# US 11,443,029 B2 · Password hint policies on a user provided device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,443,029 B2 - Document ID: US11443029B2 - Status: Granted - Kind: B2 - Application number: 15/223,012 - Filed: 2016-07-29 - Published: 2017-09-28 - Granted: 2022-09-13 - Earliest claimed: 2016-03-24 - Assignees: AirWatch LLC - Applicants: Airwatch LLC - Inventors: Rene J. Olivera; Ishan Srivastava; Aditya Prasad - Web page: https://patentgrep.com/patent/US11443029B2 ## CPC - G06F 21/46: by designing passwords or checking the strength of passwords - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/08: Access security - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed are various examples for remotely managing passwords using local security policies. A client device can be enrolled with a management service. The management service then transmits a password policy requiring a password hint to be defined by the user. A management component executed on the client device can then enforce the password policy by requiring a user to define a password hint in order to access enterprise resources. ## Claims ### Claim 1 A non-transitory computer-readable medium embodying a management component executed by a client device, wherein the management component is configured to cause the client device to at least: enroll the client device, through the management component installed on the client device, with a management service; in response to enrollment of the client device with the management service, determine that a local security policy stored by the management component on the client device indicates that a password hint is required to be defined by a user for a local password corresponding to the client device; extract a Windows Relative Identifier (RID) from a Windows Security Identifier (SID) associated with a local user identity of the client device; determine that a registry entry in a system registry of the client device fails to comprise the password hint, the registry entry being based upon the RID; prompt a user to define the password hint associated with the local password corresponding to the client device; and store the password hint in the registry entry on the client device. ### Claim 2 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the management component is further configured to cause the client device to at least identify the registry entry on the client device associated with the password hint by determining a user identifier corresponding to the local user identity of the client device. ### Claim 3 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the management component is further configured to cause the client device to obtain the SID using a Windows application programming interface (API) call to retrieve the SID associated with a currently logged-in user. ### Claim 4 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the management component is executed as a system process to access the registry entry. ### Claim 5 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the local security policy is obtained by the management component from the management service. ### Claim 6 A method comprising: enrolling, by a management component, a client device with a management service, wherein the management component is installed on the client device; in response to enrolling the client device with the management service, determining, by the management component, that a local security policy stored by the management component on the client device indicates that a password hint is required to be defined by a user for a local password corresponding to the client device; extracting, by the management component, a Windows Relative Identifier (RID) from a Windows Security Identifier (SID) associated with a local user identity of the client device; determining, by the management component, that a registry entry in a system registry of the client device fails to comprise the password hint, the registry entry being based upon the RID; prompting, by the management component, a user to define the password hint associated with the local password corresponding to the client device; and storing, by the management component, the password hint in the registry entry. ### Claim 7 (depends on 6) The method of claim 6, further comprising identifying, by the management component, the registry entry on the client device associated with the password hint by determining a user identifier corresponding to the local user identity of the client device. ### Claim 8 (depends on 6) The method of claim 6, wherein the management component is further configured to cause the client device to obtain the SID using a Windows application programming interface (API) call to retrieve the SID associated with a currently logged-in user. ### Claim 9 (depends on 6) The method of claim 6, wherein the management component is executed as a system process to access the registry entry. ### Claim 10 (depends on 6) The method of claim 6, wherein the local security policy is obtained by the management component from the management service. ### Claim 11 A system comprising: a client device; and a management component executable by the client device, wherein the management component causes the client device to at least: enroll a client device, through a management component installed on the client device, with a management service; in response to enrollment of the client device with the management service, determine that a local security policy stored by the management component on the client device indicates that a password hint is required to be defined by a user for a local password corresponding to the client device; extract a Windows Relative Identifier (RID) from a Windows Security Identifier (SID) associated with a local user identity of the client device; determine that a registry entry in a system registry of the client device fails to comprise the password hint, the registry entry being based upon the RID; prompt a user to define the password hint associated with the local password corresponding to the client device; and store the password hint in the registry entry. ### Claim 12 (depends on 11) The system of claim 11, wherein the management component is further configured to cause the client device to at least identify the registry entry on the client device associated with the password hint by determining a user identifier corresponding to the local user identity of the client device. ### Claim 13 (depends on 11) The system of claim 11, wherein the management component is further configured to cause the client device to obtain the SID using a Windows application programming interface (API) call to retrieve the SID associated with a currently logged-in user. ### Claim 14 (depends on 11) The system of claim 11, wherein the local security policy is obtained by the management component from the management service. ### Claim 15 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the management component is further configured to cause the client device to: lock the client device in response to determining that the registry entry fails to comprise the password hint; and unlock the client device in response to the user defining the password hint. ### Claim 16 (depends on 1) The non-transitory computer-readable medium of claim 1, wherein the management component is further configured to cause the client device to store the password hint in the registry entry using a Windows application programming interface (API) to save the password hint to the registry entry. ### Claim 17 (depends on 6) The method of claim 6, further comprising: locking, by the management component, the client device in response to determining that the registry entry fails to comprise the password hint; and unlocking, by the management component, the client device in response to the user defining the password hint. ### Claim 18 (depends on 6) The method of claim 6, wherein the management component is further configured to cause the client device to store the password hint in the registry entry using a Windows application programming interface (API) to save the password hint to the registry entry. ### Claim 19 (depends on 11) The system of claim 11, wherein the management component is further configured to cause the client device to: lock the client device in response to determining that the registry entry fails to comprise the password hint; and unlock the client device in response to the user defining the password hint. ### Claim 20 (depends on 11) The system of claim 11, wherein the management component is further configured to cause the client device to store the password hint in the registry entry using a Windows application programming interface (API) to save the password hint to the registry entry.