Managing your ControlKey

Back your ControlKey up, change its password, move to a new PC, rotate it, and let more of your PCs command your stations - whichever security mode you use.

The ControlKey page

In the SupportFlow Client, open Options (the gear) and choose ControlKey. Along the top it shows the mode this PC uses - High Security or Medium Security - and below that are three panels:

• Change ControlKey Mode - switch between the two modes (see Switching modes), and choose whether this PC saves your ControlKey.
• Manage ControlKeys - add, remove, revoke, import or export your ControlKeys, create your Recovery Key, and rotate your key.
• Pending Station Authorizations - new stations waiting for you to accept them. While any are waiting, the panel is highlighted with a count, and so is the gear.

With Medium Security, the mode panel along the top also has a Change my ControlKey button at its bottom right (see Changing your ControlKey password).

High Security and Medium Security

Your SupportFlow Client keeps your ControlKey in one of two ways. The first time you sign in on a PC, the Client asks you to create a ControlKey password - that is Medium Security. To choose High Security instead, open Advanced Options in the same window and pick High Security — Use Full ControlKeys. You can switch later from Options (the gear) › ControlKey › Change ControlKey Mode.

With Medium Security, your ControlKey password is as important as the key itself:

• Make it long - a phrase of several words works well - and different from your account password.
• Never share it, and never type it anywhere but the SupportFlow Client.
• Keep a copy somewhere safe - we have no way to recover it. If it is lost, switch to High Security from a PC where you are signed in, or ask your Administrator or a Manager to approve a new key. Otherwise, stations can only be given a new key by resetting the authorization at each one.
• For better security, leave Save ControlKey on this PC unticked. You can change it later under Change ControlKey Mode.

Switching modes

Choose Change ControlKey Mode, pick the other mode and choose Switch. Because it can take a while, the Client first tells you what will happen, with the number of your stations and of the keys you have authorized. Choose Start and a progress window works through it, ticking off each step:

1. A new ControlKey is made - from the ControlKey password you choose (Medium Security), or at random on your PC (High Security).
2. It is registered, and your current key puts it on each of your stations, one at a time.
3. Your PC hands over to the new key, and the old one is retired.
4. Every key you have authorized - your other PCs' own keys, and the people you approved - is re-signed with your new key. Nobody needs to do anything, and nobody loses access.
5. Your old key is removed from each station that has the new one.

• Keep the Client connected until the window says it is done. Stations that are switched off are brought over automatically when they come back online, as long as the Client is running then.
• You can stop at any time. The switch stays in progress: open Change ControlKey Mode again and choose Continue the switch to carry on where it left off.
• Users (rather than Administrators and Managers) receive the new key on their stations from their Administrator's or a Manager's SupportFlow Client. The progress window shows how many stations have it; continue the switch once they all do.
• Your other PCs. A PC of yours that used the same ControlKey - the same ControlKey password, or an imported copy - shows Your ControlKey was changed on another PC the next time you sign in there. Choose Set up this PC: for Medium Security, type your ControlKey password; for High Security, choose Advanced Options, then High Security, and approve the PC from the one that holds your new key. PCs that have keys of their own carry on as they are.

Changing your ControlKey password

With Medium Security, choose Change my ControlKey at the bottom right of the mode panel at the top of the ControlKey page. The Client first tells you what will happen, with the number of your stations, then asks for your new ControlKey password, twice. A new password makes a new ControlKey, so a progress window then works through the same steps as a switch:

1. Your new ControlKey is registered, and your current key puts it on each of your stations, one at a time.
2. Your PC hands over to the new key, and the old one is retired.
3. Every key you have authorized - your other PCs' own keys, and the people you approved - is re-signed with your new key. Nobody needs to do anything, and nobody loses access.
4. Your old key is removed from each station that has the new one.

• Please let it run until it is complete, and keep the Client open and connected. If it is interrupted, nothing is lost: the button then reads Continue changing my ControlKey - choose it to finish. If the Client was restarted in between, it asks for your new ControlKey password again.
• Stations that are switched off get the new key when they come back online, as long as the Client is running then.
• Your other PCs that use your ControlKey password show Your ControlKey was changed on another PC the next time you sign in there. Choose Set up this PC and type your new ControlKey password.
• Endpoint installers named with your organization's code ask our server for the current keys, so they need nothing. An older installer named with your organization's name still names your old key, so get a fresh one afterwards.

Backing up your ControlKey

Why: if your PC breaks or is lost, your stations still trust a key that is gone. With a backup you are working again in minutes; without one, somebody has to approve a new key for you, or visit each station.

• High Security: under Manage ControlKeys, choose Export… beside your ControlKey, pick a passphrase, and save the file somewhere that is not your PC - a USB stick in a drawer, for example. Anyone with the file and the passphrase holds your key, so keep the two apart and both safe.
• Medium Security: your ControlKey password is your backup. There is nothing to export - but keep a copy of the password somewhere safe.
• Administrators and Managers: also create a Recovery Key under Manage ControlKeys, and export it the same way. It is a second key, kept off your PC, that your Client puts on every station for you. If you lose your PC, it lets a replacement PC take over (see below).

Moving to a new PC

• With Medium Security: sign in on the new PC and type your ControlKey password when the Client asks for it - that is all.
• From your backup (High Security): install the SupportFlow Client on the new PC and sign in. In the ControlKey window choose Advanced Options, then Import Full ControlKeys, pick your saved file and type its passphrase. The new PC now holds the same key, and your stations already trust it.
• From your Recovery Key: sign in on the new PC, choose Advanced Options, then Import Full ControlKeys, and pick your Recovery Key file and type its passphrase. Your Recovery Key approves the new PC's key and puts it on each of your stations as it comes online - keep the Client connected. Then, under Manage ControlKeys, revoke the lost PC's key and choose to move what it approved to this PC.

Whichever way you moved, if the old PC was lost or stolen, revoke its key under Manage ControlKeys so nobody can use it if it turns up.

Rotating your ControlKey

Why: rotating replaces your key with a fresh one without losing access to a single station. Do it now and then as good practice, and straight away if you are not sure your key is still only on your PC - for example after a virus scare, or if the PC was shared.

1. Under Manage ControlKeys, choose Rotate…. A new key is made, and your current key puts it on every station as it comes online.
2. Watch the progress on the same page. When every station has the new key, choose Finish rotation. The old key is retired - anything it had approved carries on under the new key.
3. Stations that were switched off are brought over when they next come online. Once none still hold the old key, choose Forget old key.

In Medium Security your key comes from your ControlKey password, so a fresh key means a new password: the button reads Change my ControlKey… and takes you through Changing your ControlKey password. Your stations move to the new key in the same way.

In Low Security Mode SupportFlow keeps the key, and your organization's Administrator renews it from the account page; see Renewing the ControlKey yourself.

Letting more of your PCs command your stations

You can use as many PCs as you like. Each one gets its own key, so you can revoke any of them on its own later.

• Ask from the new PC (High Security): sign in there. In the ControlKey window choose Advanced Options, then High Security — Use Full ControlKeys, and, if you like, say who you are. On your first PC a window asks Do you trust this PC? - check the machine name, the address it asked from and the key, then choose Approve. Your approval is signed by your first PC's key. If you are a User, your Administrator or a Manager is then asked to confirm on their own PC before the new key reaches your stations.
• Ask your Administrator or a Manager: they approve the new PC's key under Manage ControlKeys in their own Client.
• Use Medium Security: type your ControlKey password on each PC - the same key, with nothing to approve.

Now and then, ask your assistant to list your organization's ControlKeys, and revoke any you do not recognise.