Skip to main content
OptionTypeAllowed ValuesDefault ValueDescription
DomainStringThe domain of the TruU service, e.g.,: “truuth.com”
IdsDomainLookupStringany valid urlSupplies the url used for the Domain FQDN call. Should contain the domain and end in the form “url.domain”. The idsDomainLookup is used to construct our FQDN service and directly to make the FQDN call.
OAuthClientIdStringUsed to obtain oAuth token. This token will then be submitted as authorization for the asset enrollment
OAuthClientIdNonceStringThe nonce used in the encryption of the client id
OAuthClientSecretNonceStringThe nonce used in the encyrption of the secret
OAuthClientSecretStringUsed to obtain oAuth token. This token will then be submitted as authorization for the asset enrollment
OAuthScopeStringThe scope of what the oAuth token can be used for
UseTruuForRdpBoolean0 or 11This option controls, whether the TruU for RDP is enabled or not. It can be changed in the TruU dektop app context menu.
UseTruuForUacBoolean0 or 11This option controls, whether the TruU for UAC is enabled or not. It can be changed in the TruU dektop app context menu.
TruuForRdpFeatureEnabledBoolean0 or 11If set to 0, the TruU for RDP is completely disabled.
TruuForUacFeatureEnabledBoolean0 or 11If set to 0, the TruU for UAC is completely disabled.
EnableGetStartedNotificationBoolean0 or 10The option controls whether Get Started notification is displayed for non-truu logins when there are no enrollments.
TokenWebRequestTimeoutMsInt325000Timeout for the authentication token request operation
TokenInitialRetryDelayMsInt323000Delay between authentication token retry operations
FirstTokenRequestDelayMsInt32300000Time period before first authentication token get is called
BackgroundTokenRequestDelayMsInt323600000When system fails to get authentication token (even with retries), it will wait this period of time before another GetToken call.
TokenBufferPercentageInt320-10060Percentage of token expiration when the authentication token should be refreshed
EnrollmentTokenRetryAttemptsInt323Getting token retry count
EnableSmartCardDriverLogsBoolean0 or 10When set to 1 all smart card driver messages are logged (>= verbose level). When disabled only Warning and higher levels are logged.
SuppressThreadExceptionsBoolean0 or 11When set to 1 it prevents task’s exception escalation policy (which, by default, terminates the process) from triggering.
InitIntervalMsInt3210000The amount of time to delay before HeartBeat and PolicyCheck starts after the service has started
WaitingIntervalOnPreshoutdownMsInt3215000An information for the system about maximum expected service stopping time.
TimerIntervalLogMsInt32605000Interval for regular system info logging
PolicyCheckIntervalMsInt32300000Interval for regular policy check
HeartbeatIntervalMsInt323600000Time interval for heartbeat when everything works as expected
ShortHeartbeatIntervalMsInt32600000Time interval for heartbeat retry when heartbeat failed or when authentication token is missing.
SendLogsTimeoutMsInt32300000Report to IDS send operation timeout
TaskExecutionIdleTimeoutSecInt3215Timeout for task execution when login application calls to agent service
AboutToExpirePercentInt320-10015Percentage of certificate validity period for a certificate to be renewed before expiration.
CertificateStatusCheckTimeoutMsInt3210000Specifies how often the certificate status should be checked
authAttemptsInt328The number of PIN tries before user must wait for a specified period of time.
timeExpiredFailedAttemptsSecUInt323600If wrong PIN was entered multiple times (authAttempts option), user must wait for this period of time before trying again.
EventLogStopGapSecInt32120When event logs are scanned for security events or system events like Suspend or Resume, events older than this amount of seconds is excluded
TruUAlwaysDefaultCredentialProviderBoolean0 or 101 will force the TruU Credential Provider to show even when there are no users enrolled in TruU on the computer. Enrollment requires connectivity to the domain, so keep this in mind when enabling this feature
PinRecoveryEnrollmentFromLoginScreenBoolean0 or 10When this value is set to 1, the user will see a ‘Forgot PIN’ link enabling the user to enroll from the lock screen.Please note that the PIN recovery actually does a full re-enrollment after user successfully completes an Identity Verification Workflow. As this is a new enrollment, the user must have connectivity to the domain (and the user will have to re-enroll biometrics if they had been setup previously).If you would like to disable this feature, you can set this flag value to 0
FaceBioEnabledBoolean0 or 11If set to 0, face bio is completely disabled
FingerprintBioEnabledBoolean0 or 11If set to 0, fingerprint bio is completey disabled
HideAddUserSigninBoolean0 or 10If set to 1, Add User option on login screen is hidden
HideAddAccountBoolean0 or 10When set to 1, the “Add account” menu item is hidden
alwaysAllowedSignInCPsMultiStringList of CP GUIDsAllowed credential providers for Login screen before any user is enrolled. If empty, all providers are allowed
alwaysAllowedRDPCPsMultiStringList of CP GUIDsAllowed credential providers for RDP before any user is enrolled. If empty, all providers are allowed
alwaysAllowedUACCPsMultiStringList of CP GUIDsAllowed credential providers for UAC before any user is enrolled. If empty, all providers are allowed
enrolledAllowedSignInCPsMultiStringList of CP GUIDsAllowed credential providers for Login screen when any user is enrolled. If empty, all providers are allowed
enrolledAllowedRDPCPsMultiStringList of CP GUIDsAllowed credential providers for RDP when any user is enrolled. If empty, all providers are allowed
enrolledAllowedUACCPsMultiStringList of CP GUIDsAllowed credential providers for UAC when any user is enrolled. If empty, all providers are allowed
ssoWsPortRangePort range to be used for Nitro (SSO)
RequireFido2Boolean0 to 10Setting this flag to 1 will force the FIDO2 security key enrollment during user registration and the FIDO2 key will be used to log into Windows.Please use this value only if your environment is prepared to use FIDO2.
Fido2EnrollmentCompletionTimeoutMsInt3215000The wait period after the FIDO2 enrollment is finished. This is required for the changes to take effect
ShouldForbidExternalCamerasBoolean0 or 10If set to 1, external cameras are not allowed
PrivacyUrlStringany valid urlhttps://truu.ai/privacySpecifies the URL with a policy about how biometrics are used.
MaxFingerprintFailureAttemptsInt324Number of failed fingerprint attempts before falling back to PIN
NumberOfFailedFollowingFingerprintSessionsToBeReportedInt322The number of failed fingerprint session attempts to login in a row (1 failed session means MaxFingerprintFailureAttempts failed attepmts), after which an alert is displayed to the user once succesfuly signed in
NumberOfFailedFingerprintTrackedSessionsToBeReportedInt325The number of failed sessions out of MaxFingerprintTrackedSessions which would cause an alert displayed to the user
MaxFingerprintTrackedSessionsInt3210Maximum number of tracked fingerprint sessions. These tracked sessions are used in combination with NumberOfFailedFingerprintTrackedSessionsToBeReported to evaluate if an alert should be displayed
MaxFaceFailureAttemptsInt3230The number of failed face recognition attempts made by WinBio before the failure is reported to the user
MaxCameraStartupFailuresInt323Camera is started when the face is being enrolled. This is the maximum number of attempts before failure is reported to the user
SwitchFaceToPinTimeoutMsInt3210000The timeout after which face recognition falls back to PIN if no face is recognized
ShouldInsertSmartCardBoolean0 or 10If set to 1, smart cards are used
DisableMaintainFocusBoolean0 or 10If set to 1, keystrokes are not captures for pin entry into login window if not in focus. If set to 0 keystrokes are captured even when window doesn’t have focus
SentryHeartBeatIntervalSecInt3286400Interval for sending heartbeat info to sentry
AuthDeviceProcessingTimeoutMsInt3210000Timeout for Smart Card operability check
UseSecurityKeyForSignInBoolean0 or 10Internal Windows Key
EnableFIDODeviceLogonBoolean0 or 10Internal Windows Key
AppsUseLightThemeInt3210 - Dark Theme, 1 - Light Theme
ReloginWithTruUBoolean0 or 10If set to 1 and user sign’s in to non-truu account, a notification will pop up saying “Lock/unlock with TruU to continue.”
dontdisplaylastusernameBoolean0 or 10This option controls whether the user session will be disconnected (value set to 1) or only locked (value set to 0) after successfull enrollment
Fido2AuthenticationTimeoutMsInt3260000Timeout for user verification during Fido authentication
BioRecognitionTimeoutMsInt32120000Time period after which bio recognition (face and fingerprint) gives up during verification
RemovePreviousNetVersionStringnever, always, nextSessionneverThe installer executables always install new content before removing the previous installation.Applications that are running might be interrupted or crash when older runtimes are removed.To minimize the impact of updating .NET, you can specify when a previous .NET installation should be removed using a registry key. ‘never’ retains previous installations and requires manual intervention to remove previous .NET installations.‘always’ removes previous installations after the new version is installed. This is the default behavior in .NET.‘nextSession’ defers the removal until the next logon session from members in the Administrators group.
DisableUiccIsoReadersBoolean0 or 11Disables sim card readers (Microsoft UICC ISO Reader) if set to 1.
StartLoginAppLinkAppearanceTimeoutMsInt3210000Timeout for the credential provider tile to appear. If it doesn’t appear within the timeout a link with text “Sign-in not appearing? Click here.” will appear
brandingetagStringBranding ETag
NetworkDiagnosticTimeoutMsInt32120000During enrollment when there is a network issue, the enrollment process is restarted. This interval specifies for how long the network issue must last to restart the enrollment
NetworkMonitorIntervalMsInt325000Interval for network diagnostic check
EssMonitoringIntervalMinutesInt325ESS state is checked regularly with the frequency specified by this interval.
ssprUrlStringA Self-Service Password Reset url to be displayed for the user on error screen like “Account locked”, “Password change required”, “Password expired”, …
enrollmentLearnMoreUrlStringIf key is presented and valid url inside -> “Learn more” link to this url is shown on Getting started page
enrollmentLearnMoreParagraphStringText to replace our text on GettingStartedPage - “Enroll in passwordless authentication today…“
enrollmentLearnMoreLabelStringShould replace default “Learn more” text of link on GettingStartedPage. → note: to have shown this link first you need to set reg key enrollmentLearnMoreUrl
enableNewUiBoolean0 or 10New UI for Login switch flag
enableNewAccountProfileUiBoolean0 or 10New UI for Account Profile pages switch flag
MacOS Log Collection after PIN Lockout Modalities