> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/server/web-interface/administration/configuration/system-settings.md).

# System settings

Configure global System Settings in Devolutions Server, covering password policy, notifications, ticketing, vault management, and version control behavior.

The ***System settings*** allow the administrators to control many global aspects of the Devolutions Server workspace and manage settings such as ***Password policy***, ***Type availability***, ***Vault permissions***, and more.

## Logs

The ***Logs*** section allows administrators to define the behavior of logs when certain conditions are met, such as when they are opened, closed, or when credentials are viewed. This is also where administrators can determine if and when it is appropriate to automatically mark logs as closed.

<table><thead><tr><th width="300">SETTINGS</th><th>DESCRIPTION</th></tr></thead><tbody><tr><td><strong>Automatic "Mark as Closed" after</strong></td><td>Automatically mark logs as closed after the set number of days, between 1 and 365.</td></tr><tr><td><strong>Created/Modified by user type</strong></td><td>Select <em><strong>Local</strong></em>, <em><strong>Database</strong></em>, or <em><strong>Both</strong></em>.</td></tr><tr><td><strong>Prompt for comment on open</strong></td><td>Prompt users for a comment when they open an entry. When checked, <em><strong>Open comment is required</strong></em> and <em><strong>Ticket number is required</strong></em> make the comment or a ticket number mandatory.</td></tr><tr><td><strong>Prompt for comment on close</strong></td><td>Prompt users for a comment when they close an entry. When checked, <em><strong>Close comment is required</strong></em> and <em><strong>Ticket number is required</strong></em> make the comment or a ticket number mandatory.</td></tr><tr><td><strong>Prompt for comment on credentials viewed</strong></td><td>Prompt users for a comment when they view credentials. When checked, <em><strong>Credentials viewed comment is required</strong></em> and <em><strong>Ticket number is required</strong></em> make the comment or a ticket number mandatory.</td></tr></tbody></table>

## System message

In ***System message***, administrators can set a message to be displayed every time a user connects to the Devolutions Server workspace, or when the message has changed, no matter which method is used (web interface, Remote Desktop Manager).

## Notification

{% hint style="info" %}
Email must be configured in Devolutions Server to enable user subscriptions.
{% endhint %}

<table><thead><tr><th width="250">SETTINGS</th><th>DESCRIPTION</th></tr></thead><tbody><tr><td><strong>Enable user subscriptions</strong></td><td>Enable or disable user subscriptions.</td></tr><tr><td><strong>Available actions</strong></td><td>Determine which actions can be the object of notifications: <em><strong>Deleted</strong></em>, <em><strong>Modified</strong></em>, <em><strong>Password viewed</strong></em>, <em><strong>Password changed</strong></em>, <em><strong>Opened</strong></em>, <em><strong>Closed</strong></em>, <em><strong>Expired</strong></em>, and <em><strong>Expiring</strong></em>. At least one action must be selected when user subscriptions are enabled.</td></tr><tr><td><strong>Notify for expiring entries</strong></td><td>Select when to notify for expiring entries: <em><strong>Never</strong></em>, <em><strong>30 days before expiration</strong></em>, <em><strong>60 days before expiration</strong></em>, <em><strong>90 days before expiration</strong></em>, or <em><strong>Custom</strong></em> to enter a number of days before expiration.</td></tr></tbody></table>

## Secure message

<table><thead><tr><th width="250">SETTINGS</th><th>Description</th></tr></thead><tbody><tr><td><strong>Permission</strong></td><td>Determine whether secure messages can contain attachments or not: <em><strong>Send messages with attachments</strong></em> or <em><strong>Send messages without attachments</strong></em>.</td></tr><tr><td><strong>Devolutions Send region</strong></td><td>Select the Devolutions Send region: <em><strong>Canada (.com)</strong></em> or <em><strong>France (.eu)</strong></em>.</td></tr><tr><td><strong>Enforce passphrase when sending messages</strong></td><td>Require a passphrase when sending secure messages.</td></tr><tr><td><strong>Enable secure message default expiration time</strong></td><td>Enable the <em><strong>Default expiration time</strong></em> setting.</td></tr><tr><td><strong>Default expiration time</strong></td><td>Set a default expiration time in <em><strong>Days</strong></em>, <em><strong>Weeks</strong></em>, <em><strong>Months</strong></em>, or <em><strong>Years</strong></em>. This can be set independently when sending messages.</td></tr></tbody></table>

## Ticketing service

The ***Ticketing service*** section lists the ticketing services integrated with the workspace. Each row shows whether the service is ***Enabled***, its ***Name***, its ***Type***, and whether ***Log enabled*** is turned on. The order of the list sets the priority of the services: use ***Move up*** and ***Move down*** to change it, and ***Edit*** or ***Remove*** to manage a service.

Click ***Add*** to open the ***Ticketing system*** window, select a ***Ticketing type***, then click ***Continue***. The available types are ***Jira (native)***, ***ServiceNow (native)***, and ***HaloPSA***.

<table><thead><tr><th width="218">SETTINGS</th><th>DESCRIPTION</th></tr></thead><tbody><tr><td><strong>Name</strong></td><td>Name of the ticketing service. This field is required.</td></tr><tr><td><strong>Enabled</strong></td><td>Enable or disable the ticketing service.</td></tr><tr><td><strong>Log enabled</strong></td><td>Enable or disable the ticketing service for logs.</td></tr><tr><td><strong>Authentication type</strong></td><td><p>Available for <em><strong>ServiceNow (native)</strong></em> and <em><strong>HaloPSA</strong></em>. Select the authentication type:</p><ul><li><em><strong>ServiceNow (native)</strong></em>: <em><strong>Default</strong></em>, <em><strong>Basic</strong></em>, or <em><strong>OAuth</strong></em>.</li><li><em><strong>HaloPSA</strong></em>: <em><strong>Client credentials</strong></em> or <em><strong>Username and password</strong></em>.</li></ul></td></tr><tr><td><strong>Ticketing server URI</strong></td><td>The URL to reach your instance of the ticketing system, e.g., <code>https://yourorganization.atlassian.net/</code> for Jira. This field is required.</td></tr><tr><td><strong>API key entry</strong></td><td>Select an <em><strong>API key</strong></em> entry holding the application credentials. This field is required for <em><strong>HaloPSA</strong></em>, and is displayed for <em><strong>ServiceNow (native)</strong></em> when the <em><strong>OAuth</strong></em> authentication type is selected.</td></tr><tr><td><strong>Project key</strong></td><td>Available for <em><strong>Jira (native)</strong></em>. Enter the key of the Jira project.</td></tr><tr><td><strong>Default filter</strong></td><td>Available for <em><strong>ServiceNow (native)</strong></em>. Select <em><strong>Default</strong></em>, <em><strong>Incident</strong></em>, <em><strong>Change request</strong></em>, or <em><strong>Task</strong></em>.</td></tr><tr><td><strong>Scope</strong></td><td>Available for <em><strong>HaloPSA</strong></em>. Enter the HaloPSA scope.</td></tr><tr><td><strong>Ticket enforcement</strong></td><td>Select <em><strong>Enforce</strong></em> or <em><strong>Don't enforce</strong></em> for this ticketing service.</td></tr></tbody></table>

## Type availability

This section allows administrators to control the availability of entries for the workspace. Each section contains different entry types you can choose to be available.

## Default role assignments

***Default role assignments*** are pre-filled in the role assignments of a new resource, where they can be removed before it is saved. They are applied as is when the resource is created through the API. Default role assignments are set separately for ***Vaults***, ***Privileged access providers***, ***Business units***, and ***Gateways***.

Click ***Add default role assignment***, select a ***Role***, then select the ***Assignees*** who receive this role. See [Roles](/server/concepts/intermediate-concepts/roles.md) for more information.

## Advanced

<table data-header-hidden><thead><tr><th width="177"></th><th></th></tr></thead><tbody><tr><td><strong>Option</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Disable stack trace</strong></td><td>Disable the stack trace of Devolutions Server in Remote Desktop Manager's error logs.</td></tr></tbody></table>

{% hint style="info" %}
The ***Disable AI assistant*** option is located in [Server settings – AI assistant](/server/web-interface/administration/configuration/server-settings/general/ai-assistant.md).
{% endhint %}

## General

<table data-header-hidden data-search="false"><thead><tr><th width="262"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Allow user-specific settings</strong></td><td>Allow user-specific settings to override the properties of an entry. Several settings can be overridden, such as the credentials or custom fields.</td></tr><tr><td><strong>Allow entry states (locked, running, checked out)</strong></td><td>Allow entries to have states assigned to them to reflect their current usage.</td></tr><tr><td><strong>Force default status for new entries</strong></td><td>Select a default status to apply to new entries, or <em><strong>Do not enforce</strong></em>.</td></tr><tr><td><strong>Automatic check-in after</strong></td><td>Allow to automatically check in an entry after the defined time.</td></tr><tr><td><strong>Add entry mode</strong></td><td><p>Select if users are prompted to choose a template when creating a new entry. Select between:</p><ul><li><em><strong>Default (Template list including blank)</strong></em></li><li><em><strong>Template list including blank</strong></em></li><li><em><strong>Template list only</strong></em></li><li><em><strong>No template selection</strong></em></li></ul></td></tr><tr><td><strong>Allow users to see user emails</strong></td><td>User email addresses are visible to other users.</td></tr><tr><td><strong>Allow portable license</strong></td><td>Allow Remote Desktop Manager users to use their Remote Desktop Manager licenses across workspaces.</td></tr><tr><td><strong>Expires</strong></td><td>Set the duration of the portable license, between 1 and 7 days. This option is only available when <em><strong>Allow portable license</strong></em> is checked.</td></tr><tr><td><strong>Force date/time format</strong></td><td><p>Apply a single, predefined date/time format. In <em><strong>Date and time format</strong></em>, select one of the following options:</p><ul><li><em><strong>Default</strong></em></li><li><em><strong>US</strong></em></li><li><em><strong>Custom</strong></em>: enter the <em><strong>Date</strong></em> and <em><strong>Time</strong></em> formats.</li></ul></td></tr><tr><td><strong>Allow log comment editing</strong></td><td>Enable the log comment editing for all users.</td></tr><tr><td><strong>Minimum length</strong></td><td>Select the minimum length for log comments, between 0 and 100 characters.</td></tr><tr><td><strong>Maximum file size</strong></td><td>Limit the file size, in MB, to prevent overloading the workspace.</td></tr><tr><td><strong>Allow favorites</strong></td><td>Allow to flag entries as favorites.</td></tr><tr><td><strong>Allow user vault</strong></td><td>Allow users to use <a href="/server/web-interface/user-vault.md">user vaults</a>.</td></tr><tr><td><strong>Log user vault activities</strong></td><td>Include the logs of the <a href="/server/web-interface/user-vault.md">user vault</a> for all users of the workspace.</td></tr><tr><td><strong>Allow linking to shared vault credentials from the user vault</strong></td><td>Allow users to link vault credentials to their personal user vault.</td></tr><tr><td><strong>Allow Macros/Scripts/Tools usage from user vault</strong></td><td>Use Macros, Scripts, and Tools associated with entries in the <a href="/server/web-interface/user-vault.md">user vault</a>.</td></tr><tr><td><strong>Disable user vault export</strong></td><td>Prevent users from exporting their user vault data.</td></tr><tr><td><strong>Allow system vault in user vault</strong></td><td>This setting allows users to access entries from the System vault within their <a href="/server/web-interface/user-vault.md">user vault</a>.</td></tr><tr><td><strong>Create vault with restricted access by default</strong></td><td>Create vaults with a restricted access by default. Checking this option sets all the permissions of the root folder to <em><strong>Never</strong></em> as opposed to <em><strong>Inherited</strong></em> if the option is left unchecked.</td></tr><tr><td><strong>Risky events</strong></td><td>Configure risky events notifications: <em><strong>Default (Enabled)</strong></em>, <em><strong>Enabled</strong></em>, <em><strong>Warn on risky events</strong></em>, <em><strong>Disable risky events</strong></em>, <em><strong>Disable all events</strong></em>, or <em><strong>Optional per vault</strong></em>.</td></tr><tr><td><strong>Time zone</strong></td><td>Select the time zone you are currently in.</td></tr><tr><td><strong>Days</strong></td><td><p>Select which days the entries are available for. Select between:</p><ul><li><em><strong>Any day</strong></em>: the entries can be used any day of the week or weekend.</li><li><em><strong>Weekdays</strong></em>: the entries can be used only in the weekdays.</li><li><em><strong>Weekends</strong></em>: the entries can be used only the weekends.</li><li><em><strong>Custom</strong></em>: manually select each day the entries are available for.</li></ul></td></tr><tr><td><strong>Time of day</strong></td><td><p>Select the hours which the entries are limited to. Select between:</p><ul><li><em><strong>Anytime</strong></em>: the entries can be used at any hour.</li><li><em><strong>Inherited</strong></em>: the entries inherit the time of day setting from their parent.</li><li><em><strong>Custom</strong></em>: set the <em><strong>Start</strong></em> and <em><strong>End</strong></em> of the time frame the entries are available for.</li></ul></td></tr><tr><td><strong>Tag configuration mode</strong></td><td><p>Select how tags are managed for entries:<br></p><ul><li><em><strong>Custom</strong></em>: Tags are assigned manually on each entry, with no inheritance.</li><li><em><strong>Custom + Inherited</strong></em>: entries automatically inherit the tags of their parent folder.</li></ul></td></tr><tr><td><strong>Default dashboard layout</strong></td><td>Select the dashboard layout shown to users by default: <em><strong>User's dashboard</strong></em> or <em><strong>System dashboard</strong></em>. With <em><strong>System dashboard</strong></em>, click <em><strong>Set default layout</strong></em> to configure it.</td></tr><tr><td><strong>Disallow selecting a different dashboard</strong></td><td>Prevent users from selecting a dashboard other than the system dashboard. This option is not available when <em><strong>User's dashboard</strong></em> is selected.</td></tr></tbody></table>

## Application access

The ***Applications*** table lists the applications that can access the workspace: ***Remote Desktop Manager*** (with its ***Windows***, ***macOS***, ***Linux***, ***iOS***, and ***Android*** platforms), ***Cli***, ***Devolutions Launcher***, ***Scripting***, ***Web***, ***Password Manager browser extension***, and ***Devolutions Password Manager***.

<table data-header-hidden><thead><tr><th width="344"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Is allowed</strong></td><td>Allow the application to access the workspace. The <em><strong>Web</strong></em> application cannot be disallowed.</td></tr><tr><td><strong>Default access</strong></td><td>Set the default access to the application. For the Remote Desktop Manager platforms, this option is only available when the platform is allowed.</td></tr><tr><td><strong>Enable application access in user groups</strong></td><td>Enable the application access parameters in <a href="/server/web-interface/administration/user-and-security-management/user-groups.md">user groups</a> properties.</td></tr><tr><td><strong>Precedence</strong></td><td>Set to <em><strong>Allow</strong></em> or <em><strong>Denied</strong></em>. This option is only available when <em><strong>Enable application access in user groups</strong></em> is checked.</td></tr></tbody></table>

## Application-specific

<table><thead><tr><th width="390">SETTING</th><th>DESCRIPTION</th></tr></thead><tbody><tr><td><strong>Enable synchronization by non-administrators</strong></td><td>Enable users that are not administrators to activate the synchronization feature.</td></tr></tbody></table>

## Recording server

<table><thead><tr><th width="333">SETTINGS</th><th>DESCRIPTION</th></tr></thead><tbody><tr><td><strong>Enable Devolutions Gateway recording</strong></td><td>Activate Devolutions Gateway recording.</td></tr><tr><td><strong>Recording frame rate</strong></td><td>Set a frame rate for the recording, between 0 and 60. This option is only available when <em><strong>Enable Devolutions Gateway recording</strong></em> is checked.</td></tr><tr><td><strong>Resolution</strong></td><td>Select the resolution of the recording. This option is only available when <em><strong>Enable Devolutions Gateway recording</strong></em> is checked.</td></tr><tr><td><strong>SSH recording mode</strong></td><td><p>Choose an SSH recording mode between:</p><ul><li><em><strong>WebM</strong></em></li><li><em><strong>TRP</strong></em></li><li><em><strong>Asciicast</strong></em></li></ul></td></tr><tr><td><strong>Prompt confirmation message before opening an entry with session recording</strong></td><td>Display a confirmation message before opening an entry with session recording.</td></tr><tr><td><strong>Custom message</strong></td><td>Enter the confirmation message to display. This option is only available when <em><strong>Prompt confirmation message before opening an entry with session recording</strong></em> is checked.</td></tr><tr><td><strong>Enable Devolutions Gateway recording automatic cleanup</strong></td><td>Allow Devolutions Server to delete Devolutions Gateway recordings after the time set in <em><strong>Delete recordings older than</strong></em>.</td></tr><tr><td><strong>Delete recordings older than</strong></td><td>Set the age of the recordings to delete, in <em><strong>Days</strong></em>, <em><strong>Weeks</strong></em>, <em><strong>Months</strong></em>, or <em><strong>Years</strong></em>. This option is only available when <em><strong>Enable Devolutions Gateway recording automatic cleanup</strong></em> is checked.</td></tr></tbody></table>

## RDM and Password Manager clients

### General

<table data-header-hidden><thead><tr><th width="214"></th><th></th></tr></thead><tbody><tr><td><strong>SETTING</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Expiration</strong></td><td>In <em><strong>Cache/Offline</strong></em>, set the number of days before the offline cache expires. You must go online prior to the end of that period to re-validate the data. It is not recommended to set the Expiration to 0, as this will disable the expiration of the offline cache.</td></tr></tbody></table>

### RDM

<table data-header-hidden><thead><tr><th width="258"></th><th></th></tr></thead><tbody><tr><td><strong>SETTING</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Disconnect workspace</strong></td><td><p>Set application to lock:</p><ul><li><em><strong>On minimize</strong></em>: Lock the application when minimized in the taskbar.</li><li><em><strong>On Windows lock</strong></em>: Lock the application on Windows lock.</li><li><em><strong>Go offline</strong></em>: Lock application when switched to offline mode.</li><li><em><strong>On idle</strong></em>: Lock the application when not in use after a set number of minutes.</li><li><em><strong>On standby</strong></em>: Lock the application when in standby mode.</li><li><em><strong>On close</strong></em>: Lock application when closed.</li></ul></td></tr><tr><td><strong>Maximum document size for offline synchronization (MB)</strong></td><td>Maximum size of each document saved in the database that will be available for synchronization in offline mode.</td></tr></tbody></table>

### Devolutions Password Manager

#### Desktop & mobile apps

<table data-header-hidden><thead><tr><th width="205"></th><th></th></tr></thead><tbody><tr><td><strong>SETTING</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Enforce biometric lock or master password</strong></td><td>Force the use of biometric lock or master password for Devolutions Password Manager clients.</td></tr><tr><td><strong>Force background lock</strong></td><td>Prevent unauthorized access to the Devolutions Server workspace in Devolutions Password Manager if a user switches to another task or window. This option is only available when <em><strong>Enforce biometric lock or master password</strong></em> is checked.</td></tr><tr><td><strong>Force auto-lock after a delay of</strong></td><td>When activated, the Devolutions Server workspace in Devolutions Password Manager will lock itself after a specified delay (e.g., 30 seconds) of inactivity. This option is only available when <em><strong>Enforce biometric lock or master password</strong></em> is checked.</td></tr><tr><td><strong>Force clear clipboard after copy with a delay of</strong></td><td>In <em><strong>Clipboard</strong></em>, require Devolutions Password Manager clients to automatically clear clipboard data after a set delay.</td></tr></tbody></table>

#### Browser extension

<table data-header-hidden><thead><tr><th width="205"></th><th></th></tr></thead><tbody><tr><td><strong>SETTING</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Disconnect workspace</strong></td><td><p>Set the Devolutions Password Manager browser extension to lock the Devolutions Server workspace:</p><ul><li><em><strong>On idle</strong></em>: Lock the workspace when not in use after a set number of minutes.</li><li><em><strong>On close</strong></em>: Lock the workspace on close.</li></ul></td></tr></tbody></table>

## Version management

The version management settings of Remote Desktop Manager are configured separately for each platform in the ***Windows***, ***macOS***, and ***Linux*** tabs.

<table data-header-hidden data-search="false"><thead><tr><th width="306"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Minimal version</strong></td><td>Forces users of the workspace to use a minimal version of Remote Desktop Manager. Enter the entire version number (20XX.X.0.0) to force a specific version. Use this to disable connecting to the workspace with an older version.</td></tr><tr><td><strong>Minimal version custom message</strong></td><td>Enter a custom message for the minimal version notification.</td></tr><tr><td><strong>Maximal version</strong></td><td>Forces users of the workspace to use a maximal version. Enter the entire version number (20XX.X.0.0) to force a specific version. Use this to disable connecting to the workspace with a newer version.</td></tr><tr><td><strong>Maximum version custom message</strong></td><td>Enter a custom message for the maximal version notification.</td></tr><tr><td><strong>Recommended version</strong></td><td>Recommended version will be displayed to the user via the updater as the recommended version to be downloaded and installed. This option is only available in the <em><strong>Windows</strong></em> tab, when <em><strong>Minimal version</strong></em> or <em><strong>Maximal version</strong></em> is checked.</td></tr><tr><td><strong>Disable checks for updates</strong></td><td>Disable the auto update notification message. Use this to manually update the application and prevent from getting notified when new versions are available.</td></tr><tr><td><strong>Show custom minimum/maximum version message for administrators</strong></td><td>Show the custom minimum/maximum version message to administrators.</td></tr><tr><td><strong>Download URL</strong></td><td>Use in conjunction with the minimal or maximal version, once a minimal or maximal version requirement is not met the system will prompt the user that the version is no longer valid and it will open the link (path/URL) to download the newer or older version.</td></tr></tbody></table>

## Vault management

### Default vault visibility

<table data-header-hidden><thead><tr><th width="270"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Public - Allow access requests</strong></td><td>Users can request access to the vault.<br></td></tr><tr><td><strong>Private - Invitation only</strong></td><td>This setting makes the vault accessible only to users who are invited.</td></tr></tbody></table>

### Default permissions

<table data-header-hidden><thead><tr><th width="138"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Permission</strong></td><td><p>Set the default permissions of new vaults to <em><strong>Default</strong></em>, <em><strong>Custom</strong></em>, or <em><strong>Disallowed</strong></em>. Unless <em><strong>Disallowed</strong></em> is selected, the permissions are displayed in the <em><strong>General</strong></em>, <em><strong>Security</strong></em>, <em><strong>Attachments</strong></em>, <em><strong>Documentation</strong></em>, <em><strong>More</strong></em>, and <em><strong>PAM</strong></em> tabs. They can only be modified when <em><strong>Custom</strong></em> is selected.</p><p>The <em><strong>PAM</strong></em> tab holds the <em><strong>Reset password</strong></em>, <em><strong>Approve checkout request</strong></em>, <em><strong>Force Check-in</strong></em>, <em><strong>Checkout</strong></em>, and <em><strong>Read logs</strong></em> permissions.</p></td></tr><tr><td><strong>Grant access</strong></td><td>Get access to the <em><strong>Batch grant access</strong></em> feature when selecting <em><strong>Custom</strong></em> in the <em><strong>Permission</strong></em> drop-down list. It allows you to set permissions and permission sets to multiple users, user groups, and/or application users at once. Both shared and PAM permission sets are available.</td></tr></tbody></table>

### Default root permissions

| Settings              | Description                                                                                                                                                                                                                                                                                  |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Allow add in root** | Choose whether users can add entries and folders at the root level of vaults. The permission can be set to ***Default***, ***Allowed***, ***Disallowed***, or ***Custom***, the latter of which opens up the user/user groups/applications window, letting you grant access more granularly. |
| **Root settings**     | Choose whether users can access the root settings of vaults. The permission can be set to ***Default***, ***Allowed***, ***Disallowed***, or ***Custom***, the latter of which opens up the user/user groups/applications window, letting you grant access more granularly.                  |

### Role assignments

| Settings                              | Description                                                                      |
| ------------------------------------- | -------------------------------------------------------------------------------- |
| **Default vault creator role**        | Set the role users are assigned by default on a vault they create.               |
| **Default vault assignment role**     | Set the default role users have when assigned a vault.                           |
| **Default vault access request role** | Set the default role users have when their access request to a vault is granted. |

### My account settings

<table data-header-hidden><thead><tr><th width="195"></th><th></th></tr></thead><tbody><tr><td><strong>SETTING</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Forced save location</strong></td><td>Force where <em><strong>My account settings</strong></em> are saved by selecting <em><strong>Database</strong></em> or <em><strong>Local</strong></em>. Select <em><strong>None</strong></em> to not force a save location.</td></tr></tbody></table>

### Permission sets

<table data-header-hidden><thead><tr><th width="190"></th><th></th></tr></thead><tbody><tr><td><strong>SETTING</strong></td><td><strong>DESCRIPTION</strong></td></tr><tr><td><strong>Add permission set</strong></td><td>Create a custom list of permissions that can be applied to the permissions of an entry/folder/vault through the <em><strong>Batch grant access</strong></em> feature.</td></tr><tr><td><strong>Permission sets list</strong></td><td>Lists the shared and PAM permission sets with their <em><strong>Name</strong></em> and the number of granted <em><strong>Permissions</strong></em> per category. Use <em><strong>Edit</strong></em> or <em><strong>Delete</strong></em> to manage a custom permission set. The permission sets that exist by default cannot be edited or deleted.</td></tr></tbody></table>

### Security settings

<table data-header-hidden><thead><tr><th width="326"></th><th></th></tr></thead><tbody><tr><td><strong>Setting</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Allow Password Manager browser extension auto-fill</strong></td><td>Set Devolutions Password Manager browser extension auto-fill in Devolutions Server to <em><strong>Enabled</strong></em> or <em><strong>Disabled</strong></em>.</td></tr></tbody></table>

## Vault templates

| Settings                        | Description                                                                                                         |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| **Add vault template**          | Create a vault template to be used by future vault creators.                                                        |
| **Add entry to vault template** | Add default entries to the selected template. Select a vault template or a folder entry in a template to enable it. |
| **Edit**                        | Modify the selected vault template or template entry.                                                               |
| **Delete**                      | Delete the selected vault template or template entry.                                                               |

## Password management

<table data-header-hidden data-search="false"><thead><tr><th width="301"></th><th></th></tr></thead><tbody><tr><td><strong>SETTINGS</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Password history</strong></td><td>Indicate the maximum saved password to keep in history, between 0 and 30.</td></tr><tr><td><strong>Password strength calculator</strong></td><td>Select the tool to use to analyze the password strength: <em><strong>Default (Zxcvbn)</strong></em>, <em><strong>Legacy</strong></em>, or <em><strong>Zxcvbn</strong></em>.</td></tr><tr><td><strong>Disable password saving (shared)</strong></td><td>Prevent users from saving passwords in entries.</td></tr><tr><td><strong>Disable password saving (user-specific settings)</strong></td><td>Prevent users from saving passwords in the User-specific settings.</td></tr><tr><td><strong>Allow revealing credentials (if enabled in the entry)</strong></td><td>Shows the credentials if the box "Allow show credentials (everybody)" is check inside the entry.</td></tr><tr><td><strong>Disable password saving (tools)</strong></td><td>Prevent users from saving passwords in the Tools tab of a session.</td></tr><tr><td><strong>Allow password variables for all entries</strong></td><td>Renders the $PASSWORD$ variable usable for this workspace.</td></tr><tr><td><strong>Allow password variable in macros</strong></td><td>Renders the $MACRO_PASSWORD$ variable usable for this workspace. This option is only available when <em><strong>Allow password variables for all entries</strong></em> is checked.</td></tr><tr><td><strong>Default policy</strong></td><td>Default password policy used by the system, or <em><strong>None</strong></em>. Click <em><strong>Add policy</strong></em> to create a password policy, or <em><strong>Manage</strong></em> to go to <a href="/server/web-interface/administration/templates/password-policies.md">Password policies</a>. Only password policies in "default" or "custom characters" mode allow the application to restrict entering passwords that don't adhere to the selected policy.</td></tr><tr><td><strong>Lock password policy</strong></td><td>Force the usage of the default policy.</td></tr><tr><td><strong>Forbidden password check</strong></td><td>A verification of the password against all configured <a href="#forbidden-password">forbidden password</a> lists is done if <em><strong>Enabled</strong></em>. If set to <em><strong>None</strong></em>, no forbidden password validation is applied.</td></tr><tr><td><strong>Password complexity check</strong></td><td><ul><li>None: No policy will be used when creating a password.</li><li>Required: When a user creates a password, they will get a warning that the password does not respect the policy. The user cannot save the password.</li><li>Warning: When a user creates a password, they will get a warning that the password does not respect the policy. The user can save the password.</li></ul></td></tr></tbody></table>

{% hint style="info" %}
The ***Compromised (pwned) check*** setting is located in the [Forbidden password](#forbidden-password) section.
{% endhint %}

## Forbidden password

***Forbidden passwords*** let administrators build lists of passwords that cannot be used in the Devolutions Server workspace. Each credential password is checked against every list and rejected if it matches any of them. Each list has its own name, verification mode, and case sensitivity, and lists can be added, edited, or removed independently.

{% hint style="info" %}
To check passwords against known data breaches, use the ***Compromised (pwned) check*** setting of this section. There is no need to import a breach list in the forbidden password lists.
{% endhint %}

<table data-header-hidden><thead><tr><th width="210"></th><th></th></tr></thead><tbody><tr><td><strong>Setting</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Compromised (pwned) check</strong></td><td>Check passwords against known data breaches using <a href="https://haveibeenpwned.com/Passwords">Have I Been Pwned</a>. Select <em><strong>None</strong></em>, <em><strong>Enabled</strong></em>, or <em><strong>Required</strong></em>.</td></tr><tr><td><strong>Forbidden password check</strong></td><td>Verify passwords against the forbidden password lists. Select <em><strong>Enabled</strong></em> to apply the lists, or <em><strong>None</strong></em> to not apply any forbidden password validation. This is the same setting as the one in <a href="#password-management">Password management</a>.</td></tr><tr><td><strong>Forbidden password list</strong></td><td><p>Each list contains:</p><ul><li><em><strong>Name</strong></em>: the name of the list. This field is required.</li><li>The forbidden passwords, one per line. Each list holds a maximum of 1,000 passwords.</li><li>The verification mode: <em><strong>Contains</strong></em> forbids a password that contains one of the list's passwords, and <em><strong>Exact match</strong></em> forbids a password that matches one of the list's passwords.</li><li><em><strong>Case sensitive</strong></em>: make the verification case sensitive.</li></ul><p>Use the <em><strong>Delete</strong></em> button to remove a list.</p></td></tr><tr><td><strong>Add</strong></td><td>Open the <em><strong>Add forbidden password list</strong></em> window to create a list. Enter a <em><strong>Name</strong></em>, enter the passwords or click <em><strong>Import</strong></em> to load them from a .txt file, then set the <em><strong>Word separator</strong></em>, <em><strong>Verification mode</strong></em>, and <em><strong>Case sensitive</strong></em> option. The workspace holds a maximum of 10 forbidden password lists.</td></tr><tr><td><strong>Import</strong></td><td>Import a .txt or .json file of 1 MB or less. A .txt file opens the <em><strong>Add forbidden password list</strong></em> window with its passwords, and the list is named after the file. A .json file must come from an <em><strong>Export</strong></em>; its lists are added to the existing ones.</td></tr><tr><td><strong>Export</strong></td><td>Export the forbidden password lists as a JSON file.</td></tr></tbody></table>

## Users

The ***Users*** section contains the ***Users*** settings and the ***User template***, which sets the default settings applied to new users.

<table data-search="false"><thead><tr><th width="233">SETTINGS</th><th>DESCRIPTION</th></tr></thead><tbody><tr><td><strong>Enabled auto-deletion of users marked as "deleted".</strong></td><td>Automatically delete the users marked as deleted, meaning that their user vaults are definitely deleted after the delay defined in the <em><strong>Delete after</strong></em> field.</td></tr><tr><td><strong>Delete after</strong></td><td>Select <em><strong>30 Days</strong></em>, <em><strong>60 Days</strong></em>, <em><strong>90 Days</strong></em>, or <em><strong>Custom</strong></em> to enter a number of days. This option is only available when auto-deletion is enabled.</td></tr><tr><td><strong>Allow AI assistant</strong></td><td>Enable or disable the <a href="/server/web-interface/administration/configuration/server-settings/general/ai-assistant.md">AI assistant</a> for users of the workspace. When unchecked, the <em><strong>AI assistant</strong></em> button is hidden from the toolbar.</td></tr><tr><td><strong>Allow API key</strong> (Users)</td><td>Enable or disable the use of API keys.</td></tr><tr><td><strong>RDM offline mode</strong></td><td>Determine how new users can interact with the workspace when using Remote Desktop Manager's <a href="https://docs.devolutions.net/rdm/getting-started/workspaces/offline-mode">offline mode</a>: <em><strong>Disabled</strong></em>, <em><strong>Cache only</strong></em>, <em><strong>Read-only</strong></em>, or <em><strong>Read/write</strong></em>.</td></tr><tr><td><strong>Password Manager offline mode</strong></td><td>Determine how new users can interact with the workspace when using Devolutions Password Manager's <a href="https://docs.devolutions.net/password-manager/application/settings">offline mode</a>: <em><strong>Disabled</strong></em> or <em><strong>Read-only</strong></em>.</td></tr><tr><td><strong>User type</strong></td><td>Set the default <a href="/server/web-interface/user-group-based-security.md#select-the-appropriate-user-type">user type</a> of new users: <em><strong>Workspace owner</strong></em> or <em><strong>User</strong></em>.</td></tr><tr><td><strong>Language</strong></td><td>Set the default language of new users.</td></tr><tr><td><strong>Allow user vault</strong></td><td>Set whether new users can use the user vault: <em><strong>Default</strong></em>, <em><strong>Yes</strong></em>, or <em><strong>No</strong></em>. <em><strong>Default</strong></em> follows the <em><strong>Allow user vault</strong></em> setting of the <a href="#general">General</a> section.</td></tr><tr><td><strong>Allow API key</strong> (User template)</td><td>Set whether new users can use API keys: <em><strong>Default (No)</strong></em>, <em><strong>Yes</strong></em>, or <em><strong>No</strong></em>.</td></tr><tr><td><strong>Vault assignments</strong></td><td>Click <em><strong>Add vault assignment</strong></em>, select a <em><strong>Role</strong></em> and one or more <em><strong>Vaults</strong></em> to assign this role to new users in these vaults.</td></tr></tbody></table>

## Devolutions Server user

### Password policy

<table data-search="false"><thead><tr><th>Setting</th><th>Description</th></tr></thead><tbody><tr><td><strong>Password policy</strong></td><td><p>Select the password policy applied to accounts created directly in Devolutions Server (as opposed to domain, SSO, or Devolutions Cloud accounts). Select between:</p><ul><li><em><strong>List</strong></em>: select an existing password policy in the <em><strong>Select policy</strong></em> drop-down list.</li><li><em><strong>Custom</strong></em>: define the requirements below.</li><li><em><strong>None</strong></em>: no password policy is applied.</li><li><em><strong>Recommended</strong></em>: apply the recommended requirements.</li></ul><p>The minimum requirements below can only be modified when <em><strong>Custom</strong></em> is selected. Each one is enabled by its checkbox and accepts a value between 0 and 50.</p></td></tr><tr><td><strong>Minimum length</strong></td><td>Enforce a minimum number of characters required in the password.</td></tr><tr><td><strong>Minimum lowercase characters</strong></td><td>Enforce a minimum number of lowercase letters required in the password.</td></tr><tr><td><strong>Minimum uppercase characters</strong></td><td>Enforce a minimum number of uppercase letters required in the password.</td></tr><tr><td><strong>Minimum number of numeric characters</strong></td><td>Enforce a minimum number of digits required in the password.</td></tr><tr><td><strong>Minimum symbols</strong></td><td>Enforce a minimum number of special characters (symbols) required in the password.</td></tr><tr><td><strong>Compromised password (pwned) check</strong></td><td>Verify if the password has already been exposed in known data breaches. Select <em><strong>None</strong></em>, <em><strong>Enabled</strong></em>, or <em><strong>System settings</strong></em>.</td></tr></tbody></table>

### Security

| Setting                                                | Description                                                                                                                             |
| ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------- |
| **Devolutions Server user password expiration (days)** | Set the number of days before a Devolutions Server user's password expires and must be changed. A value of ***0*** disables expiration. |

## User tag colors

The ***Tag color rules*** list shows each rule's ***Tag name***, ***Match mode***, ***Case sensitive*** option, and ***Preview***. Use ***Edit*** or ***Delete*** to manage a rule.

<table><thead><tr><th width="230">Setting</th><th>Description</th></tr></thead><tbody><tr><td><strong>Add tag color rule</strong></td><td>Create a rule that sets the colors of the custom tags it matches.</td></tr><tr><td><strong>Tag name</strong></td><td>Enter the tag name to match. This field is required. With the <em><strong>Regex</strong></em> match mode, enter a valid regular expression.</td></tr><tr><td><strong>Match mode</strong></td><td>Select how the <em><strong>Tag name</strong></em> is matched against custom tags: <em><strong>Exact match</strong></em>, <em><strong>Starts with</strong></em>, <em><strong>Ends with</strong></em>, <em><strong>Contains</strong></em>, or <em><strong>Regex</strong></em>.</td></tr><tr><td><strong>Case sensitive</strong></td><td>Make the match case sensitive.</td></tr><tr><td><strong>Background color</strong>, <strong>Text color</strong></td><td>Select the colors of the tag in the light theme.</td></tr><tr><td><strong>Background color (dark)</strong>, <strong>Text color (dark)</strong></td><td>Select the colors of the tag in the dark theme.</td></tr><tr><td><strong>Preview</strong></td><td>Preview the tag in the <em><strong>Light</strong></em> and <em><strong>Dark</strong></em> themes.</td></tr></tbody></table>

#### See also

* [Devolutions Academy – Configuration and security](https://academy.devolutions.net/student/path/2942210/activity/4493535)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.devolutions.net/server/web-interface/administration/configuration/system-settings.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.