Issue After commissioning HID Signo OSDP readers in Security Expert, they do not log card events. Readers cannot be brought online in Security Expert. Product Line EcoStruxure Security Expert Environment Security Expert HID Signo Smart Card readers HID Reader Manager App Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Cause Both sides of the commissioning process require proper installation steps: HID Signo reader configuration using the HID Reader Manager App Security Expert configuration Resolution Confirm Cards Work with Reader Before starting OSDP commissioning: Set the HID Signo reader to Wiegand mode. Connect it to the Security Expert SP-C Reader Expander port. Configure the Reader Expander and Door records for the correct format and credential. Badge a card at the reader and check events in Security Expert to confirm the reader is reading the correct format. Once confirmed, proceed to Commissioning HID Signo OSDP readers.   Commissioning HID Signo OSDP readers involves two main steps: Reader configuration in the HID Reader Manager App Security Expert configuration Step 1: Configure Reader in HID App for OSDP Install Mode Open the HID Reader Manager App. Navigate to: Inspection Report → Detailed Configuration → Communication Protocol Inspect Reader Enable Install Mode:  Scroll down and select Add to Template. Select Apply Selected Items. Enable OSDP Wait for the reader update to complete, then exit the menus. Writing changes Step 2: Configure Reader Expander in Security Expert In Security Expert, go to: Reader Expander → General tab Set Port Network Type to OSDP.  Saving changes creates two new Smart Reader records. Configure the Smart Reader:  Set the Address correctly (1 + the address value set in the HID Reader App). Under the Reader tab, set:  Reader One Format to the correct format. Reader One Door to the correct Door record. Activate OSDP Install Mode:  Right-click the Reader Expander record → Activate OSDP Install Mode. Expected Events Install Mode Activation by <operator> on Module <module> Module <module> Registered With Serial No (####) These indicate the command was processed and the expander attempted to register. Important: These events appear whether the OSDP handshake succeeds or fails. The only way to confirm success is to badge a card and check for events. OSDP Install Mode may need multiple attempts for successful handshaking. When successful, the HID Reader Manager App will automatically disable Install Mode, which can be confirmed in the App. Key Notes Always verify card functionality before starting OSDP commissioning. Multiple attempts may be required for OSDP handshake. Successful commissioning is confirmed by card events in Security Expert.  

Issue How is a subnet defined, and what role does it play in IP networking? Product Line EcoStruxure Access Expert, EcoStruxure Building Operation, EcoStruxure Security Expert, TAC I/NET Environment This explanation is based on principles outlined in TCP/IP Network Administration by Craig Hunt, published by O’Reilly & Associates, Inc Cause Subnetting is a method used to divide a larger IP network into smaller, more manageable segments called subnets. This segmentation helps optimize IP address usage, improve routing efficiency, and enhance network security and organization. Resolution What Is a Subnet? A subnet (short for subnetwork) is a logical subdivision of an IP network. It is defined by applying a subnet mask to an IP address, which determines how the address is split into: Network portion – identifies the specific network. Host portion – identifies individual devices (hosts) within that network. How Subnet Masks Work A subnet mask is a 32-bit binary pattern that accompanies an IP address. It uses binary values to indicate which part of the IP address refers to the network and which part refers to the host: A bit set to 1 in the subnet mask means the corresponding bit in the IP address is part of the network. A bit set to 0 means the corresponding bit is part of the host. Example IP Address: 192.168.1.10 Subnet Mask: 255.255.255.0 (binary: 11111111.11111111.11111111.00000000 ) CIDR Notation: /24 This means: Network Address: 192.168.1.0 Broadcast Address: 192.168.1.255 Usable Host Range: 192.168.1.1 to 192.168.1.254 CIDR Notation Modern networks often use CIDR (Classless Inter-Domain Routing) notation to define subnets. CIDR expresses the subnet mask as a suffix (e.g., /24 ), indicating the number of bits used for the network portion. Common CIDR Blocks CIDR  Subnet Mask Hosts per Subnet /30 255.255.255.252 2 usable hosts /24 255.255.255.0 254 usable hosts /16 255.255.0.0 65,534 usable hosts Additional Notes Subnets are local constructs: They are meaningful within the internal network and typically not visible to external networks unless explicitly routed. Subnetting supports hierarchical addressing, which simplifies routing tables and improves scalability. Proper subnetting is essential for network performance, security segmentation, and efficient IP address management.

Issue How to be redundant with your intelligent Building Management System (iBMS) Product Line Andover Continuum, EcoStruxure Building Operation, Field Devices, Satchwell Sigma, Security Expert, TAC INET Environment Existing intelligent Building Management System Open Mind High Availability Solutions (Deprecated by manufacturer) everRun MX ztC Edge Cause In engineering, redundancy is the duplication of critical components of a system with the intention of increasing the system's reliability. To be redundant with an intelligent Building Management System (iBMS) would take on two possibilities. Have an alarm on critical points alerting personnel who move into action quickly replacing control boards or devices in the event of failure. Have secondary backup controllers which upon failure, which are used to control devices resuming functionality. This is accomplished through programming the BAS with event sequences triggered from alarms or flags noting the failure. Redundancy capabilities and feasibility are site specific. Ascertaining failure in boards, points, or devices is crucial to creating secondary measures to keep seamless processes going and resume with functions.   Error detection and correction with maintenance is often the best practice for preventing failure. Worn components are the leading cause of failure, followed by a lack of planning and consideration in the protection of electrical components through power surges or failures.   For the database, backups including automated backups for MSDE, SQL Express, and Full SQL are available. For further information on database backups and options, take a look at Microsoft SQL Management Studio. For Host Computer backups, look at adding a secondary computer which replicates the database and can capture transactions and messages should a failure with the primary host computer take place. Also work with the local IT department to keep machines up to date, safe, and clean of 3rd party applications which may interfere with integrity. Schneider Electric’s building management systems are designed such that building control continues even when controller to server communication is disrupted. The BMS server is home to a database of alarm and historical data, as well as system parameters and programs. When a server or its network connection fails, the collection of data from building controllers halts until the problem is resolved. For data critical applications, this solution provides an environment capable of preventing the data loss that results from these types of failures.  Although we do support its use with EcoStruxure Building Operation, Security Expert, Continuum, I/NET, Vista, Sigma, and I/A Series as a disaster recovery solution, we do not provide direct support for EverRun. Resolution For Open Mind High Availability Solutions guide please look at the following link; Open Mind High Availability Solution guide For everRun MX solution guide please look at the following link; everRun MX guide For ztC Edge solution guide please look at the following link; ztC Edge guide   

Issue What is the password policy for Security Expert operators, and how can it be configured to meet specific cybersecurity requirements? Product Line EcoStruxure Security Expert Environment Security Expert Server Security Expert Client Cause Some sites require customized password policies to comply with cybersecurity standards. These may include requirements such as: Enforcing regular password changes Preventing the reuse of previous passwords Setting minimum password length Requiring strong password complexity Resolution   Default Password Policy in Security Expert By default, Security Expert enforces the following password policy for operator accounts: Minimum password length: 8 characters Password change required: On first login For more information on Security Expert’s cybersecurity practices, refer to the SX-SRVR Security Expert System Hardening Reference Guide. Custom Password Policies via Active Directory Integration Security Expert does not support advanced password policy configuration directly within the client interface. However, enhanced password policies can be enforced by integrating Security Expert with Windows Active Directory. To implement this: Integrate Security Expert with Active Directory Follow the steps outlined in Option 1 of the How to Integrate Active Directory with Security Expert article or Option 2 for full Active Directory integration. See AN 288 Security Expert - Using Active Directory - Integration Guide for additional details. Configure Password Policies in Windows Domain Once integration is complete, operator accounts managed through Active Directory will adhere to the domain’s password policy. This allows you to enforce: Password expiration intervals Password history restrictions Minimum and maximum password lengths Complexity requirements (uppercase, lowercase, numbers, symbols)

Issue Unable to find details on all commands that have been added to Security Expert objects to implement new functionality. Having this information available would help determine feature set possibilities. Product Line Security Expert Environment Security Expert Client, SP-C Cause Commands used in objects such as Controllers, Doors, and Access Levels may not be documented in the online help, installation, or operation manuals as they are being used to implement new functionality that has not been added to the Security Expert yet. There is no stand-alone list of all available Commands. Resolution Commands are listed in the firmware Release Notes and defined further in Application Notes.

Issue What virtual environments are supported for use with Security Expert? Product Line Security Expert Environment Security Expert Microsoft SQL Server Cause Which specific virtualization software has been qualified to work with Security Expert? Resolution No specific virtualization software has been qualified with Security Expert. The Security Expert Compatibility Matrix describes support for Virtual Environments as the following.   The Security Expert server is supported on Virtual Server Environments. However, Schneider Electric reserves the right to request customer replication of any errors in a non-virtual environment. When installing under virtual server environments special care must be taken to ensure that the system requirements are met by the virtualized hardware. The VM must be carefully reviewed with regard to resource and performance before completing any installation.

Issue Suprema Fingerprint Reader Integration Product Line EcoStruxure Security Expert Environment Security Expert Suprema Fingerprint Reader Cause Security Expert integrates with Suprema BioEntry, BioEntry Plus, and FaceStation devices. Enrolment is both quick and easy with users scanning their fingerprint or face at an enrolment reader. The Suprema reader uses the scanned data to create a credential template, including a card number, which it sends to the Security Expert Server. Security Expert then sends this template to any other Suprema readers that are attached to the system so that only one enrolment is required. Resolution The following information is available on integrating Suprema Fingerprint Readers with Security Expert A list of qualified Suprema devices and configuration details can be found in the Suprema Biometric Integration in Security Expert Application Note. There are some available help topics in the online help. In the Security Expert  Client go to ABOUT | HELP and search for "Biometric Readers" and "Suprema". Each Suprema reader requires a wiegand port on a controller / expander, a license (SX-BIO-SP) and an IP address. The amount of Suprema readers allowed is only limited by these numbers. 

Issue When a card is presented at the Smart Reader it beeps but no card data is sent through to the Security Expert Controller. The Reader LED is flashing red then green every second continuously. Product Line EcoStruxure Security Expert Environment Security Expert Smart Card Readers which support both 125Khz and 13.56Mhz (SX-DRD-xx, SX-DRK-xx, SX-RK-xx) Cause The Smart Card Reader is not able to communicate with the Controller as it is in RS-485 mode but the connection being used is Wiegand. Once connecting to the the Smart Reader in RS-485 mode the reader will not communicate if it is then connected up to a Wiegand port. Resolution Once a Security Expert Smart Card Reader is used in an RS-485 configuration it will not work in Wiegand configuration until it has been re-programmed with a configuration card designed for that purpose. The configuration card  (SX-ISO-CONFIG) must be purchased through Schneider Electric. See the Security Expert Credentials Order Form for details.   This is because RS-485 is a two-way communication, intelligent wiring protocol. Once the reader is set in this two-way communication mode there is currently no way, without the configuration card, to go back to a less intelligent one-way mode like Wiegand.   Note: Readers manufactured in 2017 or before may have a firmware version that uses a configuration mode that will not respond to a configuration card. If you contact Schneider Electric for a configuration card, supply the serial number (SN) from the back of the reader on your request.

Issue What fingerprint or faceprint readers does Security Expert support? Product Line EcoStruxure Security Expert Environment Security Expert Fingerprint Reader Faceprint Reader Biometric Reader Cause Require information on what Biometrics readers are supported with Security Expert. Resolution We officially support Suprema, Princeton Identity and IDEMIA biometric readers (see SX SRVR Security Expert - Compatibility Matrix) however our reader expanders/controllers are able to work with any reader that provides a standard 26-bit Wiegand output.   If there is a biometric reader that does this it should be able to be connected to Security Expert like a standard card reader supplying the controller with Wiegand data that is assigned to a user. The enrolling of biometrics would need to be handled by the third party system, we would essentially be treating it as a normal card reader and card.   For a list of Suprema devices that Security Expert supports refer to the Suprema Biometric Integration in Security Expert Application Note. For a list of Princeton Identity devices that Security Expert supports refer to the Princeton Identity Biometric Integration  Application Note. For a list of IDEMIA devices that Security Expert supports refer to the IDEMIA Biometrics Integration Application Note.

Issue Security Expert PSU has Fault Icon lit and Status Light Flashing Red Every 3 Seconds indicating an issue with PSU Addressing Product Line EcoStruxure Security Expert Environment Security Expert PSU Cause The module address 254 is the default value which all modules are shipped with and is outside the range the controller can accept. This must therefore be changed during commissioning. See Page 41 of the Operator Reference Manual for details. There is an overall limit of 250 modules that can be connected to a single controller with the following limit on each type of module: Keypad Modules: 200 Input Expanders: 248 Reader Expanders: 64 Output Expanders: 32 The module addressing is defined per module type not by the position of that module on the network. You could have all modules at the same address as long as they are all different types. Example: With the following modules we could have all modules be set to use address 1: 1 x Controller 1 x Keypad 1 x Reader Expander (In this case onboard Reader) 1 x Analogue Expander (PSU) Resolution 1. Right Click on the SP-C Controller and select Module Addressing. Change the Address of the Analog Expander (PSU) from its default value of 254 in this case to a value of 1. 2. Then Update all Modules. 3. Select the Analog Expander (PSU) in the System and also change its Physical Address to also be 1. Save the changes. 4. The PSU should now come online and the Fault Icon on the PSU will no longer be lit.

Issue Troubleshoot Security Expert Controllers showing offline in the client. Product Line EcoStruxure Security Expert Environment Security Expert Cause Require some common troubleshooting steps to help determine why controllers may be offline to the client. Resolution The main items to check are: Refer to the Troubleshooting Security Expert Controller Connectivity - Application Note on Exchange. If a controller has failed and the Replacement controller unable to be brought online then check if controller encryption had been enabled on the replaced controller. Restart the client software. Power restart the controller. Remove power Wait for all LED's on the controller to go completely off Apply power to the controller. In the controller web interface, on the Settings page, check that Event Server 1 has the correct IP address. Check that the Firewall is disabled. Check any Anti-Virus Firewalls/settings as well. If the Firewall cannot be disabled, ensure that all required ports are open between devices. See SX-SRVR Security Expert - Network Administrators - Installation Guide for details. Restart the Security Expert services under the PC's Services option in Control Panel. These need to be restarted when any changes are made. Confirm that the User Interface, Data Server, Event Server and Download Server module versions are all the same. Go to About  > Version and check there. If the database has not been upgraded to the same version as the client software, then this can cause communications issues. On the Security Expert Server check that MSMQ is installed as this is now a requirement   Security Expert MSMQ is required (Not showing live point status / shows "Unknown Status" error)   If MSMQ was installed after Security Expert, you'd need to reinstall Security Expert to allow it to run correctly. If MSMQ is installed and controllers are still not coming online (or the controllers are "bouncing" offline/online) then anecdotal evidence suggests enabling Windows 8 Compatibility Mode may help especially for Windows Server 2016 and Server 2019. Set the Windows 8 Compatibility Mode checkbox in the Properties page for C:\Program Files (x86)\Schneider Electric\Security Expert\SecurityExpertEvtSvr.exe   Also, note that if a database backup has been imported, then there is a need to check/change some other settings as well to ensure everything is set up for the specific server and controller.   Under Global > Download Server confirm that your computer name is the name of the PC where the download server service is running. Under Global > Event Servers ensure that the computer name is the name of the PC where the event server service is running. Under Sites > Controllers confirm the Serial number, IP Address, Download Port, Download Server and Control and Status Request Port match what is set in the controller's configuration web page (browse to the controllers IP Address to view). On that same General tab go to Diagnostic Windows and open the download and event server windows. Review the information contained and if there are any errors shown. Right click the controller and select Get Health Status. Review the status messages displayed.

Issue Is it possible to integrate Schlage products with Security Expert? Product Line Security Expert Environment Security Expert Server (vv4.2.259.19 and above) SP-C controller Firmware (v2.08.923 and above) Cause Unable to migrate or convert a legacy access control system which has Schlage devices integrated to Security Expert Resolution With Security Expert Software (v4.2.259.19 and above) and SP-C firmware (v2.08.923 and above), the integration of Schlage devices (AD300 and AD400) with Security Expert software is supported.  It is always recommended to use the latest Security Expert Version and SP-C firmware version to avoid any known issues. For more information regarding the, Schlage Integration with Security Expert, download the attachment.  Refer to Security Expert Allegion Smart Reader Integration 

Issue SP-C-WEB Recommended Limits Product Line Security Expert Environment Security Expert SP-C-WEB Cause The SP-C-WEB limitations are mentioned in briefly in the SmartX Controller SP-C-WEB presentation but detailed information on this is not available in the current SP-C-WEB documentation.  Resolution Schneider Electric's recommended limits for the SP-C-WEB:Number of Areas: 32 Number of Doors: 32 Number of Aperio Doors: 0 Number of Sallis Doors: 0 Number of Allegion Doors: 0 Number of Credential Readers: 0 Number of Cameras: 2 Number of Elevators: 0 Number of Floors: 0 Number of Inputs: 512 Number of Keypads: 32 Number of Outputs: 512 Number of Input Expanders: 32 Number of Output Expanders: 32 Number of Reader Expanders: 32 Number of Analog Expanders: 32 Number of Users: 10000 Number of Areas: 32 Number of Doors: 32 Number of Aperio Doors: 0 Number of Sallis Doors: 0 Number of Allegion Doors: 0 Number of Credential Readers: 0 Number of Cameras: 2 Number of Elevators: 0 Number of Floors: 0 Number of Inputs: 512 Number of Keypads: 32 Number of Outputs: 512 Number of Input Expanders: 32 Number of Output Expanders: 32 Number of Reader Expanders: 32 Number of Analog Expanders: 32 Number of Users: 10000

Issue How to interface OTIS Elevator HLI with Security Expert. Product Line Security Expert Environment Security Expert v4.2.194.7 or higher SX-ELV-HLI-OT license to enable the integration OTIS OTIS Compass V2 OTIS OTIS Compass V3 Cause Information required on how to interface OTIS Elevator HLI with Security Expert. Resolution Requirements Security Expert (v4.2.194.7 or higher). SX-ELV-HLI-OT license to enable the integration.   This interface will work with OTIS Compass V2 and OTIS Compass V3. Detailed information on how to configure this integration can be found in the application note below.   Security Expert OTIS HLI Integration

Issue When the card reader is set to "CARD and PIN" it will wait for 10 seconds for the valid pin after a valid card has been swiped. There is no visible setting to set to be able to change this PIN timeout. Product Line Security Expert Environment Security Expert Server SP-C Cause The default timeout setting of 10 seconds between displaying a card and entering PIN can in some situations be too short. In other situations it may even be that the timeout of 10 seconds is too long for security reasons. There is therefore a need to adjust this timeout value. Resolution From SP-C firmware version 2.08.0843 and forward, there is a Door command called DualCredPendingTime that enables adjusting the timeout for supplying credentials for authenticating a user, such as Card and PIN. In Security Expert Client, go to Programming > Doors. Select the door you want to configure on the left. Expand COMMANDS Enter DualCredPendingTime = # where # is the timeout time in seconds. See example with a 20 second timeout set below. See also the Security Expert Release Notes page 30.

Issue Where are the reports of fixed issues/bugs for the various product lines located? Product Line TAC Vista, TAC INET, Andover Continuum, Satchwell MicroNet, Satchwell Sigma, TAC IA Series, EcoStruxure Building Operation, EcoStruxure Building Expert, Access Expert, Security Expert Environment Technical Product Announcements Cause TPAs contain information of changes made per version of the different product lines. A TPA may report enhancements and/or broken functionality. Resolution Navigate to Exchange Extranet to view all TAC Vista documents tagged as TPA. The documents will be listed in reverse chronological order. Log in to view these documents. See Register for The Exchange Download Center for more information on registration.

Issue Are there restrictions on the location of the SP-C on the RS-485 bus? Product Line Security Expert Environment Security Expert Controller (SP-C, SP-AC1, SP-ACX, SP-C-WEB) Security Expert Expander Modules Warning Hazard of Electric Shock: Remove all power from all devices before removing any covers or doors of the system. Disconnect power at the device and at the power source. Electrostatic Discharge Required: Always discharge static electricity from your person by touching metal prior to handling any hardware. Failure to do so may result in damage to devices. Potential for Data Loss: The steps detailed in the resolution of this article may result in a loss of critical data if not performed properly. Before beginning these steps, make sure all important data is backed up in the event of data loss. If you are unsure or unfamiliar with any complex steps detailed in this article, please contact Product Support for assistance. Cause The SP-C Installation Manual shows the SP-C as the first device in a standard network communication connection.  Locating the Security Expert controller in the middle of the RS-485 bus will reduce the amount of cable required. Resolution You can put the controller in any position on the RS-485 chain. Ensure you use the correct cable type, the overall length does not exceed 900 meters (3000 feet) and the two ends are correctly terminated with EOL resistors. Refer to the Encrypted Module Network section in the SP-C Installation Manual - System Controller for more details.

Issue When attempting to use the Read Card button to read credentials from a card reader the following error is shown. Failed to read the card from the reader Failed to read cardFailed to read cardFailed to read card Product Line Security Expert Environment Security Expert Client Proximity Card Encoder (PRX-ENC-DT) Cause A Proximity Card Encoder (PRX-ENC-DT) is not connected to the Workstation. Resolution 1. Using a USB connection, connect a PRX-ENC-DT to the Workstation. The USB connected card reader can be used to read new cards and add those card credentials to a User by placing the card on the reader and pressing the Read Card button in the User object. Read CardRead CardRead Card This will read 13.56MHz Schneider encoded Mifare and DESFire cards. The encoder is not able to read 125KHz cards.   2. Using alternative methods for adding credentials to Users Manually adding the Facility and Card Numbers to an available slot in the User object. Badging the card at a Card Reader and right-clicking the resulting access event in the Status Window and selecting to add to an existing or create a new User. Use the Data Sync Service to import Users, and changes to Users, from CSV files. See Mass importing User Photos into Security Expert using Data Sync Service for an indication of how the Data Sync Service is configured.

Issue Need to activate an Output when access is denied to a User at a Door. Product Line Security Expert Environment EcoStruxure Security Expert Cause In the Door object, there is a facility for triggering Outputs on Pre Alarm, Door Left Open, and Door Forced Open but nothing for when a User is denied access. Resolution There were new Door commands added to SP-C firmware 2.08.1018 and newer to add this functionality. AccessDeniedTime = # has been added to the Door commands which will specify the duration in seconds that an output or output group will be activated for when access to the door has been denied. This must also be paired with one of the following 2 commands in order for the functionality to occur. AccessDeniedOutput = # has been added to the Door commands which will specify the output that will be activated when access to the door has been denied. The # will be the database ID of the output/output group. AccessDeniedOutputGroup = # has been added to the Door commands which will specify the output group that will be activated when access to the door has been denied. The # will be the database ID of the output group. As an example, if you wanted the Output with an Id = 3 to turn on for 5 seconds when access is denied at the Door, the following lines would need to be added to the Door object in the Commands section. AccessDeniedTime = 5 AccessDeniedOutput = 3 Door Command - Access Denied OutputDoor Command - Access Denied Output  

Issue Understand methods for integrating Security Expert with Active Directory for creation and management of Operators and Users. Product Line EcoStruxure Security Expert Environment Security Expert Active Directory SX-AD-OPR SX-AD-USR SX-DB-SYNC Cause Security Expert Active Directory Integration provides synchronization and authentication for Active Directory users enabling organizations to leverage on the user management and security policies that Active Directory provides. This article looks at the details between each integration option. Resolution There are four options for Active Directory Integration. 1. Default Windows Authentication option. This allows for logging in to Security Expert with the Windows User account credentials which could include AD users if on a Domain. Operator object must be created in Security Expert and configuration of windows authentication option has some specific steps to be followed for it to work. Unable to login to Security Expert using Windows Authentication Remember to use syntax "<domain>\<username>" for the username when configuring the Operator for a Windows user ON a  Domain. Remember to use syntax "<computername>\<username>" for the username when configuring the Operator for a Windows user that is NOT on a Domain. No extra license is required for this. 2. SX-AD-OPR : License for adding Security Expert Operators from AD. Security Expert Operators will need to be added manually using the following steps: Navigate to Operators and click Add. Check the Windows Authentication box. Click the ellipsis adjacent to the User Name. Use the Active Directory Users window to search for the AD credentials you wish to use. Once the Operator has been added, you may check the Windows Authentication option when logging in. 3. SX-AD-USR : License for adding Security Expert Users from AD. This will allow an active directory domain windows group to be periodically polled for updates that will in turn update the Users in Security Expert. Individual options for importing users, disabling user if AD user is disabled, disabling user if AD user is deleted. Only user names are imported, other than this only action can be disabling of users in Security Expert. No other details can be updated or added. See application note AN-141 Security Expert LDAP User Import Configuration. 4. SX-DB-SYNC : Data Sync Service with Powershell script. Powershell script pulls user details out of AD and writes to a CSV file that the Data Sync Service then imports into Security Expert. Can perform more functions than SX-AD-USR as any attribute from AD users can be mapped to any attribute in Security Expert users. Will require use of powershell experience as the sample script will likely need to be tweaked. Here is a really good video Using Data Sync to Transfer Information from Active Directory to ProtegeGX on using Windows Active Directory as a source of Users/Operators for the Data Sync Service. It provides a good overview of how this is accomplished and how easy it can be to setup. See Security Expert Data Sync Service and sample Powershell script SXFetchADUsers.zip attached