For configuring the Entrust IdentityGuard Soft Token application, and gaining access to your Paychex machine remotely.

Prerequisites

1. Physical LAN connection to Paychex network (the office is configured as such).
2. Credentials

1. to configure the Soft Token:

1. 1. Paychex Username
   2. Paychex Password
   3. PVN
   4. Token Serial

1. 1. (Should be pre-configured when you get to that step)
2. Details to login to your Paychex machine:
   1. Paychex Machine Name
3. Make sure that you are not on the “croop” domain on your local machine. You will need to use your local account (“Solu-AccountName”) as we need administrative privileges

1. .

Accessing the Self-Service Website

1. Make sure to be connected via the LAN network.
2. Use the following link as we are remotely located: https://eaccesssecurityportal.paychex.com/
3. Use your Paychex credentials to login:
   Image Modified
4. Use the same Paychex credentials again:
   Image Modified
5. Setup your 5 Security Questions:
   1. Four will need to be selected from drop-down lists; you will need to create the fifth yourself.
   2. After you have selected and answered your five questions (1 custom and 4 from the drop-downs), click “Next”: 
      Image Modified
6. You should be returned to the main menu. Select "I’d like to activate my soft token so I can start using it."
   Image Modified
7. Confirm that you wish to activate your token:
   Image Modified
8. Select option 2, manual activation:
   Image Modified
9. You should see a page like the following, containing all the details you will need to activate the application. Wait here:
   Image Modified

Configure the Soft Token Application for Desktop

1. Check to see if the application is already installed under Start > All Programs > “Entrust IdentityGuard Soft Token”. If so, run it, and skip to the next section.
   Image Modified
2. If the software is not installed:
   1. Download it here: https://www.entrust.com/mobile/info/download.php
      Image Modified
   2. Locate the downloaded installer file and run it. You will see this screen:
      Image Modified
   3. Click “Next” through the installer, accepting the license agreement along the way.

Connecting your Account and Soft Token Application

1. Go back to the Self-Service website, and copy the information from the page we left off at to the Soft Token application.
2. Create your pin for logging into the soft token application when prompted. Note that this is a different pin than your PVN.
3. Once configured, the application should provide you with a Registration Code. Input this into the next page on the Self-Service site:
   Image Modified
4. Confirm successful registration. If you see the page below, your token is set up correctly. If not, please ensure all information is correct and retry.
   Image Modified
5. Next, change your PVN. From the Self-Service main menu, select “I’d like to change my PVN the next time I authenticate.”
   Image Modified
6. At the confirmation prompt, click “Yes”:
   Image Modified
7. Click “done”.
8. Log out and back into Self-Service which will prompt you to change your PVN.
9. Enter your old PVN in the first field (provided via email), followed by your desired new PVN in the next two, and a response from the token application in the last field:
   Image Modified
10. Click OK; the token is now properly set up.

Connecting to the Paychex Network

1. Go to: https://eaccessapps.paychex.com/vpn/index.html
2. Install the Citrix Helper Client.
3. Login using your Paychex username and password. Pin and Passcode is combination of PVN + Response Passcode from the soft token application. e.g. PVN: 1234 + Passcode: 12345678 = 123412345678
4. This screen gives you access to all of the various environments you will need to connect to for Paychex.

Connecting to your Paychex Machine

1. Complete the steps in the above section, Connecting to Paychex.

2. You should have access to the Remote Desktop service from here. If not,

1. talk to your team Scrum Master and Solution Lead.

2. Click Remote Desktop Connection
3. For the Computer name you will use the name of the Paychex-provided machine, ex: dev-d-NNNNN, and Username is PAYCHEX\<yourpaychexusername>
4. Before clicking Connect, go to the Experience tab and set your performance speed to High-speed broadband
5. Now click Connect
6. Log into your Paychex machine with the same credentials again and you're in!
7. If this is your first time on the network and you'll be moving onto Paychex onboarding start here: https://wiki.paychex.com/pages/viewpage.action?pageId=77806382 (NOTE: This link will only work from within the Paychex network, and once Mark has given you access to the specific Space within the wiki.)

Other Tasks

Configuring the Soft Token Application for Mobile

1. From the Self-Service website main menu, click on "I'd like to activate my soft token so I can start using it."

2. Confirm your serial number.

3. Select option 1, you should get a page containing a QR code and a password:
   Image Modified

4. Go to the App Store (iOS) or the Google Play Store (Android), search for the "Entrust IdentityGuard Mobile" application and install it.

5. Go to the "Scan QR Code" feature of the application (top-left menu in Android, bottom-right button in iOS) and scan the code on the Self-Service page.
   Image ModifiedImage Modified

6. Enter the password below the QR code when prompted.

7. Create your pin for logging into the soft token application when prompted. Note that this is a different pin than your PVN.

Paychex Laptop (No Remote Desktop Protocol)

Paychex laptops can connect directly to the Paychex network via VPN using Cisco AnyConnect. This is a completely different access method, and does not require the Soft Token to access. 

You will need a certificate on your laptop to authenticate with the Paychex network. You can get this certificate via Paychex Enterprise Support: (585) 383-3456.

When you have the certificate, you can use Cisco AnyConnect to access connect.paychex.com, selecting the Employee_cert you received, and using you Paychex login credentials. 

If you know of content related to this specific configuration, please link it here.