#Ama microsoft word add in 2013 how to#
#Ama microsoft word add in 2013 pro#
#Ama microsoft word add in 2013 windows#

The user tries to access network resources that require the smart card universal security group. The user logs on by using a user name and password: The user can't access local security sensitive resources. If the previous logon was performed by using a password, the access token for the desktop does not have the smart card universal security group that's provided by AMA. The user logs on by using user name and password: The user can still access local security sensitive resources.

The user logs on by using the smart card: The user can still access local security sensitive resources. If the previous logon was performed by using a smart card, the access token for the desktop has the smart card universal security group that's provided by AMA. Note In this article, group membership is retrieved for interactive logon sessions by using “whoami/groups.” This command retrieves the groups and claims from the desktop’s access token. Therefore, the security groups and claims from the previous logon are used instead of the current one. However, because the workstation allows optimized/cached logon, the cached verifier is used during logon to create the NT access token for the user’s desktop. In this scenario, you expect that only user who signs on by using smart cards can access local and network resources. Local and network resource access requires the smart card universal security group. Therefore, users can log on by using other credentials, such as user name and password. The 'Interactive logon: Require smart card' policy isn't enabled on workstations. Note In this article, we refer to this new mapped group as “the smart card universal security group.'

#Ama microsoft word add in 2013 windows#

To do this, the administrator deploys AMA according to the Authentication Mechanism Assurance for AD DS in Windows Server 2008 R2 Step-by-Step Guide for the issuance policy object identifier that's used in all the smart card certificates. Symptoms Problem Scenario 1 (logon/logoff)Īn administrator wants to enforce Smart Card (SC) Logon authentication when users access certain security-sensitive resources. This is because resources that are accessed after an interactive user logon can’t be reliably protected by using AMA. The behavior of AMA in these scenarios is 'by design' and can be summarized as follows:ĪMA is intended to protect network resources.ĪMA can neither identify nor enforce the interactive logon type (smart card or user name/password) for the user's local computer. This article focuses on two problem scenarios: logon/logoff and lock/unlock. This access is based on whether the user logs on by using a certificate-based logon method and the type of certificate that's used to log on. This makes it possible for network resource administrators to control the access to resources, such as files, folders, and printers. IntroductionĪMA adds an administrator-designated, universal group membership to a user's access token when the user's credentials are authenticated during logon by using a certificate-based logon method.

#Ama microsoft word add in 2013 how to#

This article discusses how to use Authentication Mechanism Assurance (AMA) in interactive logon scenarios.

#Ama microsoft word add in 2013 pro#

Windows Server 2012 R2 Standard Windows Server 2012 R2 Datacenter Windows 8.1 Pro Windows 8.1 Enterprise Windows Server 2012 Standard Windows Server 2012 Standard Windows Server 2012 Datacenter Windows Server 2012 Datacenter Windows 8 Pro Windows 8 Enterprise Windows Server 2008 R2 Standard Windows Server 2008 R2 Enterprise Windows 7 Enterprise Windows 7 Professional More.