\nThe page to get a certificate is only available in the User Initialization Wizard if this setting is enabled and at least one Security Platform Feature has been selected for configuration.\n\nNotes:This setting is supported as system policy to be compatible with earlier versions of the Security Platform Solution Software.\nRecommendation: Use this setting as a user policy.\nWhile this setting is independent of the certificate usage, there is also a special user policy for EFS certificates (EFS certificate type and enrollment).\n\nDisabled: The page to get a certificate is not available in the Infineon Security Platform User Initialization Wizard.\n\nDefault value: Disabled"
CertificateRequestFile="Location: "
CertificateRequestFile_Explain="Please enter a URL for the certificate request."

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;; USER CONFIGURATION
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

;; USER CONFIGURATION - ALL VERSIONS SETTINGS - BASIC USER PASSWORD

BUPasswordMinLen="Minimum password length"
BUPasswordMinLen_Explain="Enabled: Enter the desired minimum Basic User Password length, e.g. 6.\nThe minimum password length is valid for Basic User Passwords which are set or changed subsequently.\n\nDisabled: The minimum password length is 6 characters.\n\nDefault value: Enabled, 6 characters"
BUPasswordMinLenValue="Minimum password length: "
BUPasswordMinLenValue_Explain="Please enter the minimum password length in characters"

BUPasswordComplexityReqs="Password must meet complexity requirements"
BUPasswordComplexityReqs_Explain="Enabled: Password complexity requirements are enforced for Basic User Passwords which are set or changed subsequently.\nThis means that characters from 3 of the following 4 categories are required:\n- English uppercase characters (A through Z)\n- English lowercase characters (a through z)\n- Base 10 digits (0 through 9)\n- Non-alphanumeric characters (e.g. !, $, #, %)\n\nDisabled: No password complexity requirements are enforced.\n\nDefault value: Disabled"

BUPasswordMaxAge="Maximum Basic User Password age"
BUPasswordMaxAge_Explain="Determines the period of time (in days) that a Basic User Password can be used before the system requires the user to change it.\n\nEnabled:\nMaximum Basic User Password age: Enter the desired maximum Basic User Password age, e.g. 42 days.\nBasic User Password expiration warning: Specify how many days before Basic User Password expiration users shall be notified, e.g. 7 days.\n\nDisabled: There is no maximum Basic User Password age, i.e. passwords do not expire.\n\nDefault value: Disabled"
BUPasswordMaxAgeValue="Number of days: "
BUPasswordMaxAgeValue_Explain1="Maximum Basic User Password age"
BUPasswordExpirationValue="Number of days: "
BUPasswordExpirationValue_Explain1="Basic User Password expiration warning"

;; USER CONFIGURATION - ALL VERSIONS SETTINGS - BASIC USER PASSPHRASE

BUPassphraseMinLen="Minimum passphrase length"
BUPassphraseMinLen_Explain="This policy is only relevant if Enhanced Authentication is used.\n\nEnabled: Enter the desired minimum Basic User Passphrase length, e.g. 20.\nThe minimum passphrase length is valid for Basic User Passphrases which are set or changed subsequently.\n\nDisabled: The minimum passphrase length is 20 characters.\n\nDefault value: Enabled, 20 characters"
BUPassphraseMinLenValue="Minimum passphrase length: "
BUPassphraseMinLenValue_Explain="Please enter the minimum passphrase length in characters."

BUPassphraseComplexityReqs="Passphrase must meet complexity requirements"
BUPassphraseComplexityReqs_Explain="This policy is only relevant if Enhanced Authentication is used.\n\nEnabled: Complexity requirements are enforced for Basic User Passphrases which are set or changed subsequently.\nThis means that characters from 3 of the following 4 categories are required:\n- English uppercase characters (A through Z)\n- English lowercase characters (a through z)\n- Base 10 digits (0 through 9)\n- Non-alphanumeric characters (e.g. !, $, #, %)\n\nDisabled: No complexity requirements are enforced.\n\nDefault value: Disabled"

;; USER CONFIGURATION - ALL VERSIONS SETTINGS

QuickInitialization="Control Quick Initialization"
QuickInitializationt_Explain="Enabled/Allow: Quick Initialization Wizard or Security Platform Initialization Wizard and User Initialization Wizard can be used to initialize platforms and users.\n\nEnabled/Enforce: Quick Initialization Wizard must be used to initialize platforms and/or users. Also available features (EFS, PSD) must be initially configured with Quick Initialization Wizard.\n\nDisabled: Quick Initialization Wizard cannot be used to initialize platforms and users. Security Platform Initialization Wizard and User Initialization Wizard must be used instead.\n\nDefault value: Enabled/Allow"

QuickInitialization_Enforce_Explain="Enforce"
QuickInitialization_Allow_Explain="Allow"

NonMigratableBUK="Creation of non-migratable Basic User Key"
NonMigratableBUK_Explain="Enabled/On demand: Users are prompted to create their non-migratable Basic User Key, when they are going to use Infineon TPM Strong Cryptographic Provider for the first time. Note that the Strong Cryptographic Provider requires a non-migratable Basic User Key.\n\nEnabled/Automatic: For new users, the non-migratable Basic User Key is automatically created during user initialization. For users who are already initialized, the non-migratable Basic User Key is created on demand.\n\nDisabled: No non-migratable Basic User Key is created, i.e. the Infineon TPM Strong Cryptographic Provider cannot be used.\n\nDefault value: Enabled/On demand"

NonMigratableBUK_OnDemand_Explain="On demand"
NonMigratableBUK_Automatic_Explain="Automatic"

TempDisable="Allow user to temporarily disable the Security Platform Features"
TempDisable_Explain="Enabled: The Infineon Security Platform User can switch off the active Security Platform Features until the computer is rebooted the next time.\n\nDisabled: The ability to temporarily disable the Infineon Security Platform is not available in the user interface of the Security Platform Solution Software.\n\nThis policy is only relevant for Security Platforms with an Infineon Trusted Platform Module 1.1.\nWhen the user logs off and a different user logs on, the deactivated Security Platform Features remain deactivated until the computer gets rebooted.\n\nDefault value: Enabled"

SecureMailAllow="Allow secure e-mail configuration"

EFSAllow="Allow EFS configuration"

PSDAllow="Allow PSD configuration"
AllowFeature_Explain="Enabled: The user is allowed to configure this Security Platform Feature.\n\nDisabled: The user cannot configure this feature, but a previous configuration can be used.\n\nDefault value: Enabled"
AllowScript_Explain="Allow Management Provider only"
AllowWizard_Explain="Allow Management Provider and Wizard"

EnforceEnablingOfPasswordReset="Enforce enabling of Password Reset"
EnforceEnablingOfPasswordReset_Explain="Enabled: Enabling Password Reset is mandatory in the User Initialization process.\nIf a Security Platform User has already been initialized without enabling Password Reset, there is no enforcement to enable Password Reset.\n\nDisabled: There is no enforcement to enable Password Reset. Password Reset can be enabled after User Initialization via Settings Tool - Password Reset - Enable.\n\nDefault value: Disabled"

EnhancedAuthenticationViaBasicUserPassphrase="Enforce Enhanced Authentication"
EnhancedAuthenticationViaBasicUserPassphrase_Explain="Enabled: Security Platform Users must use Enhanced Authentication (with Basic User Passphrase).\n\nDisabled: Security Platform Users can decide whether they want to use Enhanced Authentication (with Basic User Passphrase) or Password Authentication (with Basic User Password).\n\nDefault value: Disabled"

CacheUserKey="Enable caching of Basic User Password"
CacheUserKey_Explain="Enabled: The Basic User Password can be cached in the Infineon Security Platform Software, thus reducing the number of required inputs of the password during the current log-on session. This minimizes the number of password prompts for the user.\n\nDisabled: The Basic User Password dialog does not offer the ability to temporarily cache the Basic User Password.\n\nDefault value: Enabled"

;; Note: CertificateRequest="URL to start..." is set in section "STRINGS FOR MACHINE POLICIES"

EFSCertificateEnrollment="EFS certificate type and enrollment"
EFSCertificateEnrollment_Explain="Enabled: You can restrict the EFS certificate type. You can also enable the enrollment of external EFS certificates by specifying the Certification Authority's web address.\n1.EFS certificate type: Specify whether you want to allow all certificate types (domain, external and self-signed certificates) or only certain certificate types. This restriction will apply when users are going to enroll or select certificates.\n2.Certificate request URL: Enter a CA's certificate request web address to be used for EFS certificate enrollment, e.g. https://www.companyname.com/foldername.\nThis target path will be used when an EFS certificate is requested from an external Certification Authority (CA).\nThe certificate request URL is optional. If you do not specifiy a path here, users will not be able to request external EFS certificates. If you want to enable external EFS certificates, then enter a valid path which will be accessible to all Security Platform PC's. Otherwise the EFS certificate enrollment will fail.\n\nDisabled: The EFS certificate type is not restricted. The web adress to be used to retrieve EFS certificates is not set, i.e. users cannot request external EFS certificates.\n\nNotes:\nNote that EFS certificates are not only used for EFS, but also for PSD.\nWhile this setting is valid only for EFS certificates (to be used for EFS or PSD), there is also a user policy which is independent of the certificate usage (URL to start from wizard for certificate enrollment).\n\nDefault value: Disabled"
EFSCertificateEnrollmentTypes="EFS certificate type:"
EFSCertificateEnrollFromURL ="Certificate Request URL (only relevant for external certificates)"
EFSCertificate_AllowAllTypes_Explain="Allow all types"
EFSCertificate_AllowDomain_Explain="Allow only domain certificates"
EFSCertificate_AllowDomainAndExternal_Explain="Allow only domain and external certificates"

EFSCertificateExpirationWarningOccurrence="EFS certificate expiration warning occurrence"
EFSCertificateExpirationWarningOccurrence_Explain="Enabled: Security Platform Users will be notified by a balloon before their EFS certificate expires. Specify when this notification should take place, e.g. 14 days before certificate expiration.\n\nDisabled: There is no notification of certificate expiration.\n\nDefault value: Users are notified 14 days before certification expiration."
EFSCertificateExpirationWarningOccurrenceValue="Number of days: "
EFSCertificateExpirationWarningOccurrenceValue_Explain1="Please enter the number of days to remind me"
EFSCertificateExpirationWarningOccurrenceValue_Explain2="before the EFS certificate expires."

EFSSelfSignedCertificateValidityYears="EFS self-signed certificates validity period"
EFSSelfSignedCertificateValidityYears_Explain="Enabled: Specify the length of time that self-signed EFS certificates shall be valid.\n\nDisabled: The validity period is 10 years.\n\nDefault value: Enabled with a validity period of 10 years."
EFSSelfSignedCertificateValidityYearsValue="Number of years: "
EFSSelfSignedCertificateValidityYearsValue_Explain1="Please enter the validity period of self-signed EFS certificates."

PSDDefaultDrive="File location for Personal Secure Drive"
PSDExplain="Enabled/PSD Default Drive: This sets the drive in which the Personal Secure Drive image files will be created. Enter a valid drive letter in the edit field, including a colon but without any additional path (e.g. C:). If the drive letter is invalid, users will not be able to create a Personal Secure Drive image file.\n\nDisabled: The user can select the target drive in which the Personal Secure Drive image files will be created.\n\nDefault value: Disabled"

LimitationOfPSDDriveImageSize="Minimum free space after PSD creation"
LimitationOfPSDDriveImageSize_Explain="Enabled: If a PSD is saved on the system drive (where the current operating system is located), then a defined amount of free space has to be left after PSD configuration. Specify how much free space has to be left on the system drive after PSD configuration.\n\nDisabled: There is no restriction concerning the free space on the system partition after PSD creation.\n\nExample: The policy is enabled and set to 5000 MB. This means that you need at least 5010 MB free space on your system drive, because the minimum PSD drive size is 10 MB.\nAssuming the free space before PSD creation is 5050 MB, then the maximum PSD size would be 50 MB.\nAssuming the free space is 5000 MB, then you cannot create a PSD on the system drive.\n\nDefault value: The policy is enabled and set to 5000 MB."
LimitationOfPSDDriveImageSizeValue="Minimum free space (MB): "
LimitationOfPSDDriveImageSizeValue_Explain="Please enter the minimum free space after PSD creation."

AllowKeyImportForUser="Allow key import for User"
AllowKeyImportForUser_Explain="Enabled: Security Platform Users are allowed to import private keys into the Security Platform. Note that private keys are imported along with certificates via Certificate Viewer and Certificate Selection.\n\nDisabled: Security Platform Users are not allowed to import private keys into the Security Platform.\n\nDefault value: Enabled"

StrongSigningKey="Enforce strong private key protection for MS-CAPI signing keys"
StrongSigningKey_Explain="Enabled: All keys used exclusively for signing operations by the MS-CAPI interface are protected by strong private protection. In this case the key is protected by its own password that has to be entered whenever the key is being used for a signing operation.\nThis specific password can be cached to avoid repetitive input. Since this password is not related to the Basic User Key, the caching mechanism used for the Basic User Password does not affect this password.\n\nDisabled: Signing keys are not protected in a special form.\n\nDefault value: Disabled"

;; USER CONFIGURATION - STAND-ALONE COMPUTER VERSION SETTINGS

BackupWarningOccurrence="Backup warning occurrence"
BackupWarningOccurrence_Explain="Enabled: Security Platform Users will be notified by a balloon, if the backup of user-specific credentials and keys has failed (for example, because the backup location is not accessible). Specify how often this notification should take place, e.g. every 2 days after the backup failure, until the next successfull backup.\n\nDisabled: There is no notification of backup failure.\n\nDefault value: Users are notified daily."
BackupWarningOccurrenceValue="Number of days: "
BackupWarningOccurrenceValue_Explain1="Specify how often this notification should take place,"
BackupWarningOccurrenceValue_Explain2="e.g. every 2 days after the backup failure,"
BackupWarningOccurrenceValue_Explain3="until the next successfull backup."

UserEnrollment="Allow user enrollment"
UserEnrollment_Explain="Enabled/Allow Management Provider and Wizard: Users can be initialized via Management Provider interface, Quick Initialization Wizard or User Initialization Wizard .\n\nEnabled/Allow Management Provider only: Users can be initialized only via Management Provider interface.\n\nDisabled: Users cannot be initialized.\n\nDefault value: Enabled/Allow Management Provider Interface and Wizard."
