Disabled: The minimum password length is 6 characters.

Disabled: No password complexity requirements are enforced.

Enabled:

• Maximum Basic User Password age: Enter the desired maximum Basic User Password age, e.g. 42 days.
• Basic User Password expiration warning: Specify how many days before Basic User Password expiration users shall be notified, e.g. 7 days.

Disabled: There is no maximum Basic User Password age, i.e. passwords do not expire.

Disabled: The minimum passphrase length is 20 characters.

This policy is only relevant if Enhanced Authentication is used.

Disabled: No complexity requirements are enforced.

This policy is only relevant if Enhanced Authentication is used.

Enabled/Enforce: Quick Initialization Wizard must be used to initialize platforms and/or users. Also available features (EFS, PSD) must be initially configured with Quick Initialization Wizard.

Disabled: Quick Initialization Wizard cannot be used to initialize platforms and users. Security Platform Initialization Wizard and User Initialization Wizard must be used instead.

Disabled: The ability to temporarily disable the Infineon Security Platform is not available in the user interface of the Security Platform Solution Software.

This policy is only relevant for Security Platforms with an Infineon Trusted Platform Module 1.1.
When the user logs off and a different user logs on, the deactivated Security Platform Features remain deactivated until the computer gets rebooted.

Disabled: The user cannot configure this feature, but a previous configuration can be used.

Disabled: The user cannot configure this feature, but a previous configuration can be used.

EFS is not supported by Windows Home editions.

Disabled: The user cannot configure this feature, but a previous configuration can be used.

Disabled: There is no enforcement to enable Password Reset. Password Reset can be enabled after User Initialization via Settings Tool - Password Reset - Enable.... 

Disabled: Security Platform Users can decide whether they want to use Enhanced Authentication (with Basic User Passphrase) or Password Authentication (with Basic User Password).

This policy is only relevant, if at least one Authentication Device has been enabled for all users. If a Security Platform User has already been initialized without selecting an authentication device, there is no enforcement to use Enhanced Authentication.

Disabled: The Basic User Password dialog does not offer the ability to temporarily cache the Basic User Password.

Disabled: The page to get a certificate is not available in the Infineon Security Platform User Initialization Wizard.

Notes:

• This setting is also supported as system policy to be compatible with earlier versions of the Security Platform Solution Software.
• Recommendation: Use this setting as a user policy.
• While this setting is independent of the certificate usage, there is also a special user policy for EFS certificates (EFS certificate type and enrollment).

1. EFS certificate type: Specify whether you want to allow all certificate types (domain, external and self-signed certificates) or only certain certificate types. This restriction will apply when users are going to enroll or select certificates.

• Domain certificate: A certificate enrolled via a Certification Authority within your domain.
• External certificate: A certificate enrolled via an external Certificate Authority accessible by the WWW.
• Self-Signed certificate: A certificate created on your own PC.

2.  Certificate request URL: Enter a CA's certificate request web address to be used for EFS certificate enrollment, e.g. https://www.companyname.com/foldername.
This target path will be used when an EFS certificate is requested from an external Certification Authority (CA).

• The certificate request URL is optional.
• If you do not specify a path here, users will not be able to request external EFS certificates.
• If you want to enable external EFS certificates, then enter a valid path which will be accessible to all Security Platform PC's. Otherwise the EFS certificate enrollment will fail.

Disabled: The EFS certificate type is not restricted. The web address to be used to retrieve EFS certificates is not set, i.e. users cannot request external EFS certificates.

Notes:

• Note that EFS certificates are not only used for EFS, but also for PSD.
• While this setting is valid only for EFS certificates (to be used for EFS or PSD), there is also a user policy which is independent of the certificate usage (URL to start from wizard for certificate enrollment).

How to enroll and select an EFS certificate

Disabled: There is no notification of certificate expiration.

Disabled: The validity period is 10 years.

Disabled: The user can select the target drive in which the Personal Secure Drive image files will be created.

Disabled: There is no restriction concerning the free space on the system partition after PSD creation.

Example:
The policy is enabled and set to 5000 MB.
The minimum PSD drive size is 20 MB for Windows 7 and Windows Vista and 10 MB for all other Operating Systems.

• Assuming the free space before PSD creation is 5050 MB, then the maximum PSD size would be 50 MB.
• Assuming the free space is 5000 MB, then you cannot create a PSD on the system drive.

Disabled: Security Platform Users are not allowed to import private keys into the Security Platform.

Enabled: All keys used exclusively for signing operations by the MS-CAPI interface are protected by strong private protection. In this case the key is protected by its own password that has to be entered whenever the key is being used for a signing operation.

Disabled: Signing keys are not protected in a special form.

Enabled/On demand: Users are prompted to create their non-migratable Basic User Key, when they are going to use Infineon TPM Strong Cryptographic Provider for the first time. Note that the Strong Cryptographic Provider requires a non-migratable Basic User Key.

Enabled/Automatic: For new users, the non-migratable Basic User Key is automatically created during user initialization. For users who are already initialized, the non-migratable Basic User Key is created on demand.

Disabled: No non-migratable Basic User Key is created, i.e. the Infineon TPM Strong Cryptographic Provider cannot be used.

Disabled: There is no notification of backup failure.

Enabled/Allow Management Provider only: Users can be initialized only via Management Provider interface.

Disabled: Users cannot be initialized.