# Quick Overview
## **Application Overview**
Hideez Authenticator is a free app for Android and iOS that turns your smartphone into a reliable key for logging into services and workstations. With this app, you can quickly, securely, and conveniently access your data.
{% hint style="info" %}
**Minimum iOS version**: 13\
**Minimum Android version**: 8
{% endhint %}
Hideez Authenticator is part of the Hideez Authentication Service and is used in corporate projects. For it to work, you need a configured server and the Hideez Client app installed on your computer.
## **Key Features**
* Passwordless Single Sign-On (SSO) to web services and applications using biometrics or QR code
* Two-factor authentication (2FA) through SAML and OIDC protocols for secure access to applications and services
* Passwordless login to Microsoft services (e.g., Exchange OWA)
* Passwordless login to Windows workstations
* Login to workstations via RDP using a smartphone
* One-Time Password (OTP) generation for 2FA
* FIDO standards support for high-security levels
* Protection from phishing attacks, unauthorized access, and account hijacking
* Compliance with strict security requirements for protecting critical data (FIDO Alliance)
## **Requirements for Operation**
### **For passwordless login to web services and applications:**
* The user must be registered on the server with the app installed
* Hideez Authenticator must be enabled as the authentication method for SSO
* Web services and applications must support SAML, OIDC protocols
* Integrations with web services via SAML, OIDC, WS-Federation protocols must be set up on the server
### **For passwordless login to a PC (local Active Directory accounts):**
* Corporate version of Hideez Client must be installed on the computer
* The computer must run Windows 10/11 and support TPM 2.0 module
* The computer must be connected to an Active Directory domain
* A configured certificate server (Certificate Authority) in the Active Directory domain
* The server must be accessible both for Hideez Client and the mobile app
* A specially configured certificate template on the certificate server (see Certificate Authority settings in Active Directory)
### **For password-based login to a PC (password-based account):**
{% hint style="info" %}
Users can also log in to the workstation using a password-based account. To do so, they must set the password themselves once during the account creation process. After that, the login will proceed by scanning a QR code and confirming in the app.
{% endhint %}
* Corporate version of Hideez Client must be installed on the computer
* The user must be registered on the server
* The server must be accessible both for Hideez Client and the mobile app:
* The computer and smartphone must be on the same network, or the server must have a public IP address
{% hint style="info" %}
Українську версію цього керівництва можна знайти [тут.](https://authenticator-ua.hideez.com/)
{% endhint %}
# Primary Setup (admin guide)
There are 2 options for Windows login:
* passwordless login to the PC within AD on-premises domain
* password-based login
The following guide describes setting the environment for passwordless Windows workstation login.
To set up your system environment for passwordless login you have to [configure Active Directory Certification Authority](/primary-setup-admin-guide/configuring-an-active-directory-certification-authority), [add domain settings to the Hideez Server](/primary-setup-admin-guide/server-setup-for-passwordless-login), and then [configure SSO](/primary-setup-admin-guide/sso-configuration). After these steps, you can proceed to application enrollment on Server and then follow the instruction for PC passwordless login enrollment.\
\
To set up your system environment for password-based login you only have to [configure SSO on Server](/primary-setup-admin-guide/sso-configuration), enroll the application on Server and then follow instructions for PC password-based login enrollment.
In case you only have to use the Hideez Authenticator for OTP generation, please, [configure SSO on the Server](/primary-setup-admin-guide/sso-configuration) and then refer to the corresponding guide - [*Android*](/user-guide/android-guide/otp-generation)*,* [*and iOS*](/user-guide/ios-guide/otp-generation).
# Configuring an Active Directory Certification Authority
### How does passwordless authentication work?
It is based on Microsoft Virtual Smart Card technology - which allows you to log in to domain accounts using smart cards, not physical but virtual. As with regular smart cards, this is possible if you set up a domain controller and certification authority. A virtual smart card is created on a workstation using the TPM module.
When initializing a virtual smart card, part of the information required to log in to the account (smart card credentials) is transferred to the mobile application and stored there. During the logon, the user scans the QR code on the computer screen, which allows you to establish a connection between the computer and the phone, after which the smart card credentials are transferred to the computer and then PC is unlocked.
### Active Directory Certification Authority setup
On Certification Authority, you need to create a template for the certificate that you will request for the virtual smart card.
To create the certificate template:
1. On your server, open the Microsoft Management Console (MMC). One way to do this is to type **mmc.exe** from the **Start** menu, right-click **mmc.exe**, and click **Run as administrator**.
2. Click **File**, and then click **Add/Remove Snap-in**.\
\
3. In the available snap-ins list**,** click **Certificate Templates**, and then click **Add.**\
\
4. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates.
5. Right-click the **Smartcard Logon** template, and click **Duplicate Template**.\
\
6. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed.\
\
7. On the **General** tab:
1. Specify a name, such as **TPM Virtual Smart Card Logon**.
2. Set the validity period to the desired value.
8. On the **Request Handling** tab:
1. Set the **Purpose** to **Signature and smart card logon**.
2. Click **Prompt the user during enrollment**.
9. On the **Cryptography** tab:
1. Set the minimum key size to 2048.
2. Click **Requests must use one of the following providers**, and then select **Microsoft Base Smart Card Crypto Provider**.
10. On the **Security** tab, add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated users** group, and then select **Enroll** permissions for them.
11. Click **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates.
12. Select **File**, then click **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**.\
\
13. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list.
14. Right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**.\
\
15. From the list, select the new template that you just created (**TPM Virtual Smart Card Logon**), and then click **OK**.\
\
**Note**: It can take some time for your template to replicate to all servers and become available in this list.\
\
16. After the template replicates, in the MMC, right-click in the Certification Authority list, click **All Tasks**, and then click **Stop Service**. Then, right-click the name of the CA again, click **All Tasks**, and then click **Start Service**.\
# Server setup for passwordless login
Once you have created the appropriate template in the certification authority, you need to get the following settings:
1. Cryptographic Service Provider Name
2. Certificate Config
3. Certificate Template ID
The first parameter (Cryptographic Service Provider Name) must be set to "Microsoft Base Smart Card Crypto Provider".
The second parameter (Certificate Config) is the name of the domain controller and the name of the certification authority, separated by an "\\". The following command will help define these names: "certutil -config - -ping". Run it from the command line, then you should get such window:
To define the third parameter (Certificate Template ID), go to the domain controller, and do the following:
* Open MMC and add the **Certificate Templates snap-in** (File > Add/Remove Snap-ins > Certificate Templates)
* Right click the created certificate template
* Open **Properties**
* Open **Extensions** tab
* Select “**Certificate Template Information**”
The ID will be visible in the description below after "**Object identifier**":
The received parameters need to be entered to the Server settings. To do this, go to Settings → Parameters → Domain. Add the "[On-premises Active Directory domain](https://enterprise.hideez.com/hideez-enterprise-server/administration/setting-hes-server-parameters#domain)", and then edit the Workstation passwordless logon settings:
Enter and save the settings you received before.
# SSO configuration
First, admin has [to order as many SSO licenses as many users will use Hideez Authenticator](https://enterprise.hideez.com/hideez-enterprise-server/single-sign-on-settings/how-to-get-employee-licenses).
Administrators can log into the Server service and use the SSO service by default, but employees with user accounts cannot, so they first must have an explicit permission of the administrator:
1. Select an employee and click the 'Edit' button.
2. Then click the 'Enable SSO' button at the opened page to give the permission.
If you want to require Hideez Authenticator as a second factor, check the "Required Two Factor Authentication" box and then click the "Enable" button.
If you want to allow user use **passwordless authentication** with the Hideez Authenticator, ***don't do it***, just click "Enable" button.
Also you can enable SSO and second-factor for user during the employee creation on the "Single Sign On" step:
# Next steps
After the system environment configuration employees can enroll Hideez Authenticator on Server:
* settings for administrator accounts - [*Android*](/user-guide/android-guide/software-key-enrollment/sso-enrollment/sso-enrollment-admin-account)*,* [*iOS*](/user-guide/ios-guide/software-key-enrollment/sso-enrollment/sso-enrollment-admin-account)
* settings for user accounts - [*Android*](/user-guide/android-guide/software-key-enrollment/sso-enrollment/sso-enrollment-user-account)*,* [*iOS*](/user-guide/ios-guide/software-key-enrollment/sso-enrollment/sso-enrollment-user-account)
Enroll Hideez Authenticator in the Hideez Client for PC login - [*Android*](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment)*,* [*iOS*](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment).
After successful enrollment, you can login to the:
* Server - [*Android*](/user-guide/android-guide/login-with-hideez-authenticator/sso-login)*,* [*iOS*](/user-guide/ios-guide/login-with-hideez-authenticator/sso-login)
* PC - [*Android*](/user-guide/android-guide/login-with-hideez-authenticator/pc-login)*,* [*iOS*](/user-guide/ios-guide/login-with-hideez-authenticator/pc-login)
# User guide
This guide describes all steps for configuring and using the Hideez Authenticator application.
Please, select the guide for your mobile OS:
* [*Android*](/user-guide/android-guide)
* [*iOS*](/user-guide/ios-guide)
# Android guide
This section describes the full list of Hideez Authenticator Android app functions:
* [SSO login](/user-guide/android-guide/login-with-hideez-authenticator/sso-login)
* [PC login](/user-guide/android-guide/login-with-hideez-authenticator/pc-login)
* [PC lock](/user-guide/android-guide/pc-lock)
* [OTP generation](/user-guide/android-guide/otp-generation)
To use them first you have to set up the Authenticator via [this](/user-guide/android-guide/mobile-app-primary-setup) guide.
# Mobile App Primary Setup
1. Open Hideez Authenticator. Tap "Next".
2. Set and confirm the PIN code.\
\
\
3. For best security, it is highly recommended to use a Biometric login.
4. Now you can move to the [application enrollment on the Hideez Enterprise Server](/user-guide/android-guide/software-key-enrollment/sso-enrollment/sso-enrollment-admin-account).
{% hint style="warning" %}
Biometric login will be available **only** after biometric setup at the smartphone settings.
{% endhint %}
# Software key enrollment
To use the Hideez Authenticator you have to first [enroll the application on HES](/user-guide/android-guide/software-key-enrollment/sso-enrollment).
Then [enroll the Hideez Authenticator in Hideez Client](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment) if you want to use it for [PC login](/user-guide/android-guide/login-with-hideez-authenticator/pc-login).
# SSO enrollment
To use Hideez Authenticator first you have to enroll the mobile app on Hideez Enterprise Server (HES).
* [Administrator account enrollment](/user-guide/android-guide/software-key-enrollment/sso-enrollment/sso-enrollment-admin-account)
* [User account enrollment](/user-guide/android-guide/software-key-enrollment/sso-enrollment/sso-enrollment-user-account)
# SSO enrollment (admin account)
There are 2 options for HES accounts:
1. Register app for [two-factor authentication](/user-guide/android-guide/login-with-hideez-authenticator/sso-login/sso-login-as-a-second-factor).
2. [Passwordless authentication](/user-guide/android-guide/login-with-hideez-authenticator/sso-login/sso-passwordless-login) with Hideez Authenticator.
For admin account enrollment is the same for both options.
### Enabling two-factor authentication
#### Enabling the second factor for the admin account
To enable login with Hideez Authenticator as a second factor for the user account, please, follow this [guide](https://enterprise.hideez.com/hideez-enterprise-server/administration/how-to-enable-two-factor-authentication-at-hideez-enterprise-server).
#### Enabling the second factor for a user account
To enable login with Hideez Authenticator as a second factor for the user account, please, follow this [guide](https://enterprise.hideez.com/hideez-enterprise-server/single-sign-on-settings/nastroika-polzovatelei).
### Hideez Authenticator enrollment
To use Hideez Authenticator first you have to enroll the mobile app on Hideez Enterprise Server (HES). To do this, follow simple steps:
1. Open your HES and go to the "Profile" section.\ \
2. Go to the "Mobile App" section and click the "Register Hideez Authenticator" button.\
\
\
\
Here you can download Hideez Authenticator for your OS from Google Play or App Store via corresponding links.
3. Open Hideez Authenticator and scan the QR code on HES.\
\
4. Confirm SSO enrollment on Hideez Authenticator.\
\
5. That is all set. Now you can [log in on HES](/user-guide/android-guide/login-with-hideez-authenticator/sso-login/sso-passwordless-login) with the Hideez Authenticator.\
\
# SSO enrollment (user account)
{% hint style="info" %}
Please, first ensure that your HES administrator [enabled the SSO option for your user](/primary-setup-admin-guide/sso-configuration).
{% endhint %}
There are 2 options for HES accounts:
1. Register app for [two-factor authentication](/user-guide/android-guide/login-with-hideez-authenticator/sso-login/sso-login-as-a-second-factor).
2. [Passwordless authentication](/user-guide/android-guide/login-with-hideez-authenticator/sso-login/sso-passwordless-login) with Hideez Authenticator.
If your administrator [enabled the second-factor requirement](/user-guide/android-guide/software-key-enrollment/sso-enrollment/sso-enrollment-admin-account#enabling-second-factor-for-user-account), you have to follow the [first](#enrollment-as-second-factor) part of this instruction, otherwise - the [second](#enrollment-for-passwordless-login) one.
### Enrollment as the second factor
1. Open the email from the HES in your mailbox and follow the link in it.
2. Follow the screen guide and set the password.\
\
\
\
3. Then click the "Use Hideez Authenticator" button.\
\
4. Here you can download Hideez Authenticator for your OS from Google Play or App Store via corresponding links.\
\
5. Open Hideez Authenticator and scan the QR code on HES.\
\
6. Confirm SSO enrollment on Hideez Authenticator.\
\
7. That is all set. Now you can log in with the Hideez Authenticator as a second factor.
### Enrollment for passwordless login
1. Open the email from the HES in your mailbox and follow the link in it.\
\
2. Then click the "Use Hideez Authenticator" button.\
\
3. Here you can download Hideez Authenticator for your OS from Google Play or App Store via corresponding links.\
\
4. Open Hideez Authenticator and scan the QR code on HES.\
\
5. Confirm SSO enrollment on Hideez Authenticator.\
\
#### If you already registered a security key for SSO, you can register mobile app by following these steps:
1. Go to the "Hideez Authenticator" section and click the "Register Hideez Authenticator" button.
\
\
Here you can download Hideez Authenticator for your OS from Google Play or App Store via corresponding links.\
\
2. Open Hideez Authenticator and scan the QR code on HES.\
\
3. Confirm SSO enrollment on Hideez Authenticator.\
\
4. That is all set. Now you can log in with the Hideez Authenticator.
# PC Authorization Enrollment
Before you will enroll the Hideez Authenticator for PC login please ensure that you have followed the steps for [application enrollment on HES](/user-guide/android-guide/software-key-enrollment/sso-enrollment).
# Enrollment for Passwordless PC Authorization
1. [An enterprise version](https://update.hideez.com/update/hideezclient/clientsetup.exe) of the client must be installed on the computer. Ensure that:
* [The Client is connected to the HES](https://enterprise.hideez.com/hideez-client-app/application-interface/general-settings), [the workstation is approved](https://enterprise.hideez.com/hideez-enterprise-server/workstations/workstations-management).
* You are signed into the Windows domain account.
* Workstation has TPM 2.0 module.
{% hint style="warning" %}
**Please note, that for Passwordless PC Authorization Administrator has to configure:**
* [**Configuring an Active Directory Certification Authority**](/primary-setup-admin-guide/configuring-an-active-directory-certification-authority)
* [**HES setup for passwordless login**](/primary-setup-admin-guide/server-setup-for-passwordless-login)
{% endhint %}
2. Input HES address at the Settings section.\
\
3. Go to the Mobile Authenticator section and click the "Setup" button under the Passwordless Authenticator subsection.\
\
4. Open Scanner section at the Hideez Authenticator and scan the QR code from Hideez Client.\
\
\
\
Also, you can open this scanner from the "Accounts > Workstation" section.\
\
 \
\
In this case sthe canner will look like this:\
\
\
\
5. Confirm enrollment on Hideez Authenticator.\
\
\
\
Enrolling will start.\
\
 
6. That is all set.\
\
\
\
Now you can find information about unlock account in the "Accounts > Workstations" section at the Hideez Authenticator. Also here you can [delete unlock account](/user-guide/android-guide/software-key-disabling/pc-login-disabling) or add a new one.\
\
\
\
In the [next article](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-passwordless-pc-authorization/passwordless-account-re-enrollment), you can find the guide on how to re-enroll Hideez Authenticator if the validity period of the certificate for passwordless enrollment is over.
# Passwordless account re-enrollment
Certificates are created in AD for passwordless login. The default validity period for this certificate is 1 year. When the validity period ends, Hideez Client will notify you. Then you will have to re-enroll the certificate for passwordless login for further use. The procedure is the same as enrollment:
1. Open previously installed [Hideez Client](https://update.hideez.com/update/hideezclient/clientsetup.exe).
2. Go to the Mobile Authenticator section and click the "Setup" button under the Passwordless Authenticator subsection.\
\
3. Open the Scanner section at the Hideez Authenticator and scan the QR code from Hideez Client.\
\
4. Confirm the re-enrollment in the Authenticator:\
\
5. That is all set. Now the certificate validity period is reset and you are able to use Authenticator again.
{% hint style="info" %}
You can preventively re-enroll the certificate even if the validity period is not over yet.
{% endhint %}
# Enrollment for Password-based PC Authorization
1. [An enterprise version](https://update.hideez.com/update/hideezclient/clientsetup.exe) of the client must be installed on the computer. Ensure that:
* [The Client is connected to the HES](https://enterprise.hideez.com/hideez-client-app/application-interface/general-settings), [the workstation is approved](https://enterprise.hideez.com/hideez-enterprise-server/workstations/workstations-management).
2. Input the HES address in the Settings section.\
\
3. Go to the Mobile Authenticator section and click the "Setup" button under the Password-based Authenticator subsection.\
\
4. Open the Scanner section at the Hideez Authenticator and scan the QR code from Hideez Client.\
\
\
\
Also, you can open this scanner from the "Profile > Workstation" section.\
\
\
\
In this case, scanner will look like this:\
\
\
\
5. Confirm enrollment on Hideez Authenticator. Select the account type (Local/Domain/Microsoft/AzureAD) and fill in all the fields. Then tap the "Save" button.\
\
 \
\
 
6. That is all set.\
\
Now you can find information about unlock account in the "Accounts > Workstations" section at the Hideez Authenticator. Also here you can [delete unlock account](/user-guide/android-guide/software-key-disabling/pc-login-disabling) or add a new one.\
\
\
\
In the [next article](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-password-based-pc-authorization/account-roaming), you can find the guide on how to use one password-based unlock account for any PC.
# Account roaming
If you use the same account on the different workstations, you can enroll it on the one workstation and use it for the all computers with this account.
Don't forget to install Hideez Client on the all PC and [connect it to the HES](https://enterprise.hideez.com/hideez-client-app/application-interface/general-settings).
In the Authenticator you have to switch the "Roaming Account" option when you [enroll password-based unlock account](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-password-based-pc-authorization) or you can edit this option in the account settings after creation:
 
{% hint style="warning" %}
Please, note: the roaming feature applies ONLY to the unlocking feature with password-based accounts. You can [lock](/user-guide/android-guide/pc-lock) only that workstation on which the Authenticator was enrolled.
{% endhint %}
# Login with Hideez Authenticator
This section describes how to login with the Hideez Authenticator:
* [on HES to use the SSO option](/user-guide/android-guide/login-with-hideez-authenticator/sso-login)
* [into the Windows PC user account](/user-guide/android-guide/login-with-hideez-authenticator/pc-login)
# SSO login
{% hint style="info" %}
**The application also supports multi-accounts, allowing you to add multiple accounts for users registered on the Hideez Enterprise Server within a single domain, as well as accounts from different Hideez servers in various domains. This is particularly convenient if you have multiple Hideez servers or multiple accounts on one server.**
{% endhint %}
To use this option please first [enroll the application on HES](/user-guide/android-guide/software-key-enrollment/sso-enrollment).
And then if your administrator enabled passwordless login, please, follow [this](/user-guide/android-guide/login-with-hideez-authenticator/sso-login/sso-passwordless-login) guide. If you will use Hideez Authenticator as a second factor, please, follow [this](/user-guide/android-guide/login-with-hideez-authenticator/sso-login/sso-login-as-a-second-factor) guide.
# SSO passwordless login
1. [Enroll the software key on HES](/user-guide/android-guide/software-key-enrollment/sso-enrollment).
2. Click on the web browser the "Sign in with a Hideez Authenticator" button.\
\
3. Open Hideez Authenticator App and scan the QR code.\
\
 
4. Confirm the login at the Hideez Authenticator.\
\
{% hint style="success" %}
Also, for some devices it is possible to scan the code directly from the smartphone camera, this will redirect you to Hideez Authenticator.
{% endhint %}
# SSO login as a second factor
1. [Enroll the software key on HES](/user-guide/android-guide/software-key-enrollment/sso-enrollment).
2. Type your email and click the "Next" button.\
\
3. Type your password and click the "Next" button.\
\
4. Click the "Hideez Authenticator" button.\
\
5. Open Hideez Authenticator App and scan the QR code.\
\
 
6. Confirm the login at the Hideez Authenticator.\
\
{% hint style="success" %}
Also, for some devices it is possible to scan the code directly from the smartphone camera, this will redirect you to Hideez Authenticator.
{% endhint %}
# PC login
{% hint style="info" %}
**The application also supports multi-accounts, allowing you to add multiple accounts for users registered on the Hideez Enterprise Server within a single domain, as well as accounts from different Hideez servers in various domains. This means you can also unlock workstations connected to different servers.**
{% endhint %}
After [setting up login via mobile phone](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment), the QR code will be displayed in the Hideez credentials provider. Scan it with the Hideez Mobile Authenticator, confirm the login on your phone, and then the computer will be unlocked.
Some phones may open the Hideez Mobile Authenticator app automatically if you scan the QR code using the phone's camera app system. This can speed up the process of logging on to the computer.
In the '**Profile > Accounts > Workstations**' section you can see the list of the unlock accounts. [Password-based](/user-guide/android-guide/login-with-hideez-authenticator/pc-login/password-based-pc-login) credentials are marked with the  badge.
# Passwordless PC login
1. [Enroll the software key in the Hideez Client](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-passwordless-pc-authorization).
2. Choose the "Hideez Key" user on the lock screen.\
\
3. Open Hideez Authenticator App and scan the QR code from the lock screen.\
\
\
\
4. Confirm the login at the Hideez Authenticator.\
1 - workstation name, 2 - account name.\
\
{% hint style="success" %}
Also, for some devices it is possible to scan the code directly from the smartphone camera, this will redirect you to Hideez Authenticator.
{% endhint %}
In the [following article](/user-guide/android-guide/login-with-hideez-authenticator/pc-login/passwordless-pc-login/offline-passwordless-login), you can find the guide on logging in if you have no internet connection.
# Offline passwordless login
To login into the PC without an Internet connection, you need to [set up passwordless authorization](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-passwordless-pc-authorization) and then log in once in [online mode](/user-guide/android-guide/login-with-hideez-authenticator/pc-login/passwordless-pc-login) and then use offline codes.
#### To generate offline code you need to:
1. Go to the "Accounts" section.\
\
2. Tap the "Workstation" button.\
\
3. Tap the desired workstation in the list.\
\
4. Tap the "Show offline code" button.\
\
 
{% hint style="info" %}
Please, note that you will only have 50 authentication codes. When there are less than 46 codes left, they will be restored after online login.\
You can see the number of codes left above the "Show offline code" button.
{% endhint %}
#### To log in with the authentication code you need to:
1. Click the "Unlock with one-time code" button on the Windows lock screen.\
\
2. Input the code into the "Offline Logon Code" field and then press Enter.\
\
{% hint style="info" %}
**Note:** The login process may take some time up to a few seconds.
{% endhint %}
# Password-based PC login
1. [Enroll the software key in the Hideez Client](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-password-based-pc-authorization).
2. Assure that in the Hideez Client settings in the "General" section "Always show authorization QR on logon screen" parameter is enabled.\
\
3. Choose the "Hideez Key" user on the lock screen.\
\
4. Open Hideez Authenticator App and scan the QR code from the lock screen.\
\
\
\
5. Confirm the login at the Hideez Authenticator.\
1 - workstation name, 2 - account name.\
\
{% hint style="success" %}
Also, for some devices it is possible to scan the code directly from the smartphone camera, this will redirect you to Hideez Authenticator.
{% endhint %}
# Login to the remote PC via RDP
To sign in to the RDP session with Hideez Authenticator, please, follow these steps:
1. Enroll the login account with the credentials from the remote PC on the host PC. Both options are available - [passwordless](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-passwordless-pc-authorization) and [password-based](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-password-based-pc-authorization). If you want to log in with passwordless credentials, please, ensure that the host PC has a TPM (however, a remote PC can have no TPM).
2. Open the Windows RDP client and specify the remote computer address.\
\
3. Click "Connect", then click the “More choices” button.\
\
4. Choose the “Hideez Key” option.\
\
5. Click the “Show QR code” button.\
\
6. QR code appeared.\
\
7. Open Hideez Authenticator App and scan this QR code.\
\
8. Confirm the login at the Hideez Authenticator: 1 - workstation name, 2 - account name. The workstation name should match the name of the host PC.\
\
{% hint style="success" %}
Also, for some devices it is possible to scan the code directly from the smartphone camera, this will redirect you to Hideez Authenticator.
{% endhint %}
# Proximity Login/Lock Using Bluetooth
### How It Works
* Approach the workstation.
* Open the **Hideez Authenticator** app on your Android device.
* Find your workstation in the list and open it.
* Tap **“Unlock Workstation”** → you will be logged into Windows.
### Proximity Lock
* The workstation will **lock automatically** when:
* You move out of Bluetooth range, or
* You switch off Bluetooth on your phone.
{% hint style="info" %}
**Note:** The lock distance may vary depending on the environment, your phone’s Bluetooth hardware, and the workstation’s Bluetooth adapter.
{% endhint %}
# PC lock
Starting from version 1.2.9 you also can block your Windows account if you [enrolled your Authenticator for PC login](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment).
Just go to the account that you signed in to and tap the "Lock Workstation" button. The workstation will be locked.
That is what this button looks like for passwordless accounts:
That is what this button looks like for password-based accounts:
{% hint style="warning" %}
Please, note: [the roaming feature](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-password-based-pc-authorization/account-roaming) applies ONLY to unlocking. You can lock only that workstation on which the Authenticator was enrolled.
{% endhint %}
# OTP generation
Hideez Authenticator allows users to generate One-Time Passwords for [a Two-Factor Authentication](https://fidoalliance.org/specs/u2f-specs-master/fido-u2f-overview.html) mechanism.
To use the OTP generation feature first you have to [enroll your Hideez Authenticator on HES](/user-guide/android-guide/software-key-enrollment/sso-enrollment).
### Add OTP account
You can add an OTP secret either by scanning a QR code or manually.
1. Open the "Accounts" section.\
\
2. Tap the "+" button.\
\
#### Scan a QR code
1. Scan a QR code from the setup page of your account provider (for example, Google 2FA).\
\
#### Add secret manually
1. Tap the "Add manually" button.\
\
2. Type the account name and secret key in the corresponding fields.\
\
3. You also can provide advanced parameters such as an OTP length, Hash Algorithm, and valid period. Just switch the "Advanced options" trigger to set them up.\
\
\
\
4. Tap the "Add" button.\
\
And there you have it - OTP password generated automatically, you can now confirm it in your service account (for example, Google) and use it for subsequent authorizations.\
\
The validity timer of the OTP code is displayed next to the code.\
\
### Copy OTP
To copy OTP just tap the OTP code.
### Edit OTP account
1. To edit the OTP account title or name just tap its name and the edit menu will open.\
\
2. Make all changes needed and then tap the "Save" button.\
\
### Delete OTP account
1. To delete the OTP account [open the edit menu](#edit-otp-account).
2. Then tap the "Delete" button.\
\
3. Confirm operation.\
\
# Software key disabling
This section describes how to disable the Hideez Authenticator for the next options:
* [Windows PC login](/user-guide/android-guide/software-key-disabling/pc-login-disabling)
* [HES SSO login](/user-guide/android-guide/software-key-disabling/sso-login-disabling)
# PC login disabling
1. Go to the "Accounts" section and tap the "Workstations" at the Hideez Authenticator.\
\
2. Select the needed workstation from the list.\
1 - workstation name, 2 - account name.\
\
3. Tap the basket icon.\
\
4. Confirm action.\
\
# SSO login disabling
{% hint style="danger" %}
If you want to use Hideez Authenticator again, you have to [set up the key from the beginning](/user-guide/android-guide/mobile-app-primary-setup).
{% endhint %}
1. Open your HES and go to the "Profile" section.\ \
2. Go to the "Hideez Authenticator" section and click the "Delete" button near the mobile device you want to disable.\
\
3. Confirm disabling.\
\
4. Then you have to wipe the key at the mobile authenticator. Go to the "Profile" section and tap the "Exit - Erase all data" button.\
\
5. Confirm wipe.\
\
# Service operations
In the **"Profile"** section, you can perform the following service operations:
## Change PIN
To change your PIN in **Hideez Authenticator**, follow these steps:
1. Open the **"Profile"** section and click **"Change PIN"**.
2. Enter your current PIN.
{% hint style="info" %}
* You have **three attempts** to enter the current PIN.
* If you enter the incorrect PIN three times, you will not be able to change it until you successfully authenticate using the correct current PIN.
* PIN change is only possible **after entering the current PIN**, even if biometric login is enabled.
{% endhint %}
3. Set a new PIN and confirm it.
{% hint style="info" %}
**Note:** Remember your new PIN! If you forget it, you will need to delete the key and register it again.
{% endhint %}
{% hint style="warning" %}
**Restrictions:**
* You have **10 attempts** to enter your PIN.
* After **5 unsuccessful attempts**, each subsequent attempt can only be made after **3 minutes**.
* If you enter the wrong PIN 5 more times after that, all data in the app will be erased, and you will no longer be able to use your accounts for authentication.
{% endhint %}
## Enable Biometric Authentication
You can enable biometric authentication alongside your PIN to access your authentication accounts.
1. Open the **"Profile"** section.
2. Enable biometrics by toggling the switch.
3. Scan your fingerprint using the fingerprint scanner.
Once enabled, biometrics can be used to log in to the app without entering your PIN.
{% hint style="info" %}
**Note:** You can disable biometrics and use only your PIN. However, this **reduces security**, and we do not recommend it.
{% endhint %}
## Interface Language
You can choose from the available interface languages:
* **English**
* **Ukrainian**
## Quick Guide
This section provides an overview of the app's key features.
## Help
In this section, you will find:
* Links to documentation with a complete list of app features.
* An option to submit a support request to our team.
## About the App
Here, you can request a **trial version** of the software.
## Submit a Report
If necessary, you can send a report to improve the product or investigate a specific issue.
{% hint style="info" %}
**Note:** Log files containing event records do not store or collect personal information.
{% endhint %}
## Data Erasure
You can erase all data from the app:
1. Tap **"Log Out"** and select **"Erase All Data"**.
2. Alternatively, tap **"Log Out"** on the login screen and confirm your action.
{% hint style="warning" %}
**Attention**: After you erase all data in the application, you will no longer be able to:
* Use your account to log in to the server.
* Generate OTP passwords.
* Unlock your workstation.
{% endhint %}
# iOS guide
This section describes the full list of Hideez Authenticator iOS app functions:
* [SSO login](/user-guide/ios-guide/login-with-hideez-authenticator/sso-login)
* [PC login](/user-guide/ios-guide/login-with-hideez-authenticator/pc-login)
* [PC lock](/user-guide/ios-guide/pc-lock)
* [OTP generation](/user-guide/ios-guide/otp-generation)
To use them first you have to set up the Authenticator via [this](/user-guide/ios-guide/mobile-app-primary-setup) guide.
# Mobile App Primary Setup
1. Open Hideez Authenticator. Tap "Next".\
\
\
\
\
\
\
\
2. Set and confirm the PIN code.\
\
\
\
3. For best security, it is highly recommended to use Biometric login.\
\
\
\
4. Now you can move to the [application enrollment on the Hideez Enterprise Server](/user-guide/android-guide/software-key-enrollment/sso-enrollment/sso-enrollment-admin-account).
{% hint style="warning" %}
Biometric login will be available **only** after biometric setup in the iPhone settings.
{% endhint %}
# Software key enrollment
To use the Hideez Authenticator you have to first [enroll the application on HES](/user-guide/ios-guide/software-key-enrollment/sso-enrollment).
Then [enroll the Hideez Authenticator in Hideez Client](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment) if you want to use it for [PC login](/user-guide/ios-guide/login-with-hideez-authenticator/pc-login).
# SSO enrollment
To use Hideez Authenticator first you have to enroll the mobile app on Hideez Enterprise Server (HES).
* [Administrator account enrollment](/user-guide/ios-guide/software-key-enrollment/sso-enrollment/sso-enrollment-admin-account)
* [User account enrollment](/user-guide/ios-guide/software-key-enrollment/sso-enrollment/sso-enrollment-user-account)
# SSO enrollment (admin account)
There are 2 options for HES accounts:
1. Register app for [two-factor authentication](/user-guide/ios-guide/login-with-hideez-authenticator/sso-login/sso-login-as-a-second-factor).
2. [Passwordless authentication](/user-guide/ios-guide/login-with-hideez-authenticator/sso-login/sso-passwordless-login) with Hideez Authenticator.
For admin account enrollment is the same for both options.
### Enabling two-factor authentication
#### Enabling the second factor for the admin account
To enable login with Hideez Authenticator as a second factor for the user account, please, follow this [guide](https://enterprise.hideez.com/hideez-enterprise-server/administration/how-to-enable-two-factor-authentication-at-hideez-enterprise-server).
#### Enabling the second factor for the user account
To enable login with Hideez Authenticator as a second factor for the user account, please, follow this [guide](https://enterprise.hideez.com/hideez-enterprise-server/single-sign-on-settings/nastroika-polzovatelei).
### Hideez Authenticator enrollment
To use Hideez Authenticator first you need to enroll the mobile app on Hideez Enterprise Server (HES). To do this, follow simple steps:
1. Open your HES and go to the "Profile" section.\ \
2. Go to the "Mobile App" section and click the "Register Hideez Authenticator" button.\
\
\
\
Here you can download Hideez Authenticator for your OS from Google Play or App Store via corresponding links.
3. Open Hideez Authenticator and scan the QR code on HES.\
\
4. Confirm SSO enrollment on Hideez Authenticator.\
\
5. That is all set. Now you can [log in on HES](/user-guide/ios-guide/login-with-hideez-authenticator/sso-login/sso-passwordless-login) with the Hideez Authenticator.\
\
# SSO enrollment (user account)
{% hint style="info" %}
Please, first ensure that your HES administrator [enabled the SSO option for your user](/primary-setup-admin-guide/sso-configuration).
{% endhint %}
There are 2 options for HES user accounts:
1. Register app for [two-factor authentication](/user-guide/ios-guide/login-with-hideez-authenticator/sso-login/sso-login-as-a-second-factor).
2. [Passwordless authentication](/user-guide/ios-guide/login-with-hideez-authenticator/sso-login/sso-passwordless-login) with Hideez Authenticator.
If your administrator [enabled the second-factor requirement](/user-guide/ios-guide/software-key-enrollment/sso-enrollment/sso-enrollment-admin-account#enabling-second-factor-for-user-account), you have to follow the [first](#enrollment-as-second-factor) part of this instruction, otherwise - the [second](#enrollment-for-passwordless-login) one.
### Enrollment as the second factor
1. Open the email from the HES in your mailbox and follow the link in it.
2. Follow the screen guide and set the password.\
\
\
\
3. Then click the "Use Hideez Authenticator" button.\
\
4. Here you can download Hideez Authenticator for your OS from Google Play or App Store via corresponding links.\
\
5. Open Hideez Authenticator and scan the QR code on HES.\
\
6. Confirm SSO enrollment on Hideez Authenticator.\
\
7. That is all set. Now you can log in with the Hideez Authenticator as a second factor.
### Enrollment for passwordless login
1. Open the email from the HES in your mailbox and follow the link in it.\
\
2. Then click the "Use Hideez Authenticator" button.\
\
3. Here you can download Hideez Authenticator for your OS from Google Play or App Store via corresponding links.\
\
4. Open Hideez Authenticator and scan the QR code on HES.\
\
5. Confirm SSO enrollment on Hideez Authenticator.\
\
#### If you already registered a security key for SSO, you can register mobile app by following these steps:
1. Go to the "Hideez Authenticator" section and click the "Register Hideez Authenticator" button.
\
\
Here you can download Hideez Authenticator for your OS from Google Play or App Store via corresponding links.\
\
2. Open Hideez Authenticator and scan the QR code on HES.\
\
3. Confirm SSO enrollment on Hideez Authenticator.\
\
4. That is all set. Now you can log in with the Hideez Authenticator.
# PC Authorization Enrollment
Before you will enroll the Hideez Authenticator for PC login please ensure that you have followed the steps for [application enrollment on HES](/user-guide/ios-guide/software-key-enrollment/sso-enrollment).
# Enrollment for Passwordless PC Authorization
1. [An enterprise version](https://update.hideez.com/update/hideezclient/clientsetup.exe) of the client must be installed on the computer. Ensure that:
* [The Client is connected to the HES](https://enterprise.hideez.com/hideez-client-app/application-interface/general-settings), [the workstation is approved](https://enterprise.hideez.com/hideez-enterprise-server/workstations/workstations-management).
* You are signed into the Windows domain account.
* The workstation has TPM 2.0 module.
{% hint style="warning" %}
**Please note, that for Passwordless PC Authorization Administrator has to configure:**
* [**Configuring an Active Directory Certification Authority**](/primary-setup-admin-guide/configuring-an-active-directory-certification-authority)
* [**HES setup for passwordless login**](/primary-setup-admin-guide/server-setup-for-passwordless-login)
{% endhint %}
2. Input the HES address in the Settings section.\
\
3. Go to the Mobile Authenticator section and click the "Setup" button under the Passwordless Authenticator subsection.\
\
4. Open the Scanner section at the Hideez Authenticator and scan the QR code from Hideez Client.\
\
\
\
Also, you can open this scanner from the "Profile > Workstation" section.\
\
\
\
In this case, scanner will look like this:\
\
\
\
5. Confirm enrollment on Hideez Authenticator.\
\
\
\
Enrolling will start.\
\
 \
6. That is all set.\
\
\
\
Now you can find information about unlock account in the "Accounts > Workstations" section at the Hideez Authenticator. Also here you can [delete unlock the account](/user-guide/ios-guide/software-key-disabling/pc-login-disabling) or add a new one.\
\
\
\
In the [next article](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-passwordless-pc-authorization/passwordless-account-re-enrollment), you can find the guide on how to re-enroll Hideez Authenticator if the validity period of the certificate for passwordless enrollment is over.
# Passwordless account re-enrollment
Certificates are created in AD for passwordless login. The default validity period for this certificate is 1 year. When the validity period ends, Hideez Client will notify you. Then you will have to re-enroll the certificate for passwordless login for further use. The procedure is the same as enrollment:
1. Open previously installed [Hideez Client](https://update.hideez.com/update/hideezclient/clientsetup.exe).
2. Go to the Mobile Authenticator section and click the "Setup" button under the Passwordless Authenticator subsection.\
\
3. Open the Scanner section at the Hideez Authenticator and scan the QR code from Hideez Client.\
\
4. Confirm the re-enrollment in the Authenticator:\
\
5. That is all set. Now the certificate validity period is reset and you can use Authenticator again.
{% hint style="info" %}
You can preventively re-enroll the certificate even if the validity period is not over yet.
{% endhint %}
# Enrollment for Password-based PC Authorization
1. [An enterprise version](https://update.hideez.com/update/hideezclient/clientsetup.exe) of the client must be installed on the computer. Ensure that:
* [The Client is connected to the HES](https://enterprise.hideez.com/hideez-client-app/application-interface/general-settings), [the workstation is approved](https://enterprise.hideez.com/hideez-enterprise-server/workstations/workstations-management).
2. Input the HES address in the Settings section.\
\
3. Go to the Mobile Authenticator section and click the "Setup" button under the Password-based Authenticator subsection.\
\
4. Open the Scanner section at the Hideez Authenticator and scan the QR code from Hideez Client.\
\
\
\
Also, you can open this scanner from the "Profile > Workstation" section.\
\
\
\
In this case, the scanner will look like this:\
\
\
\
5. Confirm enrollment on Hideez Authenticator. Select the account type (Local/Domain/Microsoft/AzureAD) and fill in all the fields. Then tap the "Save" button.\
\
 \
\
 
6. That is all set.\
\
Now you can find information about unlock account in the "Accounts > Workstations" section at the Hideez Authenticator. Also here you can [delete unlock the account](/user-guide/ios-guide/software-key-disabling/pc-login-disabling) or add a new one.\
\
\
\
In the [next article](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-password-based-pc-authorization/account-roaming), you can find the guide on how to use one password-based unlock account for any PC.
# Account roaming
If you use the same account on different workstations, you can enroll it on one workstation and use it for all computers with this account.
Don't forget to install Hideez Client on all PC and [connect it to the HES](https://enterprise.hideez.com/hideez-client-app/application-interface/general-settings).
In the Authenticator you have to switch the "Roaming Account" option when you [enroll password-based unlock account](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-password-based-pc-authorization) or you can edit this option in the account settings after creation:
 
{% hint style="warning" %}
Please, note: the roaming feature applies ONLY to the unlocking feature with password-based accounts. You can [lock](/user-guide/ios-guide/pc-lock) only that workstation on which the Authenticator was enrolled.
{% endhint %}
# Login with Hideez Authenticator
This section describes how to log in with the Hideez Authenticator:
* [on HES to use the SSO option](/user-guide/ios-guide/login-with-hideez-authenticator/sso-login)
* [into the Windows PC user account](/user-guide/ios-guide/login-with-hideez-authenticator/pc-login)
# SSO login
{% hint style="info" %}
**The application also supports multi-accounts, allowing you to add multiple accounts for users registered on the Hideez Enterprise Server within a single domain, as well as accounts from different Hideez servers in various domains. This is particularly convenient if you have multiple Hideez servers or multiple accounts on one server.**
{% endhint %}
To use this option please first [enroll the application on HES](/user-guide/ios-guide/software-key-enrollment/sso-enrollment).
And then if your administrator enabled passwordless login, please, follow [this](/user-guide/ios-guide/login-with-hideez-authenticator/sso-login/sso-passwordless-login) guide. If you will use Hideez Authenticator as a second factor, please, follow [this](/user-guide/ios-guide/login-with-hideez-authenticator/sso-login/sso-login-as-a-second-factor) guide.
# SSO passwordless login
1. [Enroll the software key on HES](/user-guide/ios-guide/software-key-enrollment/sso-enrollment).
2. Click on the web browser the "Sign in with a Hideez Authenticator App" button.\
\
3. Open Hideez Authenticator App and scan the QR code.\
\
\
\
4. Confirm the login at the Hideez Authenticator.\
\
{% hint style="success" %}
Also, for some devices it is possible to scan the code directly from the smartphone camera, this will redirect you to Hideez Authenticator.
{% endhint %}
# SSO login as a second factor
1. [Enroll the software key on HES](/user-guide/ios-guide/software-key-enrollment/sso-enrollment).
2. Type your email and click the "Next" button.\
\
3. Type your password and click the "Next" button.\
\
4. Click the "Hideez Authenticator" button.\
\
5. Open Hideez Authenticator App and scan the QR code.\
\
\
\
6. Confirm the login at the Hideez Authenticator.\
\
{% hint style="success" %}
Also, for some devices it is possible to scan the code directly from the smartphone camera, this will redirect you to Hideez Authenticator.
{% endhint %}
# PC login
{% hint style="info" %}
**The application also supports multi-accounts, allowing you to add multiple accounts for users registered on the Hideez Enterprise Server within a single domain, as well as accounts from different Hideez servers in various domains. This means you can also unlock workstations connected to different servers.**
{% endhint %}
After [setting up login via mobile phone](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment), the QR code will be displayed in the Hideez credentials provider. Scan it with the Hideez Mobile Authenticator, confirm the login on your phone, and then the computer will be unlocked.
Some phones may open the Hideez Mobile Authenticator app automatically if you scan the QR code using the phone's camera app system. This can speed up the process of logging on to the computer.
In the '**Profile > Accounts > Workstations**' section you can see the list of the unlock accounts. [Password-based](/user-guide/ios-guide/login-with-hideez-authenticator/pc-login/password-based-pc-login) credentials are marked with the  badge.
# Passwordless PC login
1. [Enroll the software key in the Hideez Client](/user-guide/android-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-passwordless-pc-authorization).
2. Choose the "Hideez Key" user on the lock screen.\
\
3. Open Hideez Authenticator App and scan the QR code from the lock screen.\
\
\
\
4. Confirm the login at the Hideez Authenticator.\
1 - workstation name, 2 - account name.\
\
{% hint style="success" %}
Also, for some devices it is possible to scan the code directly from the smartphone camera, this will redirect you to Hideez Authenticator.
{% endhint %}
In the [following article](/user-guide/ios-guide/login-with-hideez-authenticator/pc-login/passwordless-pc-login/offline-passwordless-login), you can find the guide on logging in if you have no internet connection.
# Offline passwordless login
To login into the PC without an Internet connection, you need to [set up passwordless authorization](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-passwordless-pc-authorization) and then log in once in [online mode](/user-guide/ios-guide/login-with-hideez-authenticator/pc-login/passwordless-pc-login) and then use offline codes.
#### To generate offline code you need to:
1. Go to the "Accounts" section.\
\
2. Tap the "Workstation" button.\
\
3. Tap the desired workstation in the list.\
\
4. Tap the "Show offline code" button.\
\
 
{% hint style="info" %}
Please, note that you will only have 50 authentication codes. When there are less than 46 codes left, they will be restored after online login.\
You can see the number of codes left above the "Show offline code" button.
{% endhint %}
#### To log in with the authentication code you need to:
1. Click the "Unlock with one-time code" button on the Windows lock screen.\
\
2. Input the code into the "Offline Logon Code" field and then press Enter.\
\
{% hint style="info" %}
**Note:** The login process may take some time up to a few seconds.
{% endhint %}
# Password-based PC login
1. [Enroll the software key in the Hideez Client](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-password-based-pc-authorization).
2. Assure that in the Hideez Client settings in the "General" section "Always show authorization QR on logon screen" parameter is enabled.\
\
3. Choose the "Hideez Key" user on the lock screen.\
\
4. Open Hideez Authenticator App and scan the QR code from the lock screen.\
\
\
\
5. Confirm the login at the Hideez Authenticator.\
1 - workstation name, 2 - account name.\
\
{% hint style="success" %}
Also, for some devices it is possible to scan the code directly from the smartphone camera, this will redirect you to Hideez Authenticator.
{% endhint %}
# Login to the remote PC via RDP
To sign in to the RDP session with Hideez Authenticator, please, follow these steps:
1. Enroll the login account with the credentials from the remote PC on the host PC. Both options are available - [passwordless](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-passwordless-pc-authorization) and [password-based](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-password-based-pc-authorization). If you want to log in with passwordless credentials, please, ensure that the host PC has a TPM (however, a remote PC can have no TPM).
2. Open the Windows RDP client and specify the remote computer address.\
\
3. Click "Connect", then click the “More choices” button.\
\
4. Choose the “Hideez Key” option.\
\
5. Click the “Show QR code” button.\
\
6. QR code appeared.\
\
7. Open Hideez Authenticator App and scan this QR code.\
\
8. Confirm the login at the Hideez Authenticator: 1 - workstation name, 2 - account name. The workstation name should match the name of the host PC.\
\
{% hint style="success" %}
Also, for some devices it is possible to scan the code directly from the smartphone camera, this will redirect you to Hideez Authenticator.
{% endhint %}
# Proximity Login/Lock Using Bluetooth
### How It Works
* Approach the workstation.
* Open the **Hideez Authenticator** app on your iOS device.
* Find your workstation in the list and open it.
* Tap **“Unlock Workstation”** → you will be logged into Windows.
### Proximity Lock
* The workstation will **lock automatically** when:
* You move out of Bluetooth range, or
* You switch off Bluetooth on your phone.
{% hint style="info" %}
**Note:** The lock distance may vary depending on the environment, your phone’s Bluetooth hardware, and the workstation’s Bluetooth adapter.
{% endhint %}
# PC lock
Starting from version 1.2.9 you also can block your Windows account if you [enrolled your Authenticator for PC login](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment).
Just go to the account that you signed in to and tap the "Lock Workstation" button. The workstation will be locked.
That is what this button looks like for passwordless accounts:
That is what this button looks like for password-based accounts:
{% hint style="warning" %}
Please, note: [the roaming feature](/user-guide/ios-guide/software-key-enrollment/pc-authorization-enrollment/enrollment-for-password-based-pc-authorization/account-roaming) applies ONLY to unlocking. You can lock only that workstation on which the Authenticator was enrolled.
{% endhint %}
# OTP generation
Hideez Authenticator allows user to generate One-Time Passwords for [a Two-Factor Authentication](https://fidoalliance.org/specs/u2f-specs-master/fido-u2f-overview.html) mechanism.
To use the the OTP generation feature first you have to [enroll your Hideez Authenticator on HES](/user-guide/ios-guide/software-key-enrollment/sso-enrollment).
### Add OTP account
You can add an OTP secret either by scanning a QR code or manually.
1. Open the "Accounts" section.\
\
2. Tap the "+" button.\
\
#### Scan a QR code
1. Scan a QR code from the setup page of your account provider (for example, Google 2FA).\
\
#### Add secret manually
1. Tap the "Add manually" button.\
\
2. Type the account name and secret key in the corresponding fields.\
\
3. You also can provide advanced parameters such as an OTP length, Hash Algorithm, and valid period. Just switch the "Advanced options" trigger to set them up.\
\
\
\
4. Tap the "Add" button.\
\
And there you have it - OTP password generated automatically, you can now confirm it in your service account (for example, Google) and use it for subsequent authorizations.\
\
The validity timer of the OTP code is displayed next to the code.\
\
### Copy OTP
To copy OTP just tap the OTP code.
### Edit OTP account
1. To edit the OTP account title or name just tap its name and the edit menu will open.\
\
2. Make all changes needed and then tap the "Save" button.\
\
### Delete OTP account
1. To delete the OTP account [open the edit menu](#edit-otp-account).
2. Then tap the "Delete" button.\
\
3. Confirm operation.\
\
# Software key disabling
This section describes how to disable the Hideez Authenticator for the next options:
* [Windows PC logon](/user-guide/ios-guide/software-key-disabling/pc-login-disabling)
* [HES SSO login](/user-guide/ios-guide/software-key-disabling/sso-login-disabling)
# PC login disabling
1. Go to the "Accounts" section and tap the "Workstations" at the Hideez Authenticator.\
\
2. Select the needed workstation from the list.\
1 - workstation name, 2 - account name.\
\
3. Tap the basket icon.\
\
4. Confirm action.\
\
# SSO login disabling
{% hint style="danger" %}
If you want to use Hideez Authenticator again, you have to [set up the key from the beginning](/user-guide/android-guide/mobile-app-primary-setup).
{% endhint %}
1. Open your HES and go to the "Profile" section.\ \
2. Go to the "Hideez Authenticator" section and click the "Delete" button near the mobile device you want to disable.\
\
3. Confirm disabling.\
\
4. Then you have to wipe the key at the mobile authenticator. Go to the "Profile" section and tap the "Exit - Erase all data" button.\
\
5. Confirm wipe.\
\
# Service operations
In the **"Profile"** section, you can perform the following service operations:
## Change PIN
To change your PIN in **Hideez Authenticator**, follow these steps:
1. Open the **"Profile"** section and click **"Change PIN"**.
2. Enter your current PIN.
{% hint style="info" %}
* You have **three attempts** to enter the current PIN.
* If you enter the incorrect PIN three times, you will not be able to change it until you successfully authenticate using the correct current PIN.
* PIN change is only possible **after entering the current PIN**, even if biometric login is enabled.
{% endhint %}
3. Set a new PIN and confirm it.
{% hint style="info" %}
**Note:** Remember your new PIN! If you forget it, you will need to delete the key and register it again.
{% endhint %}
{% hint style="warning" %}
**Restrictions:**
* You have **10 attempts** to enter your PIN.
* After **5 unsuccessful attempts**, each subsequent attempt can only be made after **3 minutes**.
* If you enter the wrong PIN 5 more times after that, all data in the app will be erased, and you will no longer be able to use your accounts for authentication.
{% endhint %}
## Enable Biometric Authentication
You can enable biometric authentication alongside your PIN to access your authentication accounts.
1. Open the **"Profile"** section.
2. Enable biometrics by toggling the switch.
3. Scan your fingerprint using the fingerprint scanner.
Once enabled, biometrics can be used to log in to the app without entering your PIN.
{% hint style="info" %}
**Note:** You can disable biometrics and use only your PIN. However, this **reduces security**, and we do not recommend it.
{% endhint %}
## Interface Language
You can choose from the available interface languages:
* **English**
* **Ukrainian**
## Quick Guide
This section provides an overview of the app's key features.
## Help
In this section, you will find:
* Links to documentation with a complete list of app features.
* An option to submit a support request to our team.
## About the App
Here, you can request a **trial version** of the software.
## Submit a Report
If necessary, you can send a report to improve the product or investigate a specific issue.
{% hint style="info" %}
**Note:** Log files containing event records do not store or collect personal information.
{% endhint %}
## Data Erasure
You can erase all data from the app:
1. Tap **"Log Out"** and select **"Erase All Data"**.
2. Alternatively, tap **"Log Out"** on the login screen and confirm your action.
{% hint style="warning" %}
**Attention**: After you erase all data in the application, you will no longer be able to:
* Use your account to log in to the server.
* Generate OTP passwords.
* Unlock your workstation.
{% endhint %}
# Troubleshooting
Hideez Authenticator - Troubleshooting
### Issues After Changing Domain
If you have changed the domain of your computer (for example, joined it to Azure AD and then reverted it to an on-premises AD domain) and encounter an error when registering the device in the domain, follow these steps:
1. Run `certmgr.msc` as an administrator on your computer.
2. Navigate to **Trusted Root Certification Authorities → Certificates**.
3. Check for multiple certificates from your domain server. Keep only the root certificate from the Certification Authority, removing any extras.
## **Lack of Connection to the Certification Authority (CA) Role Service**
If you encounter error **`0x800706BA`**, it indicates that the **Certification Authority (CA) server** is unavailable. To resolve this issue, follow these steps:
1. **Check CA Server Availability**
* Ensure the **CA server** is powered on and running properly.
* Verify that there are no network issues preventing access to the server.
2. **Test Connectivity to the CA Server**
* Run the following command in **Command Prompt (cmd)** to check if the CA server is reachable:
```powershell
powershellCopyEditping
```
* If the server is reachable, test connectivity to the **CA RPC service** by running:
```powershell
powershellCopyEditcertutil -ping
```
* If you receive a **timeout or connection error**, there may be firewall rules or network policies blocking access.
3. **Check Windows Firewall & Network Settings**
* Ensure that **RPC (Remote Procedure Call)** and **DCOM** are not blocked by a firewall.
* Open the required ports for CA communication (typically **TCP 135** for RPC).
4. **Restart the CA Service**
* Open **Services (services.msc)** on the CA server.
* Find **Active Directory Certificate Services** and restart it.
* Alternatively, restart the service via PowerShell:
```powershell
powershellCopyEditRestart-Service certsvc
```
5. **Verify CA Role Installation**
* Run the following command to check if the CA role is installed:
```powershell
powershellCopyEditGet-WindowsFeature -Name AD-Certificate
```
* If the CA role is missing, reinstall it using:
```powershell
powershellCopyEditInstall-WindowsFeature -Name AD-Certificate -IncludeManagementTools
```
If the issue persists, check event logs (**Event Viewer > Applications and Services Logs > CertificateServicesClient**) for detailed error messages.
### Login Issues After Registration
If the registration is successful but you cannot log in, run the following command in PowerShell as an administrator:
```plaintext
certutil -pulse
```
### Missing QR Code for Login
If the QR code does not appear on the Windows login screen, check if this option is enabled in **Hideez Client**.
### Connection Issues Between Hideez Authenticator and Hideez Enterprise Server (No Connection to Server)
If you encounter a "No connection to server" or "Operation timeout" issue during Single Sign-On to the web application or unlocking your computer, ensure that the port and server address for Hideez are open to the network where the smartphone with the Hideez Authenticator app is located.
#### **To Check the Connection Between Your Smartphone and Hideez Server, Follow These Steps:**
1. Open a browser on your smartphone (Chrome, Safari, or any other).
2. Enter the address of your Hideez server. This could be the local or public address of the Hideez Enterprise Server.
3. Check the connection status. If the server is available and the configuration is correct, you will see a page confirming access to the server or a prompt for authorization credentials.
### View Installed Smart Cards or Passwordless Unlock Accounts on Your Computer's TPM
To check registered smart cards or passwordless login accounts using PowerShell, execute the following command:
```powershell
Get-CimInstance -ClassName Win32_PnPEntity | Where-Object { $_.DeviceID -like "*smartcardreader*" } | Select-Object DeviceID
```
If your computer has smart cards registered as login methods or accounts for passwordless unlocking via the **Hideez Authenticator** app, the corresponding command or query will return something like this:
### Remove Installed Smart Cards from Your Computer's TPM Module
To remove installed smart cards or passwordless login accounts saved in the TPM 2.0 module on your computer using PowerShell, you can use the following command:
```plaintext
tpmvscmgr destroy /instance
```
The result of the command for removing smart cards or accounts from the TPM module or through the virtual smart card management utility may look something like this:
### Check the Status and Properties of TPM on Your Computer
To check the status and properties of TPM 2.0, you can use the following command in PowerShell:
```plaintext
Get-TPM
```
If the TPM (Trusted Platform Module) on your computer is enabled, the **Get-TPM** command in PowerShell will return information similar to this:
# Help
If you haven't managed to set up Authenticator, please [contact us](https://hideez.com/pages/contact-hideez-support) to get support. Our agent will reply to you with an email within 24 hours.