#***********************************************************************************
# Enzoic for Active Directory Configuration Settings Import File.
# DO NOT remove anything from this file. If a value or section is not used, 
# leave the default values.
#***********************************************************************************

# Settings which are specific to the computer.
local:
  proxy:
    #Leave serverHost blank if no proxy server.
    serverHost:
    serverPort: 8080
    username:
    password:
    
# Settings which are stored in Active Directory, and shared by all domain controllers with Enzoic for Active Directory.
shared:
  general:
    # Valid timeout range is 1000-20000, inclusive.
    timeout: 20000
    
    # Set to true if you intend to follow NIST standards with your configuration. Enzoic for Active Directory will indicate any setting which is out of compliance.
    enforceNistCompliance: false
    
    # List of email addresses of administrators who should be notified of compromised account detection, system problems, and scheduled reports.
    administrativeNotificationEmailAddresses: []

    # The Delegate Server is the designated domain controller which will scan your organization's Active Directory for compromised passwords.
    # This scan is performed once per user per day and is spaced out over the course of the day.
    # While this is typically low performance impact, you may wish to designate a server which is typically under lighter load to be the Delegate.    
    # This is the fully qualified DNS name of the server which will be the Delegate server.
    delegateServerDnsName: delegate-server-name.domain.local
    
  administration:
    periodicSummaryEmail:
      # Set to true to receive an email digest of monitoring metrics on the desired schedule.
      enabled: false
      
      # Frequency to send the report. Daily, Weekly, or Monthly.
      schedule: Monthly       
      
  passwordPolicy:
    # Enzoic's database contains two types of passwords: those that have been exposed in data breaches
    # and those that have been recovered in the dictionaries that hackers use to crack passwords.
    # By enabling this option, you are expanding the list of passwords we will check against
    # to include the latter. This setting is recommended as it will catch weak passwords
    # which may not necessarily have been exposed in a breach yet.
    exposedPasswordsOnly: false
    
    # When enabled, Enzoic will screen password changes for any user in the Monitored Entities list for policy compliance.
    # If disabled, Enzoic will perform Continuous Password Protection only for Monitored Entities.
    # Disabling this is generally not recommended except in very specific use cases.
    enforceOnPasswordChange: true
    
    # By default, Enzoic will screen password change operations for any user in the Monitored Entities list.
    # When this setting is enabled, direct password resets by administrative users
    # (via the AD Users and Computers app for instance) will also be screened. This setting is recommended.
    enforceOnPasswordReset: true
    
    # Fuzzy password matching will ignore case and perform common leet speak substitutions as part of
    # the password screening process. For example, if Enzoic's DB contained the password "georgie",
    # but not the password "g30RGi3", this password would still be matched if fuzzy matching is enabled.
    # This setting is recommended.
    fuzzyPasswordMatching: true
    
    # Users will often add numbers and/or symbols to the beginning or end of their password in an attempt
    # to reuse the same root password.  For example, a user might change their password from "Password123!"
    # to "Password124!".  In cases where the original password was compromised for that user, it can be
    # trivial for hackers to ascertain and guess the pattern being used.  Enable this option to screen for
    # such root passwords by first dropping any leading or trailing numbers or symbols.
    rootPasswordDetection: false
    
    userAttributeBlockingPolicy:
      # Block passwords that contain the user's first name or last name.
      blockUserDisplayName: false
      
      # Block passwords which contain the user's sAMAccountName.
      blockUserName: false
      
      # Block passwords which contain the user's email address.
      blockUserEmail: false
      
    passwordSimilarityBlockingPolicy:
      # Password Similarity Blocking blocks users from choosing a new password which is too similar to their current one.
      # You can define the minimum number of differences required between the new and current password using the Minimum Required Distance setting.
      # This distance is defined as the number of character additions, substitutions or deletions required to make the two passwords identical.
      # For example, if the original password was "Flatirons2018!" and the new password was "Flatirons!2019$", the distance would be 3.
      # Continuous Password Protection must be enabled to use Password Similarity Blocking.
      enabled: false
      
      # minimumRequiredDistance is the minimum number of differences between the current and new passwords which is acceptable.
      # A difference is calculated using the Damerau–Levenshtein algorithm, and includes any character
      # added, deleted, replaced or transposed with an adjacent character. For instance, the two passwords
      # 'password' and 'apswoort' have 4 differences, one for transposing 'pa' at the beginning, one for
      # dropping the 's', one for adding the 'o' and one for replacing 'd' with 't'.
      # Case changes are only considered differences if the Normalize Password First option is disabled.
      # Valid values are 1-8
      minimumRequiredDistance: 5
      
      # When normalizePasswordFirst is enabled, passwords will be normalized prior to checking similarity.  Normalization involves
      # lower casing the password and then performing common leet speak substitutions
      # (o for 0, l for 1, e for 3, a for 4, etc.). As an example, without normalization,
      # the two passwords 'georgie' and 'G30rg13' would have 5 differences.
      # After normalization, the passwords would be considered identical.
      normalizePasswordFirst: true
      
    repeatingCharacterBlockingPolicy:
      # When enabled, users will not be able to choose a password containing a character which repeats consecutively more than the selected number of times.
      enabled: false
      
      # The maximum number of consecutively repeating characters that is allowed before blocking the password.
      maxRepeatCharacters: 3
      
  monitoredUsers:   
    # List of sAMAccountName or userPrincipalName values for specific users.
    users: []
    
    # List of cn (common name) values for specific groups.
    groups: ['Domain Users']
    
    # List of cn (common name) values for specific organizational units.
    containersOUs: []
    
  passwordMonitoring:
    # Set to true to enable Continuous Password Protection (CPP).
    monitoringEnabled: false
    
    # Action to take when a password is found to be compromised.
    # Valid values are ForcePasswordChangeOnLogin, DisableAccount, NotifyOnly
    remediationAction: ForcePasswordChangeOnLogin
    
    # Delay period in hours before taking the configured action.
    # Valid values are 0-72 (positive integers only)
    remediationDelay: 0
    
    # Whether or not the compromised account's principal should be notified.
    notifyAccountUser: false
    
  credentialMonitoring:
    # Set to true to enable full credential checks during password changes and CPP (Continuous Password Protection) cycles.
    monitoringEnabled: false
           
    # Action to take when a password is found to be compromised.
    # Valid values are ForcePasswordChangeOnLogin, DisableAccount, NotifyOnly
    remediationAction: ForcePasswordChangeOnLogin
    
    # Delay period in hours before taking the configured action.
    # Valid values are 0-72 (positive integers only)
    remediationDelay: 0
    
    # Whether or not the compromised account's principal should be notified.
    notifyAccountUser: false
    
  customPasswordDictionary:
    # Set to true to reject any passwords which contain any of the values in the directoryEntries list.
    enabled: false
    
    # List of keywords to reject. This should include things like your company name, and names of local sports teams.
    # Limit of 5000 entries.
    dictionaryEntries: []

# Settings which are stored in the Enzoic Cloud, and shared by all domain controllers with Enzoic for Active Directory.  
cloud:
  passwordAlertEmailCustomization:
    # Set to true to customize notification emails sent to end users to make it clear your company is responsible for the message.
    useCustomSettings: false
    
    # Your company name
    companyName:
    
    # This should be the filename only (no path) of a PNG or JPEG image file, in the same directory as this configuration file.
    logoFilename:
    
    # Introductory text explaining why the user is receiving the notification.
    introText:
    
    # Whatever content you choose. This could be a confidentiality statement.
    footerText:
    
  credentialAlertEmailCustomization:
    # Set to true to customize notification emails sent to end users to make it clear your company is responsible for the message.
    useCustomSettings: false
    
    # Your company name
    companyName:
    
    # This should be the filename only (no path) of a PNG or JPEG image file, in the same directory as this configuration file.
    logoFilename:
    
    # Introductory text explaining why the user is receiving the notification.
    introText:
    
    # Whatever content you choose. This could be a confidentiality statement.
    footerText:
