Server Settings

The Server settings dialog box can be found in the menu item Manage. It includes the following tabs: General, Connections, Logging, SIEM, Audit, Backups, Additional, Email, 2FA Settings, Active Directory, Entra ID, OpenID Connect, and Passkeys/WebAuthn. In general, you can use the server settings for server configuration and defining settings that will affect the entire server and all users. The content of the single tabs available in the server settings is explained in detail below.

General

Server

You can define basic server settings here:

  • Server language: Select the language of the server (not the language for Server Manager's user interface!). You can choose between English, German, French, Spanish, and Dutch.
  • Server name: Adjust the name of the server.
  • Clients Port/Server Manager Port: Adjust the port number for the client to server connection. In general, the default port number is always displayed here but you can change the value if required. When changing the port number, please make sure to also change it in the client and use the correct port for your server connection.
  • Internet Protocol: Specify a specific Internet protocol version that should be used by default. The following options are available: IPv4+IPv6, IPv4, or IPv6. Depending on the network configuration, administrators can define which Internet protocol versions the server should support. The server will then send via UDP an info message to the clients about the supported Internet protocol version. Afterwards, the clients will automatically choose the correct version for the main TCP connection.
  • Keepalive enabled: You can activate the Keepalive feature if clients connect to a server which is not part of the same local network. You can set the Keepalive time (in minutes; values can be set from 1 to 600) as well as the Keepalive interval (in seconds; values can be set from 1 to 600).
  • Max connections: Set the maximum number of simultaneous connections to the server. The default value is 1,024. Setting the value to 0 means unlimited; the maximum value that can be set is 4,096.

WARNING: In case you decide to change the default port, make sure that it is not used by any other application.

REST Server

  • Origin URL: Enter the correct URL of your Password Depot web server. It should be the exact URL which is used for addressing your Enterprise Server through the Password Depot web interface.
  • Port number: Adjust the port number for the REST server.

NOTE: The Origin URL option was removed with version 19.1.0.

Further information on the REST API

Databases

  • Storage folder: You can specify the path where server databases are stored by default. This is C:\Program Files\AceBIT\Password Depot Enterprise Server XX\Data\DB. You can change the path; however, we always recommend storing the databases on the local drive instead of using a network share or mapped drive since the latter may not be accessible at all times. If during the process of saving the database, Password Depot Enterprise Server cannot find or access the path specified in the server settings, it will switch back to the default settings and save the databases to the default folder.

Connections

Supported authentications

Select the supported authentications for your server. You can choose between the following options: Standard Authentication, Integrated Windows Authentication (Single Sign On), Windows Domain Credentials (FQUN or UPN and password), Entra ID (formerly Azure AD), OpenID Connect, or Passkeys (WebAuthn). The server supports activating more than one authentication mode at the same time.

HINT: For more information on the Integrated Windows Authentication as well as the required settings, please check the following support portal article: How do I log on to the Enterprise Server using the Integrated Windows Authentication (SSO)?

Supported clients

Check all the clients that should support the Enterprise Server connection. The following options are available here:

  • Standard Edition for Windows
  • Corporate Edition for Windows
  • Android Edition
  • iOS Edition
  • macOS Edition
  • Linux Edition
  • Web Client

NOTE: All clients that are intended to be used for Enterprise Server connection need to be activated in the Server Manager. If a client is deactivated here, users will not be able to use the disabled edition to connect to the Enterprise Server.

New connection from different device

You can decide how you would like to proceed with connections carried out by the same user but from other devices. You can choose between the following:

  • Deny new connections when user is already logged on
  • Close existing connection and allow new one
  • Allow multiple connections from different IP addresses

NOTE: As is the case with many other similar servers, it is not recommended with the Enterprise Server either to allow multiple connections carried out by the same user at the same time. This feature was implemented since it may happen that users need to connect with their desktop client and a mobile device simultaneously. This works because mobile devices are not synchronized with the server in real time. However, if a user tries to establish a server connection using their account on two different Windows clients at the same time, this may cause problems. It may happen that the user will be disconnected from one device.

Inactive sessions

Specify how Password Depot Enterprise Server should handle inactive connections. For example, you can define that clients should be disconnected from the server after a specific time of inactivity. In addition to that, if you activate this option, you can also specify that the database should be closed and users should be logged out.

Logging

In this tab you can define anything referring to the logs of Password Depot Enterprise Server. The following options are available here:

Local log

  • Logs folder: You can see here the default directory for storing the Enterprise Server's logs which is C:\Program Files\AceBIT\Password Depot Enterprise Server XX\Logs. You can change the location using the Browse button. In any case, we recommend always using a local directory, if possible.
  • Max. file size (KB): Determine the maximum size (KB) of the server's log file.
  • Create new log file: Select a time when to create a new log file.
  • Delete logs: Define the settings for deleting already existing logs. You can either select Never or determine a maximum number of log files to be kept, for example 30 (this is the default value). This means that the latest 30 files will be saved and older log files will be deleted automatically.

Remote log

  • Send log messages to a remote server: Check this box if you wish to activate the option and send the Enterprise Server's log files to external log servers. Thus, you can ensure that protocols are not being manipulated. Here, you can also define the protocol type, the server, and the log format.

NOTE: With the introduction of version 19.2.0, the former Remote log option, which sent the server log to an external server via syslog, has been moved to the new SIEM tab and expanded there (encrypted transmission via TCP/TLS, buffered forwarding, and forwarding of audit events). Forwarding is therefore no longer configured here, but on the SIEM tab.

The SIEM and Audit tabs together form the foundation for audit-proof logging in enterprise environments. Password Depot Enterprise Server maintains a tamper-evident, cryptographically chained event log internally (the audit chain) – in the Audit tab, you define how this chain is verified, compressed, and exported. In the SIEM tab, you define whether and how server events are forwarded in real time to external security systems. The two tabs complement each other: the audit chain provides local proof of integrity, while the SIEM integration provides an external, independent data stream – for compliance requirements such as ISO 27001, NIS2, or GDPR.

SIEM

In this tab you can define whether and how Password Depot Enterprise Server forwards its events in real time to an external SIEM system (Security Information and Event Management, e.g. Splunk, rsyslog, or syslog-ng). This keeps a continuous copy of the security-relevant events off the server, where it can be analyzed centrally and correlated with other systems.

Forwarded events

  • Audit events: Enable this option to forward the tamper-evident audit stream (each security-relevant event individually). This is the recommended setting with regard to compliance frameworks such as ISO 27001 A.8.15 and NIS2.
  • Server log events: Enable this option to additionally forward the operational server log. This option is only intended for SIEM correlation of operational events and is considered deprecated.

Destination

  • Server: Enter the address and port of the destination server (your SIEM) to which the events are to be sent.
  • Protocol: Select the transport protocol: UDP (RFC 5426), TCP (RFC 6587), or TLS (RFC 5425).
  • Internet protocol: Define which Internet protocol version is to be used: IPv4 or IPv6.
  • TCP/TLS message framing: This option is only available when TCP or TLS is selected as the protocol. Select how individual messages are separated from one another: Newline-terminated (Kiwi, Splunk, rsyslog, syslog-ng) or Octet-counting (RFC 6587 §3.4.1, strict).

TLS settings

These settings are only visible when TLS is selected as the protocol:

  • CA certificate file: If required, enter the certificate file of the certificate authority here. If the field is left empty, the operating system's root store is used.
  • Client certificate file: Optional for Mutual TLS – enter the client certificate here.
  • Client private key file: Optional for Mutual TLS – enter the corresponding private key here.
  • Min./Max. TLS version: Define the lowest and highest permitted TLS version. Each can be set to TLS 1.2 or TLS 1.3.
  • Verify the server's host name: Enable this option so that the host name of the destination server stored in the certificate is verified.

Reliability

These settings ensure that a slow or temporarily unreachable SIEM does not slow down the server:

  • Queue depth (before dropping buffered lines): Define how many events are buffered before the oldest ones are dropped. This prevents events from being lost immediately in the event of a brief interruption. Values range from 64 to 1,048,576.
  • Connection timeout (ms): Determine after what time a connection attempt to the SIEM is aborted. Values range from 500 to 120,000 ms. Not available when UDP is selected as the protocol.
  • Reconnect delay (ms): min / max: Define the minimum and maximum waiting time before a renewed connection attempt. After repeated failed attempts, the server gradually increases the waiting time up to the set maximum value. Values range from 100 to 600,000 ms. Not available when UDP is selected as the protocol.

RFC 5424 message format

  • Emit UTF-8 BOM in MSG: Enable this option so that the server prepends a UTF-8 BOM (Byte Order Mark, U+FEFF) to each RFC 5424 MSG field (RFC 5424 §6.4). Some receivers require this byte to unambiguously identify the character encoding.

Audit

Password Depot Enterprise Server maintains a tamper-evident audit log (the so-called audit chain), in which every security-relevant event is cryptographically linked to the previous one. As a result, nothing can be changed, deleted, or inserted afterwards without being noticed. In this tab you can define how this audit chain is verified, compressed, and exported.

Self-verification (Tier-A/B chain check)

  • Run pd_audit_verify.exe regularly and write PASS/FAIL into the chain: Enable this option so that the server automatically runs the verification tool pd_audit_verify.exe against its own audit chain at regular intervals and writes the result (PASS or FAIL) back into the chain as its own event. This way, damage or tampering is detected within the verification interval, and a continuous record of the verified integrity is created.
    • Verification interval (hours): Define the interval at which the verification is to be performed (168 hours by default, i.e. weekly). Values range from 1 to 8,760 hours.
    • Delay before first verification (minutes): Determine how many minutes after the server starts the system should wait before the first verification is performed (5 minutes by default). Values range from 1 to 10,080 minutes.
    • Verification timeout (minutes): Define after what time a stalled verification is aborted and reported (10 minutes by default). Values range from 1 to 1,440 minutes.

NOTE: Self-verification confirms that nothing was changed in the audit chain afterwards. However, it cannot detect whether an event was never written in the first place. Forwarding the events on the SIEM tab serves as the complementary measure for this.

Cold-tier compression

  • Compress audit-YYYY-MM.jsonl into .jsonl.gz once the threshold is exceeded: Enable this option so that older, already closed (sealed) monthly files of the audit chain are compressed with gzip. The active chain that is currently being written to remains untouched.
    • Compress after age (days): Define the age at which a closed file is compressed (90 days by default). Values range from 1 to 36,500 days.
    • Check interval (hours): Determine the interval at which the system checks whether files are due for compression (168 hours by default, i.e. weekly). Values range from 1 to 8,760 hours.
    • Delay at startup (minutes): Define how many minutes after the server starts the system should wait before the first compression check is performed (60 minutes by default). Values range from 1 to 10,080 minutes.

Export (TCP and REST endpoints)

  • Maximum records per export request: Define the maximum number of audit records that a single export request may return (100,000 by default). This limit protects the server against excessively large individual requests. Values range from 100 to 10,000,000.

Backups

In this tab you can specify the settings of your backup files in general. The following options are available:

Backup databases and settings

  • Backup folder: You can specify where backup copies of your server database should be saved to. By default, they are stored to the directory C:\Program Files\AceBIT\Password Depot Enterprise Server XX\Backups\. Use the browse button to change it. However, as is the case with the server's log files too, we also recommend always using a local directory for storing the backup files, if possible. The server backup files include your databases, logs, and the server's configuration file (pwd_srv.cfg) where the users, permissions, and server configurations are saved.
  • On every startup: Select this option in order to create a new backup copy on every startup.
  • Create Backup every: Set a time for Password Depot Enterprise Server to automatically create a new backup file. We recommend creating new backup files every 24 hours. You also have the option to choose between the following options: monthly, weekly, daily, hourly (this option allows you to specify an interval within a certain time frame).

Delete old backups

  • Limit number of stored backups to: This option allows you to set the maximum number of backups (values 1 to 2,000).
  • Delete backup files older than: Activate this option if you would like to automatically delete backup files older than x months from the server's backup directory. You can determine a specific period of time for this deletion to take place (1 to 72 months).

NOTE: By default, the options Backup databases on every startup and Backup databases every x hours are checked and we strongly recommend to keep both options activated at all times.

Backup log

  • Log backup events to file: If you activate this option, Password Depot Enterprise Server will create a log of all generated backups and save it to the specified file. At a later point of time, this will help you to track the times server backups were created.

Additional

The Additional tab contains more options including the following:

Editing entries

  • Lock entry timeout (min.): You can determine a specific lock entry timeout (min.). By default this is five minutes; however, you can increase or decrease the lock entry timeout, if required. If a user has opened an entry but is not working with it, this specific entry will then be locked automatically if the timeout set up in the Server Manager has expired. The maximum value that can be set is 30 minutes.

Private databases

  • Automatically create group databases for new groups: Allows you to automatically create a database if a new group is added. Only members of the group can access the respective database. Further, you can set a Default DB name prefix for these group databases.
  • Automatically create private databases for new users: You can determine whether a private database should be created automatically for every new user on the Enterprise Server. Those private databases will then also be stored to the server and users can add their own private entries there which are not supposed to be part of the company's server database. Moreover, you can determine the Default DB name prefix.
  • Automatically delete private databases for deleted users: You can further determine whether private databases should be deleted automatically from the server once the user is removed from the Enterprise Server. If this option is enabled and a user is deleted in the Server Manager, their private database will be deleted from the server.

NOTE: By default, all three options are deactivated.

Protection against brute force attacks

  • Deactivate user account after multiple failed logins in a row: Determine a maximum number of failed login attempts a user can carry out before his server account will be blocked temporarily. 
  • Block IP address after multiple failed logins within a short period of time
    • Login attempts: Specify after how many failed login attempts an IP address is automatically blocked.
    • Within (minutes): Specify the time period within which the number of failed attempts defined above must occur for the lockout to take effect.
    • Unblock after (minutes): Determine how long the affected IP address should remain blocked after being blocked before it is automatically released again.

If a user account was blocked, it can be re-activated again by the server administrator. To do so, open the Server Manager and go to Users → <USERNAME> → Accounts and uncheck the box Account deactivated.

NOTE: A user's failed login attempts will not be reset after some hours or days but the Password Depot Enterprise Server Manager will remember the number of failed login attempts and add them up. However, if a user enters the correct password after two failed login attempts (provided the maximum number of failed login attempts is set to 3 in the Server Manager), the previous failed attempts will be reset to 0. The next time the user wants to login on the Enterprise Server, he will have another 3 new login attempts until his account will be blocked.

Email

In this tab you can define email server settings.

Sender

  • Email Address: Enter the email address to be used as the sender address.
  • Sender Name: Enter the full name of the sender as it should appear to recipients.

Outgoing Mail Server

  • Address: Enter the address of your SMTP outgoing mail server (e.g. smtp.myserver.com).
  • Port: Set the port for the connection to the outgoing mail server. The default port is 25.
  • Authentication required: Enable this option if your outgoing mail server requires authentication. The following fields are then available:
    • Account: Enter the user name for authentication with the outgoing mail server.
    • Password: Enter the corresponding password.
  • Server requires encrypted connection (SSL): Enable this option if your outgoing mail server requires an encrypted connection. The following settings are then available:
    • TLS Level: Select the desired TLS level. The following options are available: No TLS Support, Implicit TLS, Required TLS, and Explicit TLS.
    • Protocol: Select the protocol version to be used. The following options are available: SSL 2.3, SSL 3, TLS 1, TLS 1.1, TLS 1.2, and TLS 1.3.

Test Connection

  • Recipient: Enter an email address to which a test message should be sent.

Click Send test e-mail to verify the settings you have configured.

2FA Settings

In this tab, you can Enable Two-Factor Authentication on the server for the users.

Operation mode

  • Trust period for user devices (hours): Specify a certain period of time during which users can trust connections to a specific device (values can be set from 0 to 2,400 hours). In this case, regarding Two-Factor Authentication, it will not be necessary for users to always enter a new code each time they want to connect to the same device (=server) in x days provided that users enable the option Trust this computer when connecting for the first time and entering the required code once.
  • TOTP – codes are generated by mobile Authenticator apps: Users will receive the second factor for the login on their smartphone in their authenticator app.
  • Email – codes are sent by Server to user's default address: Users will receive the second factor by separate email to their individual email address.
  • Email code expiration time (minutes): This option determines the validity of a code sent by email for Two-Factor Authentication (values can bet set from 1 to 60 minutes). If a user does not enter the required code in time, it expires. For authentication, a new code will then be required.
  • FIDO2/WebAuthn security keys: Since version 18, the Password Depot Enterprise Server supports FIDO2/WebAuthn, allowing users to use YubiKeys as well as other security devices as a two-factor authentication method (2FA) when connecting to a Password Depot Enterprise Server via the Password Depot Client. For more information on setting up FIDO2, please refer to our instructions.

NOTE: A trust period can be specified for the operation modes TOTP and Email.

HINT: Please visit our knowledge base to get more information on the Two-Factor Authentication.

NOTE: Both the Integrated Windows Authentication and Password Depot credentials authentication support Two-Factor Authentication. Go to Users → <USERNAME> → Account if you want to deactivate the Two-Factor Authentication for single users, if required. Besides, you can also reset 2FA for single users in the user area if problems occur. Read more about this feature in the chapter Users.

Active Directory

SSPI

In this field, you have the option of selecting the desired authentication service (SSPI).

  • SSPI Mode: Select the desired authentication service (NTLM, Negotiate, or Kerberos).
  • Service Principal Name (SPN): Select the correct Service Principal Name.

Synchronization

  • Protocol: Choose between LDAP:// and GC://.
  • Automatically run synchronization with AD every: Specify whether to perform AD synchronization automatically. If so, you can also determine the time interval automatic AD synchronization should be carried out. Furthermore, you can also specify what to do with users and groups not (or no longer) found in AD. Those users can be ignored, disabled, or deleted in the Server Manager. Please note that this option does only affect the users on the Enterprise Server but not in the Active Directory in general since Password Depot Enterprise Server cannot change anything in Active Directory.

NOTE: The administrator should perform AD synchronization manually, if required. However, if automatic synchronization is necessary, synchronization cycles should preferably be at times when the server load is low, for example once in 24 hours.

NOTE: The server option Automatically run synchronization with AD every is limited to 60 minutes and uses the server's own SYSTEM account.

NOTE: Find out more about Active Directory synchronization in the Server Manager in the chapter Import from Active Directory which can be found under Tools.

Entra ID

Tenants

Here, you can add a new organization to Password Depot Enterprise Server and the Server Manager. Once a new organization has been added you can use it to perform Entra ID synchronization.

  • New...: Click New... to launch the process. You will be asked to select a Microsoft account next and login with the administrator's access data. After the login you can see the organization in the Tenants area which means that it has been added to the Server Manager successfully. Now, select Tools → Import from Entra ID in the Server Manager to automatically synchronize Entra ID users with the Enterprise Server. You can select the desired organization to perform Entra ID synchronization from the corresponding synchronization wizard.

HINT: You can launch the same process by going to Tools → Import from Entra ID. The button New for adding a new organization to the Server Manager is also available here.

  • Update...: Update an organization that has already been added to the Server Manager and the related data.
  • Delete: Delete organizations from the Server Manager if you do not need them anymore, for example. You can then add new or other organizations for Entra ID synchronization to the Server Manager by clicking the button New....

NOTE: Find out more about Entra ID synchronization in the Server Manager in the chapter Import from Entra ID which can be found under Tools.

Synchronization

  • Automatically run synchronization with AD every: As is the case with the Active Directory synchronization, you can determine if Entra ID synchronization should be performed automatically every x minutes. Entra ID users and their attributes will then be synchronized and updated automatically according to the specified time interval. The option User and groups not found in AD does work in the same way it does during Active Directory synchronization. The only difference is that it actually refers to Entra ID and not the Active Directory.

OpenID Connect

Identity Providers

Here, you can add, update, and delete identity providers.

  • New...: Click New... to create a new OIDC entry.
  • Update...: Click Update... to refresh an existing OIDC entry.
  • Delete: Choose Delete to remove an existing OIDC entry.

Add a new organization to Password Depot Enterprise Server and the Server Manager with the help of the OIDC import. By clicking onto New... you are able to add a new OIDC Service to import your OIDC users into the Enterprise Server.

HINT: You can launch the same process by going to Tools → Import from OIDC.

NOTE: Find out more about OIDC synchronization in the Server Manager in the chapter Import from OpenID Connect which can be found under Tools.

Passkeys/WebAuthn

In this tab, you can adjust the settings for authentication via Passkeys/WebAuthn. Besides USB security keys, you can also use Windows Hello, smartphones, and other devices.

Relying Party

  • Relying party ID: Enter the ID of the relying party.
  • Display name: Choose a display name.

Registration Settings

  • Attachment: Choose between Any supported, Platform (internal authenticators), and Cross-Platform (roaming authenticators).
  • Timeout (seconds): Set a timeout value. The maximum value is 300 seconds.

Authentication Settings

  • User verification: Here you can decide whether user verification should be required. You can choose between Any supported, Required, Preferred, and Discouraged.
  • Timeout (seconds): Set a timeout value. The maximum value is 300 seconds.

NOTE: When using the WebAuthn/Passkeys login method, ensure that the Relying Party ID (configured under Manage → Server Settings → Passkeys/WebAuthn → Relying Party ID) matches the Server Name on file (configured under Manage → Server Settings → General → Server Name). This is particularly important for a functioning connection in offline mode or for accessing backup files.