18.1 Account Management

The system administrator has the highest level of privileges and can access all system functions. By creating additional administrator accounts, the system administrator can delegate certain management tasks to other administrators.

Select Tools → Accounts to view administrator information. Here, administrators can add or delete accounts, enable or disable accounts, and change administrator passwords. When creating a new administrator account, clicking Save allows you to continue adding passwords and accounts directly on the Accounts page.

Icon / Button	Action
	Add an administrator account and optionally enter a description.
	Delete an administrator account. The system administrator Admin cannot be deleted.
	Change the login password for an administrator account. The default password is blank.
	Expand additional function options.
Enable	Enable a disabled administrator account.
Disable	Disable an administrator account. The system administrator Admin cannot be disabled.
Move to	Moving administrators can be done in three ways: 1. If a regular administrator A has no sub-administrators, moving A under administrator B will make A a sub-administrator of B. 2. If administrator A has a sub-administrator C, moving C under administrator B will remove C from A's hierarchy and make C a sub-administrator of B. 3. If a regular administrator A has a sub-administrator C, moving C to the entire network will make C a regular administrator, no longer under A.
Importing Accounts	Using a CSV file exported via the Export Account Permissions feature, administrators can import accounts. The import only updates the administrator name, email, and notes; other permissions remain unchanged. Import Options: Update Only Existing Accounts Unchecked (default): Updates email and notes for existing accounts. New accounts are also imported, but all permissions except email and notes are unchecked. Checked: Updates only email and notes for existing accounts. New accounts are not imported. This option is not selected by default. Add Encryption Approver Permissions Unchecked (default): Imported accounts will not change the permissions "Has Encryption Management Rights" or "Login Only as Proxy Administrator." Checked: Imported accounts will have "Has Encryption Management Rights" and "Login Only as Proxy Administrator" enabled during import. The default setting is unchecked.
Copy Permissions To	Select an administrator A and copy their permissions to another administrator B. Administrator B will retain their original permissions while gaining all of administrator A's permissions.
Export Account Permissions	Export the permissions of all current administrators for review. In the exported file, a checked permission is marked with "√", and an unchecked permission is marked with "×". The export also includes notes and email information.

18.1.1 Administrator Password Security Verification

Administrator password security verification enforces password complexity and limits on incorrect attempts to enhance protection against malicious password-cracking attempts. By default, this feature is disabled. The system administrator can enable and configure it by clicking Administrator Password Security Verification in the lower-left corner of the Account Management interface.

Setting	Description
Enable Administrator Password Security Verification	Check this option to activate password security verification; the settings below will take effect only when enabled.
Password Complexity	Configure rules for administrator password complexity.
Password Cannot Be Empty	When checked, administrators with empty passwords will be required to set a non-empty password; otherwise, they cannot log in.
Minimum Password Length	When checked, set the minimum password length. Administrators whose passwords are shorter than this length will be forced to update their password to meet the requirement; otherwise, they cannot log in.
Password Complexity Verification	Check this option to enforce password complexity. If an administrator's password does not meet the complexity requirements when logging in, they will be forced to change it; otherwise, the account cannot access the console.Click the icon to view the detailed complexity requirements.
Incorrect Password Attempts Verification	This setting defines rules for handling the number of incorrect administrator password attempts.
Enable Incorrect Password Attempts Verification	Check this option and configure the time window, maximum allowed incorrect attempts, and account lock duration. If an administrator exceeds the specified number of incorrect password attempts within the set time, the account will be locked. During the lock period, the account cannot log in—even with the correct password.
Timeout Lock	Settings related to automatically locking the administrator console after a period of inactivity.
Lock Console After Inactivity	Check this option and set the idle time limit. Once the console remains idle for the specified duration, it will automatically lock, requiring the administrator password to log back in.This setting also applies when an administrator logs into a proxy console. The console’s timeout lock takes precedence over the proxy console lock settings.
Periodic Password Change	Settings for enforcing a maximum usage period for administrator passwords.
Maximum Password Age (Days)	Check this option and set the maximum number of days a password can be used, defaulting to 30 days. Starting from the configuration date, once the password reaches the specified duration, the administrator must change it.
Password Expiration Reminder (Days)	Check this option and set the reminder period in days, defaulting to 3 days. Once the remaining password validity reaches this period, a reminder will appear daily at 10:00.The reminder period cannot exceed the maximum password age.

When an administrator account is locked after exceeding the allowed number of incorrect password attempts, an audit log is generated and can be viewed in the Audit Console.

18.1.2 Administrator Permissions

Administrator permissions are divided into four main modules: General, Functional Permissions, Management Scope & Object Management, and Encryption Features.

General Permissions:

Administrator Functional Permissions

Object Management:

Encryption Features:

Security Zones

Administrators should assign security permissions based on actual needs and avoid granting unnecessary privileges.