> For the complete documentation index, see [llms.txt](https://docs.securepass.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.securepass.me/documentation/admin-user-guide/privileged-access-pam-setup/connecting-target-systems/manage-systems/os-logon.md).

# OS logon

OS Logon puts SECUREpass in front of the operating-system sign-in itself. Instead of a Windows machine checking a local password and letting the user in, a credential provider installed on that machine hands the logon attempt to SECUREpass and enforces the answer — so the factors you require everywhere else apply at the console and remote logon of the machine too.

**Console:** Admin Console → **Manage Resources → Manage Systems → OS Logon**

Each machine is registered individually. SECUREpass identifies it by the machine's own GUID, and every request the credential provider sends is signed with a secret unique to that registration, so a logon decision cannot be forged or replayed from elsewhere.

## The OS Logon list

**Manage Systems** has two tabs. **PAM Systems** holds the targets reached through a brokered privileged session; **OS Logon** holds the machines whose own sign-in SECUREpass protects. They are different things and the tabs do not overlap.

![The OS Logon tab of Manage Systems.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/HZEqanYuxY6zE6Enpybp/assets/01.png)

| Column                   | What it shows                                                                                                                             |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------- |
| System Name              | The name you gave the machine                                                                                                             |
| OS Type                  | Its operating system                                                                                                                      |
| GUID                     | The machine identifier SECUREpass matches logon requests against                                                                          |
| Second Factor            | The additional mode required at sign-in, if one is set                                                                                    |
| Created By / Modified By | Who registered or last changed it, and when                                                                                               |
| Status                   | Whether the registration is active. Switch it off to stop SECUREpass authorising logons on that machine without deleting the registration |
| Actions                  | Edit and delete                                                                                                                           |

## Registering a machine

### 1. Open Add System

Select **+ Add System**.

![The Add System dialog.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/lqp3t028MnYfnh25av8C/assets/02.png)

| Field         | What to enter                                                                                             |
| ------------- | --------------------------------------------------------------------------------------------------------- |
| System Name   | A name for the machine — something you will recognise in the list and in audit records                    |
| OS Type       | The operating system. Windows is the case shown here                                                      |
| GUID          | The machine's own identifier. On Windows, read it from `HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid` |
| First Factor  | Fixed as **Password**, and always required                                                                |
| Second Factor | Optional, and at most one active mode — SMS OTP in this example                                           |
| Description   | Free text. Worth filling in: it is what tells the next administrator why this machine is registered       |

Select **Register**.

### 2. Generate the HMAC secret

The form reopens with two further fields: the registration's **Status**, and the **OS Logon HMAC Secret**.

![Generating the OS Logon HMAC secret.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/vWNLlAgYqN9mpbpFXWHN/assets/03.png)

Select **Generate / Regenerate**, then **Save**.

The secret signs the requests the Windows credential provider sends to AuthPage. It is not stored anywhere you can read it back — the field shows only that one exists. Copy it into the machine's local configuration at the moment you generate it; if you lose it, the only way forward is to generate a new one and update the machine.

### 3. Confirm the registration

The machine appears in the list.

![The system added to the OS Logon list.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/MbZcXM5MAVJaEQzFxMZ0/assets/04.png)

Verify before you rely on it. Attempt a logon on the machine: SECUREpass should challenge for the configured factors and the attempt should appear in the audit log. A credential provider that cannot reach SECUREpass, or that holds the wrong secret, is a problem you want to find on a test machine rather than on a production server.

## Changing or removing a registration

![The edit and delete actions on a row.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/Xnnzo1ldVoVWrgJIi1FQ/assets/05.png)

### Edit

The pencil icon reopens the registration.

![The Edit OS System dialog.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/roTqlENySZvMPKoJa9Lf/assets/06.png)

Every field can be changed, including the second factor and the status. **Generate / Regenerate** issues a new HMAC secret — which immediately invalidates the old one, so the machine stops authenticating until you copy the new secret into its local configuration. Regenerate deliberately, not as a side effect of editing something else.

### Delete

The bin icon removes the registration, after a confirmation.

![The delete confirmation.](https://content.gitbook.com/content/W2srIAMN6RKFwvuEorV5/blobs/mRYJOLlCeRuZh0HFL8G3/assets/07.png)

Deleting does not uninstall anything on the machine. The credential provider is still there and will still try to reach SECUREpass — it simply no longer matches a registration. Where the aim is to suspend a machine temporarily, set its status to inactive instead; where a machine is being decommissioned, remove the credential provider from it as well.