---
title: Security Features
slug: security-features
createdAt: 2025-07-21T20:25:30.687Z
---



The following section outlines the security features and implementation considerations when deploying this component.

## General Site Security

The Activate Anywhere Web Site connects to a web service on the Activate Web Server. This is the same web service that the Activate Windows Security Plugin uses. The web service is installed but disabled by default when an Activate Server is installed.

![](https://api.archbee.com/api/optimize/Lfto9rn2ELed8aLNOgwlJ/hWkODU_ubPD1OVdgQkd5i_.blob)

## Configuration Level Security

The web service runs in **Anonymous** access mode within IIS and must be manually enabled before use.

## Transport Level Security

All communication between the Activate Anywhere Server and the web service is encrypted using a **256-bit AES protocol**.

A default 256-bit key is built into the Activate Anywhere Site and Web Service; however, a **custom encryption key** can be configured if required.

## Logical Protocol Security

A **unique session key** is generated for each transaction and must be used for all subsequent calls to the web service for that transaction.
 This prevents spoofing of in-progress transactions.

User password answers are never transferred to the client.

## External Links

Links to the Activate Anywhere Web Site for password reset are often placed on other publicly available portals such as **Outlook Web Access (OWA)**, **Citrix**, or **VPN Access** sites.

## Captcha Authentication

The Activate Anywhere Web Site uses an industry-standard **CAPTCHA** mechanism on the first page to prevent automated attacks and confirm that the user is human.
 This protects against automated hacking and abuse.

The CAPTCHA can be configured to use either:

- An **alphanumeric challenge**, or 
- A **numeric calculation** (e.g., “What is 5 + 7?”) 

## Single-Use PINs

The system can also be configured to require a **single-use PIN** when a user resets their password.
 This provides **three-level authentication** for password reset or account unlock.

The PIN can be delivered to:

- An external email address, or 
- The user’s mobile phone via SMS. 

## Password Reset Attempts and Locking

When users attempt to reset their passwords, **three levels of locking** are applied:

### 1. IP Address Locking

The system tracks reset attempts from each source IP address and blocks that IP after a defined number of failed attempts.

- **Default limit:** 10 attempts 
- **Default block duration:** 60 minutes 

Ensure that:

- The **external IP address** is passed correctly to IIS, or 
- The **proxy server** is configured to include the original IP in the X-Forwarded-For header. 

### 2. Account Locking

After a defined number of failed attempts to answer the password security questions, the account is locked from external reset within Activate.
 Users may still reset their account through other means or contact the Service Desk.

- **Default limit:** 3 attempts 
- **Default block duration:** 60 minutes 

### 3. Account Authentication

When setting up the Password Reset Web Site for the first time, repeated failed authentication attempts will result in a temporary lock.

- **Default limit:** 5 attempts 
- **Default block duration:** 60 minutes