Advanced Access Control-8.1!02!20 2023US IG

OnGuard Advanced Access
Control
• Welcome to LenelS2 Training
02202023
Welcome to Lenel•S2 Training
Legal Notice
THIS PRESENTATION AND ITS CONTENT ARE STRICTLY CONFIDENTIAL and

may not be copied, disclosed or otherwise disseminated either in whole or in part
without Carrier prior written approval.
This document is supplied for training purposes only. It does not constitute an offer
to supply any products or services or a binding contract thereto, nor does it give
rise to legally enforceable rights or obligations.
Training services provided by Carrier are subject to the terms and conditions of the
agreement Carrier has with your company.
All information is delivered on an “as is” basis and all representations and
warranties, express or implied, are hereby disclaimed, including, without limitation,
that the information is accurate or reliable for any purpose whatsoever.”
A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Introductions
• Who ? ( You and your employer ?)
• Where ? (Are You From ? )
• What ? ( Is your Role and Experience with Regard to Access Control

Hardware and OnGuard ?)
• What are your expectations for this course?

Training Information
• Virtual Information
• Breaks and Lunch Schedule
• Virtual Learning Platform
• Click Exit when leaving your Lab for the day
• When not speaking, please be sure you are muted
• Stop me if you have a question
• Classroom Information
• Breaks and Lunch Schedule
• Stop me if you have a question

Training Information
• LenelS2 Training Information

• Our Producer LenelS2 Training Information
• Mute/Unmute • Chat
• Alt+A: toggle to mute/unmute audio
• Please keep yourself muted when not

speaking
• If Audio connection is poor or is lost, try
• Connect by phone(1) or, connect to
computer audio (2)
(1) (2)

Zoom Controls
• At the bottom of your screen, you • Opening the Participant list

should see this: and Chat, you should see
at the right of your display:
• From left to right:
• Raise Hand Don Smith
• From left to right: • Yes

• Mute/Unmute yourself • No
• Turn your video on/off
• Go Slower
• Participant list
• Chat • Go Faster
• Share content (You will not have to do • More…reactions
this)
• Chat at the bottom
• Share reactions
• Leave Meeting • To everyone
• Privately

Course Objectives
By the end of Configure OnGuard to allows users to log on to any OnGuard desktop application
this course, automatically using the current Windows log in account
you will be able Use FormsDesigner to make cosmetic changes to the cardholder form
to:
Change how alarms/events are presented to operators, send alarms/events via E-Mail
manually or automatically, forward alarms/events to other OnGuard users
Configure OnGuard to utilize invalid badge status as a trigger for a Global I/O action
Configure Access Areas for the purpose of population management, deter badges
being passed back and re-used by others to gain entry and deploy Muster facility for
building evacuation
Configure FIRST CARD UNLOCK: cause a door to remain unlocked when Access is
Granted to a cardholder
Configure Device groups to allow multiple devices to be controlled by User Action in

Alarm Monitoring, testing inputs, outputs and door contacts
Assign action to device's icon within Alarm Monitoring to be executed by left click or
double-click

Course Objectives
Course Configure the floor-plan representation of a site (Map) to be displayed within Alarm
objectives Monitoring and place on this map icons representing hardware devices
(continued)
Define Action Groups and how to attach them to tasks like Scheduler and Global I/O
Understand the concept of Anti-Passback and how to configure in Onguard.
Define both Global I/O and Local I/O and the functional differences between them
Configure Destination Assurance feature that allows timing the use of an initiating
reader to one of several destination readers
Understand the mechanism that causes badges to be downloaded to the controller
memory and change this process using Access Level rules
Manage alarm input advanced options (Debounce & Hold Time) and use alternative
resistor values for supervision
Configure Reader Interface Modules in Elevator Mode and use of Elevator Control
Level to authorize travel to selected floors
Convert an OnGuard System from non-segmented to segmented, understand

segmentation terminology and licensing

Course Objectives
• After the Advanced Access course has been taken and the
exam has been completed with a passing score, the Lenel
Certified Professional level will be achieved
• Your certificate will be available as a .PDF at

https://partner.lenel.com

Course Agenda
Day One Topics Day Two Topics Day Three Topics

• Install and Configure OnGuard • First Card Unlock • Advanced Input Configuration
• Single Sign on • Double Card Unlock/Toggle • Debounce
• FormsDesigner Lite • Map Designer • Hold Time
• Monitoring Options • OnGuard Monitor • Custom End of Line Resistance
• Device Groups • Alarm Handling • Elevator Control
• Action Groups • Alarms Configuration • LNL-1320
• Scheduler • Global Output Server Service • LNL-1300/1324e
• Local I/O • Acknowledgement Actions • Day Mode
• Global I/O • Failure to Acknowledge • Online Facility Code Mode
• Alarm Highlighting • Offline Mode
• Alarm Forwarding • Segmentation
• Invalid Badge • Segment(s) Creation
• Area Interlock • Segment Options
• Anti-Passback • Card Formats
• Local Anti-Passback • Badge Types
• Global Anti-Passback • Cardholders
• Mustering • Segment Groups
• Area Access Manager • Access Levels
• Destination Assurance • List Builder
• Selective Cardholder Download

Course Materials
All course materials are available

through your instructor
Also available at Partner Center

– Log in required
Materials to populate your Lenel

USB drive with:
• Course presentation slides
• Handouts for various courses
• This slide deck with your notes

Certification Program

Certification Program
• Course Name: Advanced Access Control

• Duration: 3 days

Course topics – Index links for this document
Day One Topics Day Two Topics Day Three Topics

• Install and Configure OnGuard • First Card Unlock • Advanced Input Configuration
• Single Sign on • Double Card Unlock/Toggle • Debounce
• FormsDesigner Lite • Map Designer • Hold Time
• Monitoring Options • OnGuard Monitor • Custom End of Line Resistance
• Device Groups • Alarm Handling • Elevator Control
• Action Groups • Alarms Configuration • LNL-1320
• Scheduler • Global Output Server Service • LNL-1300/1324e
• Local I/O • Acknowledgement Actions • Day Mode
• Global I/O • Failure to Acknowledge • Online Facility Code Mode
• Alarm Highlighting • Offline Mode
• Alarm Forwarding • Segmentation
• Invalid Badge • Segment(s) Creation
• Area Interlock • Segment Options
• Anti-Passback • Card Formats
• Local Anti-Passback • Badge Types
• Global Anti-Passback • Cardholders
• Mustering • Segment Groups
• Area Access Manager • Access Levels
• Destination Assurance • List Builder
• Selective Cardholder Download

Basic OnGuard
Configuration

Install and Configure OnGuard
Install OnGuard
• Standard Installation
• Use License Server VMW-VLP-LIC (or, as directed by your instructor)
• Allow the OnGuard installation to create the AccessControl database
• Define the following hardware:
• (1) LNL-X4420 with TLS required (instructor will supply your IP address)
• Server Room Reader, Onboard
• (1) LNL-1100 address 1, Port 1
• Add 2 inputs
• Add 2 outputs
• Entry Reader
• Exit Reader

Single Sign On

Single Sign-On
Allows the user to log on to any OnGuard desktop application

automatically using the current Windows log in account
• Manually logging in to OnGuard using the OnGuard Internal Account User name
and Password is still available, if desired
• OnGuard users may have an internal account and/or a directory account link

Internal Account
• The Internal Account is what you have been using to log in to OnGuard up to this
point

Single Sign-On
Internal Account
• A user account where the authentication information is saved

within the OnGuard system database
Directory Accounts
• A user account where the OnGuard user is linked to the

windows log in account
• The authentication information is controlled by the directory
service selected

Single Sign-On Directory Configuration
Directory must first be configured
• System Administration > Administration > Directories

• Directory Services Template Types
• LDAP
• Lightweight Directory Access Protocol
• Microsoft Active Directory
• Windows NT 4.0 domain
• A precursor to Active Directory that handled domain directory
management prior to Windows 2000
• OpenID Connect
• Third party authentication of a user via a URL
• Windows Local Accounts
• Copy existing directory
• Uses previous configuration as a starting template

Select domain hostname
• Other default parameters will automatically be populated

• Name – {Domain Name}
• Port - 389
• Start Node – Node under which all accounts exist
• SSL (Secure Socket Layer)
• Enables data encryption

Single Sign-On Authentication
Determines how OnGuard will authenticate to

the Windows user accounts
• Anonymous
• Directories may be set up to allow anonymous access
• Active directory default is to not allow anonymous access
• Current Windows account
• Explicit
• Account logon information
• Domain\User name
• Password

Advanced Configuration for LDAP directories (Not available

for Windows NT4 Domains or Windows workstations)
• Account class (user)
• Account category (person)
• Account attributes
• ID attributes (objectsid)
• User name attributes (samaccountname)
• Display name attributes (displayname)
• E-Mail attributes

OnGuard User Accounts
• Open Administration > Users to link your windows log in account to your OnGuard
User account
• Use the filter capabilities for refining the results

Auto Single Sign-On
Log in to any OnGuard desktop application
• Launch the OnGuard desktop application

• If the application is already open simply use the key icon or the Application
menu option to log off / on
Auto Logon will be started
• To bypass the auto logon, press the Shift Key and log in manually using
an Internal Account user name and password

FormsDesigner
Lite

Cardholder Additional Features
FormsDesigner Lite
• Allows for cosmetic changes to the cardholder form

• Other forms can be altered too

FormsDesigner Application
Functionality controlled through the license
• FormsDesigner Lite
• Standard feature with OnGuard
• Allows cosmetic changes only
• Label changes
• Set Tab Order
• Move Fields and Labels
• FormsDesigner Full
• Requires an additional license (SWG-1210)
Separate OnGuard application located in the

OnGuard program menu

Before Launching FormsDesigner
Everyone should be logged out of System

Administration or Alarm Monitoring
• No changes can be made in these programs while someone is using
FormsDesigner
• The programs may be open, but it is not recommended
FormsDesigner User Guide as a reference

Before Launching FormsDesigner
You must backup your database
• You will be prompted to confirm you have done so

• Once saved, modifications cannot be undone
• This protects against unforeseen problems such as
• Power Outage
• Network Problems
• Database Issues

Using FormsDesigner
When presented with the Open Form screen, please

select the appropriate choice then press OK
The most common choice with FormsDesigner Lite would

be Cardholder

FormsDesigner Navigation
Form Design Layout
Object List
All Viewing Permanent Area
Database
Info Window Custom Area

Object List
• Lists all objects currently defined in the system

• Allows for easy selection of objects
Database Information Window
• Lists the database tables and fields
Form Layout View
• Forms look as they will within their respective applications

All Viewing Permanent Area
• This appears at the top and right hand side of all

cardholder pages including the reports tab
Custom Area
• This is where user configurable objects appear only on

the cardholder page

FormsDesigner Lite
Typical Cosmetic Changes
• Change field labels object text to match country

requirements, such as ZIP code, state, etc.
• Relocate fields on a page
• Change the tab order when adding cardholders

Label Object
Double click on the label to be updated
Update the label text to the appropriate value

Field Location
Fields may be moved within the chosen screen
• Select the field as shown, then drag to the desired location

• Be careful not to place one field on top of another
• Keep the field and field labels together
• Only fields in the custom area should be moved

Finalizing The Layout
Alignment Tools
• Allow objects to be properly aligned

• Horizontally or Vertically
• Carefully select appropriate fields for
alignment
• Toolbar located at the bottom

Set Tab Order
Speeds up copy-typing from

lists
Step 1
• Sets the order in which the cursor
moves from field to field when the
user tabs through them on a page
• Click on the fields in the order
required
• When done, select Save and Exit Tab Step 2
Mode
Step 3

Saving Changes
With FormsDesigner Lite the only option is to

save cosmetic changes
• This does not affect the data in the database
• Log back in to System Administration and review the
results

FormsDesigner Lite – Knowledge Check
Knowledge acquired in this section should

include:
• Understanding the capabilities of FormsDesigner Lite
• How to change a field label
• How to move fields / labels around
• How to modify the Set Tab Order
❖How many OnGuard users are allowed to log in to

FormsDesigner at the same time (in a typical
environment)?

Monitoring Options

Monitoring Options
Monitoring Options allows an Alarm Monitoring operator

to double click on an icon to execute a selected command
• Operators can execute the command from the system tree or a map
Only one command per Icon Type for all operators
The configuration is set under Monitoring > Monitoring

Options

Monitoring Options
Select the Reader icon and set the command to Open

door(s)
• Log off / on of Alarm Monitoring once this is done
• Double click on any reader icon in the system tree or on a map to observe the
outcome
• Under the Options menu, Execute Command on Single Click can be selected

Device Groups

Device Groups
Device Groups allow for mass control, in Alarm Monitoring, of the hardware components contained within the group
• Useful for reader lock downs, activate/deactivate outputs, or mask/unmask various inputs
• Use Monitor permissions groups to control usage of device groups
Unlimited device groups can be created
Unlimited hardware can be added to each group
Group types are:
• Reader Group
• Input Group
• Output Group
• Camera Group
• Alarm Mask Group
• Intrusion Mask Group

Reader Device Groups
Go to Access Control > Groups
On the second tab, Device Groups, click on Add
Name the group and select Reader Group as the type

Reader Device Groups
Checkmark the appropriate Readers, assign to the right, and

click OK
Readers may be grouped to provide control of the following
• Online reader mode

• Masking and Unmasking of door forced and door held alarms
• The testing of door forced open and access granted events

Input Device Groups
Click Add, name the group, and

select Input Group as the type
Checkmark the appropriate Inputs,

Assign to the right, and click OK
Inputs may be grouped to provide

control of the following
• The masking and unmasking of alarms
• The testing of inputs

Output Device Groups
Click Add, name the group, and select Output Group as the
type
Checkmark the appropriate Outputs, Assign to the right, and

click OK
Outputs may be grouped to provide control to activate,

deactivate, or pulse the outputs

Device Groups in Alarm Monitoring
Open Device Groups in Alarm Monitoring under View >

Device Groups
Understand it is not possible to control device groups that

contain hardware not included in the current monitor zone
A Restart of Alarm
Monitoring may be
necessary after creating
Device Groups.

Device Groups in Alarm Monitoring
Test the following by right clicking on the device

group:
• Change reader mode to lock for all readers in the group
• Mask / Unmask inputs in the input group
• Pulse all outputs in the output group
• Test Door Forced Opens / Access Grants
There is no reporting capabilities for Test Modes

Device Groups within User Permissions
• User Monitor Permission Group may utilize Device Groups to restrict which devices can
be influenced by an Alarm Monitor Operator action

Missing Device Groups?
Alarm Monitoring will only show the Alarm Monitoring user the Group if
all the devices included in the Group are visible and controllable by the
user
Devices could be excluded via
• Segments
• Monitoring zones
• The user permission ‘The user cannot control..’, as per last slide

Device Group - Test Mode

Action Types
and
Action Groups

Action Groups Defined
An Action Group contains one or more Action Types that will be executed simultaneously
An Action Group Library contains one or more Action Groups
• The Action Group created is listed in the Action Group Library
System Administration User Guide – Appendix A lists all the available Action Types
LS Linkage Server is required

Action Group Library
Action Groups can be used in other System

Administration features such as
• Scheduler
• Global I/O
• Guard Tour
• Alarm Acknowledgement Actions
• Note: Not all Action Types are available in all configuration

locations

Action Group Library
Select Action Group Library under the Administration
program menu in System Administration
Click on Add

Action Types
Click on Add to add the Action Type(s) to the Group
Select the Action Type

Action Types
Select the corresponding components or features for the

selected Action Type
Click OK to save

Action Types
Checkmark the appropriate Monitor

Zone
Click OK

Action Group - Monitor Zone Configuration
Monitor Zones may be configured to include

Action Groups in the Alarm Monitoring system tree
The Action Group may be directly executed

through right click menu

Scheduler

Scheduler
Scheduler is useful to manage one-time actions such as a database download or

unlocking a reader for a once a month meeting in a conference room
Action Types can be selected
• A description of each Action Type can be found in the System Administration User Guide under Appendix A
LS Linkage Server must be configured and running
• Schedule does not reside on the Access Panel(s)

• If upstream communication is lost, scheduled item will fail
• Linkage Server is configured under Administration > System Options

Scheduler Configuration
With the correct user permissions, Scheduler

may be launched from:
• System Administration > Administration > Scheduler
• Alarm Monitoring > View > Scheduler

Scheduler
Service Status indicates LS Linkage Server status

and Host Name is the computer running the service
Time Zone selection shows current time in a

specific world time zone
• For reference purposes only

Scheduler
• Click on Add and select the Pulse Open Door Action Type
• Click Next to select your Server Room Reader

Scheduler
On the Schedule tab, select Recurring and click on the

Change button
• One time only can be selected and set with an appropriate date and time
• Schedule can be Disabled using checkbox

Scheduler
Schedule the Occurrence
• Daily, weekly, monthly
Schedule the Frequency
• Occurs once or Occurs every quantity of minutes

or hours, starting at and ending at specific times
Schedule the Duration
• Start and end date
Schedule your action to occur every

one minute

Scheduler and Alarm Monitoring
Scheduler will attempt to perform

configured action at scheduled time
• Failures will be logged and may be examined
by right clicking on scheduled item
Right click to View Action History
Right click to Disable Action

Schedule Reports
• Scheduled reports allows for selection of file format output

Local I/O

Local I/O
Local I/Os automatically trigger specified output action(s), called a

Function List, based on the selected event(s) occurring
Local I/Os are confined to a single access panel
• They do not span across multiple ISCs
Function Lists are configured per access panel
• Up to 100 Function Lists are supported per ISC

• These are stored on the ISC

Local I/O
Functions allow control of:
• Activating alarm panel outputs

• Activating reader outputs
• Masking/unmasking of alarm groups
• All Reader Lock/Set Mode
• Opening/closing areas
• Chaining multiple function lists together
• Dialing back to the host computer when upstream
communication for access panels is set to dialup
• Activating Two Man Area Control
• Unlocking readers or setting reader mode
• Testing for active alarms in alarm group
• Used in conjunction with Alarm Group
unmasking to provide intrusion detection panel
functionality

Local I/O
Functions allow control of:
• Timezone Activate/Deactivate
• Temporarily activates a timezone until the next
timezone interval occurs
• Temporarily deactivates a timezone until the next
timezone interval occurs
• Timezone Override
• Permanently activates a timezone until the release
override occurs
• Permanently deactivates a timezone until the release
override occurs
• Triggered by right clicking on the ‘Timezone Override’
Local I/O function in the System Status window in
Alarm Monitoring
• Ability to release the timezone override (choose Pulse)
• In OnGuard 6.5 the release override capability was
not available

Local I/O
• Timezone activate/deactivate function behavior
• Timezone override function behavior

Local I/O
All Reader Lock/Set Mode
• All Reader Lock/Set Mode function allows the reader mode for all readers on a
specific controller to be simultaneously controlled for a specific period of time
• 1 to 48 hour incremental range

Local I/O
All Reader Lock/Set Mode behavior
• Set true
• Sets all readers on the controller to Locked for the time specified in
argument 2
• Set false
• Sets all readers on the controller to the mode selected in argument 1 for
the time specified in argument 2
• Set pulse argument 1 mode selected
• Set all readers on the controller back to the online mode configured in the
reader configuration plus any timezone changes
Note: The reader mode may be manually changed in Alarm Monitoring.

This will remove the locked override mode of the reader and will return the
reader to the selected reader mode

Local I/O
All Reader Lock/Set Mode puts the readers in an ‘Override

Reader Mode’ which overrides the standard reader mode
• Any Timezones, Schedules, or I/Os that normally change the reader mode will be
ignored when the card reader is in Override Reader Mode
• Any programmed changes to the reader mode are tracked by the access panel but
not applied to the card reader
• When the override is aborted or expires the reader mode, as tracked by the access
panel, will be restored
• This applies to First Card Unlock and Double Card Unlock/toggle features as well

Local I/O
Once the Function is selected then a corresponding Argument(s) must be

selected
Up to six (6) functions can be selected per List

Local I/O
Take note of the Function Behavior box listed at the bottom
• Set True
• Set False
• Pulse

Local I/O
Select Local I/O under the

Access Control program menu
Click on Add
Name the I/O
Select the ISC

Local I/O
Select the Function
• Activate Reader Output
Select Argument 1
• Specific Reader
Select Argument 2
• Auxiliary Output
Repeat up to 6 times
Click OK

Local I/O
Local I/Os may be executed via:
• Alarm Monitoring by right clicking on the Local

I/O and selecting Execute
• Device Linkage (second tab under Local I/O)
• Scheduler
• Action type: Execute Function List
• Command Programming
• Instant Commands
• Area count
• Alarm mask group count
• Alarm Acknowledgment

Local I/O
Device Linkage options include:
• All alarm points

• Inputs
• Door Forced Open
• Door Held Open
• Communications loss to downstream devices
• Host communication loss
• Loss in communication to workstation running the LS Communication
Server
• Access activity
• Cabinet Tampers
• Power Failure

Local I/O
Input actions on state change can be configured to
• Do nothing
• Set true
• Set false
• Pulse
Based on the Function Behavior box on the Function

Lists tab

Local I/O
Select Access panel from the drop-down list on the second tab under Local I/O
Select a Device on the left side
•LNL-1100
Select a Function List on the right side
Click on the Link button

Local I/O
Select the appropriate

Logical Event
• Each Logical Event can be
linked to only one Function
List
Select the appropriate

Take Action(s)
• Do Nothing
• Set False
• Set True
• Pulse
Click OK

Local I/O
Device and Function are linked
To Modify or Remove the link, click on the link to access the

Modify Link or Remove Link buttons
• Double clicking on the link opens the tree to display specifics contained within the
link

Local I/O and Alarm Monitoring
Activate the Device (Input) to trigger the Function List and

view results in Alarm Monitoring
Activate the Function List manually by right clicking on the

function in the System Tree

Global I/O

Global I/O
Global I/O functionality allows linkage between Access

Panels and downstream hardware system wide
• Configuration includes
• Global Linkage
• Input Event
• Output Action
• Utilizes the LS Linkage Server for Global I/O execution
• Global I/Os are not resident on the Access Panels
• Global I/Os are server based

Global I/O
Select Global I/O under Access Control program menu
Click on Add and enter a Name

Global I/O
Global Linkage
• World Time Zone

• Defines world time zone that the LS Linkage Server
will use to execute based on the OnGuard Timezone
assignment
• Timezone
• Defines allowable times when Global Linkage will
execute based on world time zone
• Always
• User defined
• Never – Could be used to disable Global I/O
linkage

Global I/O
Event Timestamp Tolerance
• Sets a user specified timeout period for a linkage which

indicates how long after an input is activated it will remain valid
and can cause an output action
• 3 Minutes is the default time

Global I/O
Logic correlation time period
• When creating a linked alarm event (And

Logic), set this to the maximum number
of seconds between each event
occurring
• This is a rolling time limit where the
time period resets after each
correlating event occurs
• Valid range 1-999 seconds
• Defaults to 10 seconds
• If each event transaction occurs within
the logic correlation time, the output
action is triggered

Global I/O
Click on Add to
add Input Event(s)
• Event is required
• May individually add
more inputs to be
linked to same output
action(s)

Global I/O
Devices may be optionally assigned
•All field hardware
Badges may be optionally assigned
•One badge number per configuration

Global I/O: “And / Or” Logic
Requires two or more input (event) transactions in a pre-configured time

(Logic correlation time period) in order to generate the output event(s)
• Not a state-based AND operation
• All inputs must report active, but do not have to remain active
• Inputs are ‘transaction’ based NOT ‘Alarm State’ based

Global I/O: “And / Or” Logic
Multi-layer AND/OR hierarchy may be created
• OR gates feeding an AND gate

• The AND gates feeding an OR gate
• Limited to OR-AND-OR relationship

Global I/O: “And” Logic Group
Two or more inputs must be selected, checkmarked,

to initially create an “And” Logic Group
• An OR logic group will also be automatically created

Creating Logic Groups
The automatically created ‘OR’ group represents that

the Input Event window was originally an ‘OR’ window
• It also allows you to follow the logic of any inputs added to the window
after the ‘AND’ was created
Logic Diagram

Global I/O: Multiple Logic Levels
• Up to 3 logic levels may be created
“OR” logic group

allows multiple conditions
to trigger execution

Global I/O: Modifying Inputs in Logic Groups
Inputs may be dragged and dropped between logic groups

using a mouse
• As long as moving the input does not violate the logical operation
• Example: There MUST always be at least 2 inputs in an ‘AND’ group
Logic groups may be deleted
• User will be prompted for keeping the inputs belonging to the group

Global I/O
Click on Add to add

Output Action(s)
• Choices include
• Action Types
• Action Group Library
• Control action
• Action dependent on selected
item
Click OK to save Global

I/O

Global I/O and Alarm Monitoring
Trigger the Global I/O Input Event
View the results and associated events in Alarm Monitoring

Global I/O – Additional Output Actions
Deactivate Badge
• Deactivates any badge

based on a specified Input
Event(s)
• New Badge Status
automatically assigned
• Use List Builder to add
more Badge Status values

Local I/O may be linked to Global I/O when Execute Function

List is selected for the Output Action
• Execute: True
• Execute: False
• Execute: Pulse

Grant / Deny Action Type
Launches pop-up on any access related event
Grant access or Deny access to the output action reader selected

Generate Event
Custom text alarm generated in Alarm Monitoring as

an output action
• Useful for creating a custom alarm text for the AND/OR linkage

Global I/O: Generate Event Text
Configuring event text
• Select configured text using dropdown

• Contents added in Text Library under Administration
• Events can be typed in the given area
• Automatically added to Text Library

Global I/O: Generate Event Text
Generate Event Text and Alarm Monitoring
Trigger Global I/O with Generate Event as an Output

Action to view the results

I/O - Knowledge Check
Knowledge acquired in this section should

include:
• Knowing the difference in functionality between a
Local I/O and a Global I/O
• How to add / modify a Function List
• How to link a Function List to a Device
• How to add / modify a Global I/O
• How to create a Logic (and/or) Global I/O
• Knowing the associated alarms and events in Alarm
Monitoring when using I/O’s
✓ What service(s) is required for Global I/O’s to work?

First Card Unlock

First Card Unlock
Configure OnGuard to cause a door to remain unlocked

when Access is Granted to a cardholder
• Limit the time of day when this can happen

• To have that door re-lock based on time or another event
• To be able to specify the badges that carry this authority
Referred to as ‘Snow Day’ functionality
• To keep a door secured in the event of a ‘snow day’ unless the first badge
that has access to a reader places the reader in unlock mode

First Card Unlock
The reader will change to unlock mode when the first

badge is presented
• Any badge
• An authorized badge
• Based on access level permission
This differs from Double-card unlock as normal single

card presentation at the reader is all that is required
• Other than opening the door there is no specific cardholder action
required
Not viable for use with Double-card Unlock function

First Card Unlock
Option enabled at each ISC/Access Panel
Enabled on a per reader basis
• At the configuration of the reader

• If it is desired that First Card Unlock mode is the reader default
Manually enabled through Alarm Monitoring
• Right click on the reader and select Reader First Card Unlock Mode
Enabled during a timezone
• Configured under Timezone/Reader Modes

First Card Unlock

First Card Unlock
To unlock a reader by any valid badge
• Select First Card Unlock at the access panel

• Enable First Card Unlock
• In Alarm Monitoring, select a reader and enable
Reader First Card Unlock Mode or
• Configure a Timezone/Reader mode and enable First
Card Unlock at either the start or end of a timezone
• The first badge that has access to the reader will be
able to change the reader to unlocked mode
• Present the badge to the reader
• Open / close the door to unlock the reader

First Card Unlock
• Timezone can be applied to determine when reader will switch to first

card unlock mode

First Card Unlock
• To unlock a reader by an authorized badge
Enable First Card Unlock Enable First Card Enable First Card
• In Alarm Monitoring, select a Unlock Authority Unlock Authority
reader and enable Reader First Required • User Commands
Select First Card
Card Unlock Mode or • Reader settings within Access
Unlock at the
access panel • Configure a Timezone/Reader Levels
mode and enable First Card
Unlock at either the start or end of
a timezone

First Card Unlock
To unlock a reader by an authorized badge

continued
• The badge that has an access level with First Card Unlock
Authority enabled will be able to unlock the reader that is
configured for First Card Unlock Authority Required
• Present the badge to the reader
• Open / close the door to unlock the reader

First Card Unlock Authority
• Enabled per Reader and within Access Level

First Card Unlock
Other features can enable or disable First Card Unlock by

selecting Reader Mode within the Add Action Wizard
• Global I/O
• Enabled as an output action
• Alarm Acknowledgment Actions
• Guard Tours
• Enabled within Checkpoint Actions of the Tour Wizard
• Scheduler

First Card Unlock
• May be moved into and out of First Card Unlock mode by an Action

Double Card Unlock/Toggle

Double Card Unlock/Toggle allows the ability to

alternate unlocking/securing an Access Series reader
• Feature enabled on the Mercury Series 2 and X Access Series
controllers
• Authority given in access levels
• Feature enabled on a per reader basis

Double Card Unlock/Toggle is a reader that is in ‘Override

Reader Mode’ which overrides the standard reader mode
• Any Timezones, Schedules, Local I/O or Global I/O’s that normally change
the reader mode will be ignored when the reader is in Override Reader
Mode

The default time that the reader will remain unlocked is

1440 minutes (24 hours)
• The default time can be changed in the acs.ini file

• c:\Windows\acs.ini
• Start > run > acs.ini

The described setting must be added to, or updated in, the

[CommunicationServer] section of the ACS.ini configuration
file on the machine running that controller’s
Communication Server
• LenelDoubleCardUnlockTime
• The amount of time that the reader will remain unlocked may be
configured through a ACS.INI setting on the LS Communication Server
workstation before reverting back to the last secured mode
• LenelDoubleCardUnlockTime=1440 (in minutes)
• Default is 1440 minutes (24 hours)

Second time attempt must be performed within 5 seconds

at the reader
• Same badge ID presented two times with proper access and Double Card
Unlock/Toggle authority
• The door position switch, DPS, (opening of door) has no bearing on the
feature

Reader modes supported when using Double Card

Unlock/Toggle
• Card only
• Card and PIN
• PIN or card (only if a card is used)
• The feature does not support entering a pin twice within five seconds
of each other
Unsupported modes
• Locked
• Unlocked
• Facility Code Mode
• Cipher Mode
• PIN / PIN

Access panel option
• Feature enabled on the controller

• System Administration > Administration > Access Control > Access Panels

Reader setting
• Feature enabled on a reader by reader basis

• System Administration > Administration > Access Control > Readers and Doors

Access level permission
• Enables the feature to be used

by the cardholder
• Enabling the feature will impact
any readers that the Double
Card feature is enabled
• Any badge that has an access
level with this feature enabled
will have Double Card Authority
• As it is with all User
Commands

To release a reader that is in Override Reader Mode, the

following can be done
• Wait for the default timeout of 24 hours that is configured in the acs.ini file
• Right click in Alarm Monitoring and change the reader access mode
• Present the authorized badge twice at the reader to put the reader back to
the original mode

Map Designer

MapDesigner
MapDesigner provides a straight forward way to associate system hardware with

a map in Alarm Monitoring and OnGuard Monitor web module
Detailed maps can be created which show all the access control hardware
Alarms can be configured to automatically display a map in Alarm Monitoring
Map icons may be used to control the alarm point by right clicking on the icon
Maps can be printed

Icon Library
Displays all the icons and icon groups currently available for use
within MapDesigner
• New icons and groups may be added
• Icons are assigned to the groups

Icon Library
Devices in MapDesigner can use

either a default icon or icon group
• Icon groups allow the device to change the
way it looks on the map based on the state
the object is in

Creating a Map
Steps to create a map
• Log on to MapDesigner
• Load a graphic file representing the map background
• Supported file formats include AutoCAD DXF (.dxf), .JPG,
.BMP and more
• Click and drag the hardware icons onto the map to
correspond with their physical locations in the facility
• Add a text label for the map
• Save the map to the database

MapDesigner Window
List Window
• Shows the current system

maps
• Shows the hardware in the
database
Map Window
• Displays either the new map

being created, or the map
that is highlighted in the list
window

Customizing Maps
Place text on the

map
• Can be a title or other
reference
• Define the font, style,
size, and color of the
font to be used

MapDesigner
• Changing the size of a device label will have a global effect on all the labels

MapDesigner
Text can be added to appear when you mouse over the device
• The text is visible in Alarm Monitoring and OnGuard Monitor web module

MapDesigner
Map Hierarchy
• Maps can be linked together to highlight a special area on the map

• You can double click to navigate through multiple maps

Using Maps in Alarm Monitoring
Manually open the Map in Alarm Monitoring under View > Map
Selection
Maps can be configured to automatically display in Alarm

Monitoring when an alarm occurs (next topic)
Maps can control hardware through right clicking on the device

just like the System Status Tree
Maps display active alarms
Icons dynamically change
Mouse Over icon to view text

Using Maps in Alarm Monitoring
Alarm notification
and Icon changes
Right click
functionality

Map Printing
Maps are able to be

printed by selecting
• The print icon from the
toolbar
• The print choice from the
File menu

Mouse Over Tool Tips
Alarm Monitoring maps display a mouse

over tool tip window for map icons
• The tool tip window displays
• The device name
• The device status
• Any optional text to provide additional information
for Alarm Monitoring operators

MapDesigner
Map Icons
• Single icons may be used for all device states

• Icon groups use different icons for each hardware state

OnGuard Monitor

OnGuard Monitor v1.3.338
What it does:
• Provides limited* web-based Alarm Monitoring

capability for OnGuard
• Features at this release:
• Maps
• Alarm Queue View & Manage
• Hardware View & Control
• Verify Cardholders (not modify)
• Live Video streams
• LNVR, UltraView & Milestone
• Customize Screen Layouts
• Saved views
• User Settings/Preference
*Intended for light use only – see release notes

OnGuard Monitor - Monitor Zones
Monitor Zone’s for Monitor
• Build a custom Monitor Zone that contains only devices and events to be managed via
the Monitor Module
• Webpages cannot handle the processing speed of the Alarm Monitoring Client
• Alert provided if no Alarm Monitoring zone exists

OnGuard Monitor Operation
Default Views
• All Alarms
• Badge/Access Alarms Only
• Non-Badge/Access Alarms
• Pending
• Hardware Tree
Custom view (only)
• Video
Monitor Zone selection
• from Gearwheel

Log off Dynamic Alarm Filter

Live or Historical
Trace Selection
Column
Selector
Views
Actions for Alarm or

hardware
Custom
View
Layouts Alarm Pending /
Priority Acknowledgement
status
Monitor Zone
Selection
Alarm Selection(s) for multiple

Alarm Actions

• Badge/Access Alarms
• Additional cardholder information Available

• Hardware Tree View
Status Ribbon
Dynamic Device Filter Status Summary and

hide status
Hardware
Control menu
Expand/Shrink Device Status, Operation mode,

hierarchy Alarms waiting counters and Device name

OnGuard Monitor Custom Layouts
• Map View
Dynamic Device Filter
List of Device count

system maps on each map

• Device control legend
View video linked

to this device
View All maps

for a device
Zoom
control
Device status
Device control
Open door
Open pending
alarm panel
Perform
hardware action

• Map devices list
Refresh Device status

New Views Layout
• ‘Custom’ to expand and select existing custom

views
• ‘New Layout’ to build Views
View Widgets
• Alarm Queue Views

• Live or Historical Trace
• Hardware Listing
• Cardholder Verify
• Video Tile
• Map

Select Custom > New Layout
• Provide suitable name
Provide name for Widget
• Select Widget Type

Alarm Type Widget
• Provide a suitable name

• Select types of alarms to include
• All Alarms
• Badge Only
• Non-Badge
• Select a Date range for historical Traces
or remove date for live

• Hardware Type Widget


• Cardholder Verify Type Widget


Video Tile Type Widget

• Select one or 4 cameras
• Select Video source(s)
• Live video streams only

Map* Type Widget

• Select Map

Custom View Layout
• Rearrange Widgets by dragging tabs around Browser

• Save changes, Save a copy Hid this layout
• Layout / Widget can be sent to new Browser Window

Adding more Widgets to Layout
• Use the (+) button at the top-right of each existing Widget

window

Alarm Handling

Alarm Definitions Tab
Existing default system-wide alarms can be modified as needed
New customized alarms can be created
• These can be hardware and event specific

Associates a particular hardware device with an event
Alarm may be prioritized
• 0 – 255 priority levels

• Higher the number = higher the priority
• Can be sorted by priority in Alarm Monitoring
Alarms may be configured to have customized attributes
• Use F1 (help) for feature information

An alarm definition may

be created for
• Specific Devices
• Multiple Devices
• All Devices
• Use the “_Default_” device to
create an alarm for all devices
in the system
• Duplicate definitions cannot exist

Priority Tab
Assigns a color to a range of alarm

priorities for visual identification
• There can be different colors for alarm
assignment and acknowledgement
256 priority levels
• 0 – 255
• Highest priority is 255
Each line starts a new range of

color choice for priorities

Text Tab
Text instructions may be associated with an alarm giving

the operator a detailed description of what to do
Text acknowledgment notes provide a consistent set of

responses when acknowledging an alarm
Hyperlinks may be included

Audio Tab
Optional audio announcements may be

used to alert the alarm monitoring operator
• Notification
• Upon arrival of an alarm
• Instruction
• As part of the alarm acknowledgment
May use standard prerecorded files
• .Wav format is the only supported format
Audio may also be recorded real time

Alarm Configuration Tab
The following features can be optionally set on the alarm

configuration page per alarm
• Text instructions
• Audio instruction and notification files
• Password assignment for sensitive alarms
• Passwords can be assigned to either view and/or acknowledge alarms

Alarm Configuration Tab
Options for Alarms
• Map automatically opens

• Audio
• Text Instructions
• Priority Level
• Select Alarm Acknowledgment notes
• Other alarm configurations occur
• Active Alarm
• Mark in Progress
• Must Acknowledge
• Aggregate Alarm

Global Output (emails) Service
Global Output Service (GOS) routes manual and/or

automatic email requests from the Lenel application to
other 3rd party applications:
• SMTP servers for email requests

• Simple Mail Transport Protocol is an Internet standard used for sending
email transmissions across Internet Protocol (IP) networks.
• Other email servers may also be used
Email server and email account must be set up by email

server administrator prior to proceeding with GOS
configurations

GOS - Manual emails
*
Alarm SMTP Mail
Monitoring
GOS Server
Manual Process
(Alarm Monitoring Operator) Internet
Relay
*
Comm
Server Mail
Mail Client
Server
OnGuard
* Service

GOS - Automatic emails
*
Alarm SMTP Mail
Monitoring
GOS Server
Internet
Relay
* *
Comm Linkage
Server Server Mail
Mail Client
Server
OnGuard
Automatic shown in blue * Service

GOS Configuration - SMTP Server
• GOS SMTP Server Settings and Recipients

GOS SMTP Server Settings and Recipients
SMTP Server Settings
• Name: friendly name

• Host: Network name of the workstation
the mail server is configured on
• Port number (defaults to 25)
• Workstation: Network name of
workstation running LS Global Output
Service
• Authentication as required by the Mail
Server for Relay approval
• User Name: alarms (for example)
• Password: ***** (as appropriate)
• Sender name: OnGuard (for example)
• Sender’s email address:
alarms@training.com (for example)
• Enable/Disable TLS encryption

GOS SMTP Server Settings and Recipients
email Recipients
• Recipients
• Allows creation of a recipients list who
can be sent emails
• Add recipient email address
• Device
• Description
• Address (recognized by email server)

Sending a Manual email
Alarm monitoring station
• System wide connection to Global Output

Server (GOS)
Able to be performed from any

window displaying events and alarms
Right mouse click on an alarm
• Select email
• Custom messages can also be appended in
the body of the email
A single event may be sent to

multiple recipients

Sending an Automatic email
Linkage server is used to route email

requests from the Communication Server to
GOS
• Typically, a custom alarm definition is created for a

specific hardware device/event
• The definition is associated with email messages and
recipients
• When configuring email messages, the default
information regarding the specific alarm will be shown
in the subject and body of the email if left blank
• Otherwise, any appended additional messages will
erase default information

Messages Tab - Automatic email
Event data may be included with email,

see User Guide
For example
• %alarmDescription has occurred at %alarmTime

(MM/DD/YY) with a Priority of %alarmPriority at the
%deviceName
• Would appear (by way of example) in the email as:
Alarm Active has occurred at 10:57
9/22/20 (MM/DD/YY) with a Priority of 88
at the Reception Movement Device

Acknowledgment Actions
Allows an Action Type or Action Group to be executed

during the alarm acknowledgment process
• Action or Action Group may be executed
• For example, deactivating a siren upon the acknowledgment of an
alarm
Allows a Local I/O function list to be executed during

the alarm acknowledgment process
• Execute Function List Action can be chosen from Action Types
• Execute: True
• Execute: False
• Execute: Pulse

Acknowledgment Actions
• Acknowledgment time limit may be configured to prevent execution

after a period of time lapses
• Zero sets no limit

Advanced Alarm Handling Options
One of two alarm handling options may be configured per

alarm definition
• Alarm highlighting
• Displays pop-up window after a pre-configured period indicating that an
alarm has not been acknowledged
• Alarm forwarding
• The alarm will be forwarded to another alarm monitoring station after a pre-
configured period
Dependent services
• The LS Communications Server is used to forward hardware related alarms

• The LS Linkage Server is used for non-hardware related alarms
• Mustering alarms
• OpenIT events

Alarm Highlighting
• Failure to Acknowledge tab – Perform Action

Alarm Highlighting
A dialog box will pop-up in Alarm Monitoring when the alarm

has not been acknowledged in the configured time frame
• Option to silence the reoccurrence of select alarms for the snooze interval
• Snooze
• Snooze all

Alarm Forwarding
Alarm forwarding may be configured per alarm definition
• The alarm will be forward to another alarm monitoring station after a pre-configured
period
• Uses the time received by the Alarm Monitoring program
• Queued events in DB follow same received rule

Alarm Forwarding
• Monitoring Stations – Alarm Forwarding

Alarm Forwarding
Alarm monitoring includes two columns that may be configured to display
• Workstation
• Workstation that events are forwarded from
• Time received
• Date/time when event was received by the Alarm Monitoring station the event was forwarded

Alarm Forwarding
Monitoring station that alarms are to be forwarded to

must include the hardware in the monitor zone
• Event routing may be used to control suppression of events except when
forwarded
• Event routing time zones do not affect forwarded events
Alarm icon indicates forwarding status in Alarm

Monitoring
• Routed In
• Routed Out
• Failure to Route

Alarm Forwarding
Set Forwarding action type allows alarm forwarding

to be scheduled
• Choose source monitoring station
• Choose monitoring station that events are to be forwarded
• Set station to None to configure the system to stop forwarding

Invalid Badge Event

Invalid Badge Event
Invalid badge events will have the badge status

appended to the event description for inactive badges
• No status will be appended on an active badge that is generating an
invalid badge event
• Standard invalid badge event will be generated on an active badge
due to no access levels assignment

Invalid Badge Event - Basic
Cardholder option must be enabled
• Use invalid badge event text
Report badge as being lost or stolen
• Deactivate badge for cardholder
Invalid Badge alarm
• Alarm description format dropdown can now be edited

• Event Text Only
• Alarm Name Only
• Alarm Name – Event Text
• Event Text – Alarm Name
Refresh Alarm Configuration in Alarm Monitoring

Invalid Badge Event - Options
• Enable Invalid Badge Event Text in General Cardholder Options

• Set by default

Invalid Badge Event - Options
Badge statuses requiring special handling will

need an exact entry match in the Text Library
Special alarm handling may be configured
• Alarm definition will need to include text

• Global I/O will need to include text as the trigger for an
action execution

Invalid Badge Event – Advanced Options
Cardholder option must be enabled
• Use invalid badge event text
Create Badge Status entry
• Badge Status entry must match exactly entry that is to be referenced in

Text Library
Create Text Library entry
• Directly from Text Library or Alarm Definition or Global I/O
Create custom alarm definition and/or create

Global I/O

Invalid Badge Event - Text Library
• Text Library and List Builder entry must match

Invalid Badge Event - Alarm Definition
• Event Text (as built in Text Library) can be selected with Invalid Badge
Event
Alarm description
format controls
Name of Alarm in
Alarm Monitoring

Invalid Badge Event - Global I/O
• Global I/O can be Invalid Event text specific and/or Badge Number
Specific
(Optional)

Invalid Badge Event – Advanced Options
Active badge with at least one access level • Access grant
Badge not in Access Panel (ISC) Database • Invalid badge
Active badge with no access levels assigned • Invalid badge
Badge marked as Lost (with Cardholder Option • Invalid badge – Lost

enabled)

Uses of Event Text
Events that may be configured with event text
• Generic event
• Invalid badge
• Option must be enabled in Cardholder Options
• License expiration
• Used by training and demonstration licenses only
• Unknown user command
• Covered later in this class
The above are also configured with Event text

as custom alarms if required

Areas and Anti-Passback

Anti-Passback Overview
OnGuard supports either Local or Global

Anti-Passback (APB)
• Local Area Control & APB
• Tracked and controlled by access panel
• Global Area Control & APB
• Tracked in DB and controlled by Communication Server

Local Anti-Passback
Access Control
Panel
Inside Area
1A 1A 1B 2B 2A
Outside Area

Global Anti-Passback
Access Control Access Control

Panel 1 Panel 2
Inside Area
1A 1A 1B 2B 2A
Outside Area

Types of Anti-Passback
Three Types of Anti-Passback scenarios
• Soft
• Access is still granted and APB event is generated if system thinks you are
not in “Area Leaving”
• Hard
• Access Denied into “Area Entering” if system thinks you are not in “Area
Leaving”
• APB event is also generated
• Timed
• Individual Reader (when no area is specified for the reader)
• Access denied to individual reader until configurable countdown time
expires
• Countdown time transfers to reader on every access granted event.
• Area
• Access denied to “Area Entering” until configurable countdown time expires
• Countdown time transfers to “Area Entering” upon access granted event at
an entering area reader

Soft Anti-Passback
Access Control
Panel
Outside Area
Then
Here 3 Inside Area
1A 2
1
Then Then
Here 4
Here Swipe
Again 1A 1B 2B 2A Here
Outcome = Access
Granted Anti-
Passback Violation

Hard Anti-Passback
Access Control
Panel
Outside Area
Then
Here 3 Inside Area
1A 2
1
Then Then
4
Here Here Swipe
Outcome = Access
Denied Anti-
Passback Violation

Timed Anti-Passback
Access Control
Panel
Outside Area
Then
Here 3 Inside Area
1A 2
09:40
09:41
09:42
09:43
09:44
09:45
09:46
09:47
09:48
09:49
09:50
09:51
09:52
09:53
09:54
09:55
09:56
09:57
09:58
09:59
10:00 1
Then Then
4 Swipe
Here Here
09:50
09:51
09:52
09:53
09:54
09:55
09:56
09:57
09:58
09:59
10:00
09:50
09:51
09:52
09:53
09:54
09:55
09:56
09:57
09:58
09:59
10:00
Outcome = Access
Denied on 1A reader
(for 10 mins)

System or Segmented Options
Non-Segmented system Segmented system
Local areas by default

Check settings in Anti-passback tab

Setting up Local APB
Local APB is setup in several steps
• Enable Store Area Anti-Passback Locations at Access Panel

• Create/Set up Areas
• Associate readers to anti-passback areas

Enabling at the Access Panel
• ISC Options

Local Areas
A Default local area will be created for every panel

in a system/segment when a panel is added
• All Badges start in the Default area when added to a panel
• WARNING: All Badges are placed in the Default area when a
database download is carried out
• Default Areas cannot be deleted but can be renamed for
convenience
• Usually no area features should be configured for default area
Local Areas may not span Access Panels

Local Areas
• Area Configuration form

Creating a Local Area
Select the Access Panel (ISC) for the area
Define area rules
• Anti-passback readers associated with the area will be listed once

readers are configured
• Interlock
• User Counting
• Two man control
• Maximum occupancy
• Close Area
• Occupancy actions
• Function list

User Counting
• Setting count to zero disables feature
• Access is denied when maximum occupancy is reached
• Two man control
• None: Feature disabled
• Standard: Two cardholders must be in the area at all times
• Other options available are Special Area Rules which is
enabled at the access panel
• Close area
• Manually closes area to any card access

Occupancy Function Actions
• A Local function list may be set to activate based on

occupancy
• Minimum count
• Local function executes when the number of occupants
decreases to the amount specified
• Maximum count
• Local function executes when the number of occupants
increases to the amount specified

Timezone/Area Modes
• Doors associated to areas can be configured to open or close based on the start and
end timezone

Setup Local APB Readers
Area Configuration Rules
• Area entering
• Updates badge being used with new area
• Required configuration
• Area leaving
• Checks for APB violation
• Free pass negates this check one time
• Cardholder must be in this area before access to area
entering
• Not required
• System has choice for ‘Don’t care’; equivalent to blank

Local APB Readers
Anti-Passback tab in reader configuration
• Area entering
• Move the badge to this new area
• Area Leaving
• Badge must be in this area to use the reader (for Hard
APB)
• Use Soft anti-passback (APB not enforced)
• Timed Area anti-passback
• Configured for areas enforcing Timed APB
• Timed anti-passback setting (minutes)
• Actual time limit for the same badge using the reader
twice in a row

Timed Anti-Passback Configuration
Timed APB
• Enable Timed APB at the Access Panel

• Set up time limit at the readers
• Areas may be used with Timed Area APB option set at the
reader
• In this case you will also need to create areas

Local APB Readers
• Area / Anti-Passback settings for each Reader

Reset Local Anti-Passback
Reset APB Status
• At the start of a timezone

• Cards will be able to access
APB areas at the start of the
configured timezone
• Reset Now
• Resets APB immediately for
all cards for all panels in a
non-segmented system or
for all cards for all panels in
a particular segment

Local Area Interlock
A multiple door interlock may

be created using Local APB
• For any door in the area if either the
door strike is active or the door is
open, no other door may be opened
to leave or enter the area
• Typically used with magnetic locks
in order to secure the interlock

This option requires
• LNL-X4420/X3300/X2220/X2210 Access Panels

• Or legacy LNL-4420/3300/2220/2210 Access Panels
• System configured with local areas
• Reader tab for APB is used for configuration
• If Global APB is enabled Local Area Interlock will be unavailable
When the area interlock is active (a door is open),

any additional request for access will be denied
• An event will be indicated in Alarm Monitoring
• LED’s on the door reader(s) will show that an access request has
been denied

Enable ‘Store Area anti-passback location’ on the access

panel
Configure areas
• System Admin > Access Control > Area

• Select ‘Interlock all doors in area’ for each area configured for the interlock
• The area prior to entering the interlock area
• The interlock area
• The area entered once you leave the interlock area
Associate readers to areas
• Configure ‘Area entering’ and ‘Area leaving’

• Readers and Doors > Anti-Passback tab

• Typical Interlock Area Events

• New ‘Interlock Area Busy’ Alarms will appear if attempts are made to violate the
Interlock rule
• Exit Request Buttons (REX) are disabled on doors forming an

Interlocked area if another door is open

Global Anti-Passback
Global Anti-passback may be enabled system

wide or may be enabled per segment
• Global and Local Areas are not supported simultaneously
in a non-segmented database or in the same segment in a
segmented database
• Global Area Control utilizes the LS Communication Server
to track and enforce APB

Global APB
Decision to grant / deny access will be made

at the database when using Hard APB
• If reader is configured for APB
• Decision based on APB location
Decision to grant / deny access will be made

by the access panel when using Soft APB
• Decision based on access level
• Anti-passback event generated after the access event is
received by the database

Setting up Global APB
Global APB is setup

in several steps
• Enable Global anti-
passback
• Create/Set up Areas
• Associate readers to anti-
passback areas

Global Areas
Areas may span Access Panels
• Not associated with an access panel
Some area features disabled
• Two man control

• Function list activation
Global Area types
• Normal (Similar to a local area)

• Hazardous (only used with Mustering)
• Safe (only used with Mustering)

Global Areas
• Area Type selection for Mustering (see later)

Global APB Readers
Global APB reader configuration
• Similar to Local APB reader options

• Timed Area APB not available
• Timed APB is available but reader must not be
associated to an area
• Host Decision Offline Mode
• Global areas require access to Database, so we need
to set the behavior when the database is offline
• Deny entry
• Allow entry on badge status and Access Levels alone

Host Decision Offline Mode
For Hard APB only, when the panel is

offline from the OnGuard database
• Access panel will attempt to make access decision
through the LS Communication Server for 15 seconds
• Reader blinks red/green during this time
• After 15 seconds of database inaccessibility, the offline
state is then enforced based on the configuration of
anti-passback at the reader
• Access will be denied for all cardholders (default)
• Set Make Local Decision at Panel which will suspend
APB and access will be based on access level

Global APB Readers
• Offline Decision for ISC unable to reach LS Communications Server for

access decision

Alarm Monitoring
Areas
• Occupancy report
• Displays cardholders in area
• May be manually refreshed
• Move badges
• Allows moving cardholder to
selected area

Global Anti-Passback Features
Allows current cardholder displayed
• One Free Pass

• APB not enforced for first access attempt
• APB Move Badge
• Allows badges to be moved from the current
area to a new area
• Notes may also be logged
• Display Global APB Areas
• Displays the Global APB areas for all badges of
the currently displayed cardholder

Anti-Passback Features
• Cardholder Area Control/Display

Global APB Reset
Reset Now
• Allows one Anti-assback violation for each badge

• Ignores existing area for next use of every badge
Listed as an Action in scheduler
• Global APB System/Segment Reset

Mustering
Global APB is the foundation for Mustering
Mustering requires at least two global areas
• Hazardous Location
• Safe Location

Visualization of Muster Areas / Locations
Normal Area Inside Area Hazard Area Safe Area

Mustering Area Types
Hazardous Location
• A danger area
• When Mustering is initiated, an occupancy report will be
generated showing cardholders in the Hazardous Location
• More than one Hazardous Location may exist for a Safe
Location(s)
Safe Location
• A safe area used to account for and assemble cardholders

leaving a Hazardous Location(s)
• More than one Safe Location may exist for a Hazardous
Location(s)

Hazard Location
Hazardous Location

• Tracked by the DB/Communication Server
• Normal areas may be associated and located within a
Hazardous Location
• Active area features
• Close area
Inside Area
• An area within a Hazard Location

Safe Location
Safe Location

• Tracked by the DB/Communication Server
• No area features enabled
• Cardholder must access the Safe Area reader
• Any event on the safe reader with the badge number will move
the badge to the safe area
• Area will update regardless of cardholder’s access levels during
Mustering
• Access Grant or usage of the door is not required
• Recommended Safe Area configuration
• Set area leaving as ‘Don’t care’
• Enable ‘Soft APB’

Safe Location
• Type of Global Area

Associated Safe Locations
Associated Safe Location
• Associates one or more safe locations with each Hazardous

Location
• A mandatory configuration when the following functionality is
required
• Muster Reset Area
• Removes all badges from safe area to a specified area when
Muster mode is reset
• Muster Start Area
• Area where badges are located when Muster mode is
initiated

Associated Safe Locations
• Mapping Associated Safe Areas to a Hazard Area

Associated Inside Areas
Associated Inside Areas
• Associates normal areas with

the Hazardous Location
• Muster report will list all badges
within the Hazardous Location
and all associated areas

Mustering Reporting
Muster Reporting
• Muster report shows badges

within the Muster area and
associated areas
• Alarm monitoring Muster Report
activation
• Immediate
• Time delay in minutes
• Minimum occupancy is reached

Safe Reader Configuration
Anti-passback tab in reader configuration
• Similar to all other APB reader configurations

• Specify Safe Area entering
Readers configured for Safe Area
• Specify Safe Area entering

• Automatically “Use soft APB”
• Automatically set Area Leaving to <Don’t Care>

Alarm Monitoring
Hazardous Location
• Muster report
• Real time display of cardholders in Hazardous Location and
optionally inside areas within the Hazardous Location
• Optionally removes all cardholders from Safe Area
Automatically refreshed every two minutes
• Shows last attempted location
• Start muster mode
• Starts muster mode for Hazardous Location
• Reset muster mode
• Stops muster mode for Hazardous Location and places
cardholders in the Muster Reset Area

Alarm Monitoring

Enabling Badge Exemption
Allows each badge to be set exempt for this feature
• Default is non-exempt
All users with view or edit permissions will see the APB Exemption option
control

Access Manager

Area Access Manager
Area Access Manager is an application allowing administration of

existing access levels to existing cardholders
An Area Access Manager user has control over specific access

levels that are assigned to the User under Administration > Users
Area Access Manager is access level oriented
This is a licensed feature

Area Access Manager
Browser-based Application-based
Access Manager Area Access Manager

Area Access Manager
Access Manager Users
• The Users for Access Manager must have

Access Levels assigned to them via Users
Module – Assignments
• Can be set to view-only
These permissions are shared with ‘Area Access Manager’ Thick and Thin clients

Area Access Manager
Open Area Access Manager and do the following:
• Assign a cardholder(s) to an access level(s)

• Remove a cardholder(s) from an access level
• View personal information concerning highlighted cardholder
Limited reports are initially available in Area

Access Manager for the user to run

Assign Cardholder
Select an access level from the dropdown box
Click on the ‘Assign Access’ button to launch a cardholder search

wizard
Select cardholder(s) to be assigned to the access level

Assign Cardholder
Select additional access levels, if needed
• Temporary access can optionally be given by clicking on the ‘Set

Activation Dates’ button

Remove Cardholder
Select an access level from the dropdown list
Select cardholder(s) to be removed from the selected access

level
Remove cardholder(s) from the access level by selecting the

‘Remove Access’ button

Display Personal Information
The ‘Personal Information’ button allows viewing of cardholder,

badge and access level information of selected cardholder
• No information may be modified
Notice there are

no Add, Modify, or
Delete buttons

Area Access Manager Reports
Area Access Manager reports
• Two default reports

• Access Level Assignments to Cardholders
• Access Level Assignments to Cardholders by Segment
• Additional reports can be added from System Administration under
Administration > Reports
• Modify the report and select type as Area Access Manager

OnGuard Access Manager v2.3.79
What it does:
• Graphical tile-based matrix of Access Levels available each

showing number of badges using it
• Filter and Search for Access Levels
• Assign Access Level to badge(s)
• Remove Access Level from badge(s)
• Bulk updates to multiple badges
• Approve/Deny Access Request sent via OnGuard Cardholder Self-
Service (CSS)

OnGuard Access Manager
• Standard View Dynamic Filter Add/Remove from badges
CSS
Approvals
view
Number of badges assigned this Access Level Select Access Level(s) to

add/remove from badges

Appling Access Levels
• Click on slider next to cardholder

• Green = Will be or is applied
• Grey = Will be removed or is
removed
• Click on Set + to apply start/end dates
• Select Start and End date
• Note graphical span of valid dates
• Type in Start and End time
• Press APPLY to save
If cardholder has more than one active badge click on

badges to apply/remove to/from each individual badge

Cardholder Self Service (CSS) Requests
• Access Status
• Submitted - when the request is unattended by the Approver
• Approved - When the request is approved by the approver
• On Hold - When the request is kept on-hold by the Approver
• Denied - When the request is denied by the Approver
Dynamic
Search
• Actions
• Approve
• Hold
• Deny

Destination Assurance

Global functionality allows timing the use of an initiating

reader to one of several destination readers
• Minutes before alarm specifies how much time after a cardholder enters an
area by an entrance reader before they must badge out at an associated exit
reader
• Maximum time 9999 minutes (approximately 7 days)
Must proceed to exit readers option enforces use of the exit

reader prior to any other reader
• Other readers may be accessed prior to the exit reader within the timeout, with
the option turned off
LS Linkage Server must be running

• Regular Use
• Within time = no alarm
‘EXIT’
Reader
‘ENTRY’
Time Line

• Must Proceed To Exit Readers enabled

• Alarm for each unexpected reader used
‘EXIT’
Reader
‘ENTRY’
Time Line

• Assign Route(s) and maximum time

Enabling Badge Exemption
Allows each badge to be set exempt for this feature
•Default is non-exempt
All users with view or edit permissions will see the Destination Exemption option control

Selective Cardholder (Badge)
Download

Selective Cardholder Download
By default every Badge that is Active with at

least one Access Level is sent to every ISC
Selective Cardholder Download allows for

selective badge downloads to the ISC
• Limits the number of badges residing on the ISC
• Reduces full panel download time
• Downloaded badges that are not assigned a selected
Access Level will be purged as other newer badges are
downloaded
• Useful for small-capacity third-party hardware

Allows for selective badge downloads to the ISC
• Limits the number of badges residing on the ISC

• Useful if you have Series 1 Access Panels with limited memory
• LNL-500, LNL-1000, LNL-2000
• Useful if you have a large cardholder database and want to
efficiently manage them
• Reduces full panel download time
• Downloaded badges that are not assigned a selected Access
Level will be purged as other newer badges are downloaded

To enable selective download, choose the access panel

and access levels that you want for the download
• Only badges that have the selected access level assigned will be
downloaded to the panel
• When the access panel cardholder capacity is reached, any additional
cardholders that don’t have the selected access level assigned will be
purged from the panel
• Number of cardholders to delete at capacity
• This will speed up the badge download process
• Allowable values are 1-99,999
• Remove expired badges daily
• Removes badges that have exceeded badge expiration date
• Processed nightly at 03:00

Display of access levels for a controller
• The access levels available for a Selective Cardholder Download are by default limited to
only those that have readers attached to the panel
• All access levels also available

• Show all access levels is automatically enabled when more than one
panel is selected

Selective Download Panel Indicator
The Alarm Monitoring icon will change on panels

that are configured for selective download
• The Access Panel properties will display the Selective
Download configuration
Badges presented but are not in the panel are

individually downloaded on a first in first out basis

Advanced Input Configuration

Debounce Time
Debounce time
• The amount of time (mS) required for the contact to remain

stable and accurately report a change of state of the input
• Configuration is relative time based on type of input
• General purpose alarm input (alarm panel, reader
interface alarm input)
• REX
• Door position switch

Debounce Time
Debounce values
• Default – used mainly for upgrading, and for hardware not supporting
configurable values
• Previous value used when upgrading
• 1 ~ 33 mS
• default for REX
• 2 ~ 67 mS
• 3 ~ 100 mS
• default for general purpose inputs and DPS
• 4 ~ 150 mS
• 5 ~ 200 mS
• 6 ~ 250 mS

Debounce Time
• Correct Debounce time
Contact Open
Debounce time Contact Bounce
Restored
150 mS
Alarm Alarm reported
Time

Debounce Time
• Debounce time too short
Contact Open
Debounce time Debounce time
Restored 67 mS 67 mS Contact Bounce
Alarm reported
Alarm Line Fault reported
Time

Hold Time
Hold time
• The hold time is intended to reduce multiple transaction

events from sensors that are likely to have many transitions
per incident
• Intended for general purpose inputs
• Extends the detection of the restored alarm
• Configured in seconds

Hold Time
Secure
A single restored event

will be generated at the
end of each hold time Alarm reported
Hold time
Single Alarm

Debounce & Hold Time Configuration
Configuration of Reader Controls, AUX inputs

and Alarm Inputs
• Assigning the EOL supervision configuration
• Debounce Time
• 1 lowest (33ms) - 6 highest (255ms)
• Default is 100mS except REX at 33mS
• Hold Time
• In seconds (1-15)

EOL Resistor Table
Allows configuration of EOL resistor

values for all OnGuard alarm inputs
• 4 Default values
• Default normally open
• Non supervised
• Supervised
• Default normally closed
• Non supervised
• Supervised 1KΩ
1KΩ
Supervised

EOL Resistor Table
4 Custom values
• Detectable resistance range

• Basic = 51Ω (minimum) to 12,499Ω (maximum)
• 10K (9,999 ohms) is the recommended maximum
resistance value for Normal high range however
values up to 12.5K are allowed but will affect
detection accuracy
• Advanced = 50Ω (minimum) to 25000Ω (maximum)
Supervised

EOL Resistor Table
Basic EOL
Common
Values
Advanced EOL

EOL Resistor Table
Custom configuration
• Basic
• Allows configuration of low and high range
• Allows selecting N/O or N/C contact
• Advanced
• Input status and resistance ranges may be defined
• Allows configuration of priority (low, med, high) for each monitored state
• During add or modify switching between basic and advanced will keep
low and high values.
• Default button
• Sets configurations to standard values

Basic Configuration
Basic default values
• Normal low range

• 750 to 1250 Ω
• Normal high range
• 1550 to 2500 Ω
Defined values
Unexpected 1K Ω Unexpected 2K Ω Unexpected
Short Open

Advanced Configuration
• Advanced default values

• Shorted loop • Active (alarm) input
• 0 (short) to 50 Ω • 1550 to 2500 Ω
• Foreign • Foreign
• 50 to 750 Ω • 2500 to 10000 Ω
• Inactive (secure) input
• Open loop
• 750 to 1250 Ω
• 10000 Ω to ∞ (open)
• Foreign
• 1250 to 1550 Ω
• Grounded input line
• Input A or B grounded
Defined values
0Ω Unexpected 1K Ω Unexpected 2K Ω Unexpected ∞Ω
Short Open

Status options:
• Inactive
• Active
• Fault – ground
• Fault – short
• Fault – open
• Fault – foreign voltage (abnormal resistance)
• Fault – non-settling (debounce time expires)

Resistance range
• Positive number representing a resistance value in ohms

• Drop-down selection
• infinite resistance
• shorted line
• ground line A
• ground line B

Elevator Control

Elevator Control Overview
LNL-1320 button interrupt elevator control
• 1-6 floors
• LNL-1320 Relays interrupt elevator floor selection button
LNL-1300/1324e* button interrupt elevator control
• 1-128 floors
• Uses LNL-1300 or LNL-1324e with LNL-1200 combination
LNL-1300/1324e* elevator control with floor tracking
• 1-128 floors
• Uses LNL-1300 or LNL-1324e with LNL-1100 and LNL-1200 combination
* LNL-1324e requires OnGuard 7.6 or later and X series ISC

Legacy LNL-1300e Support
LNL-1300e may be used where a LNL-1300

would otherwise be used, reader 1 only
• Product no longer commercially available
• Requires Series 2 ISC or later X series
• Requires OnGuard 7.1 or later

LNL-1320 Button Interrupt Example
N/C
ISC To
C
N/O
Elevator
Control
Room
LNL-1320 Elevator
Floor Button
1 2
Reader
1 2 3 4
3 4 5 6
5 6
This example shows a button interrupt setup that will allow the
cardholder to select floors 1, 2, 4 & 5 but only chooses floor 1.
LNL-1300 or LNL-1300e Button Interrupt Example
To
ISC Elevator
Control
Room
Elevator
Floor Button
1 2 3
4 5 6
1 2 3 4 5 7 8 9
6 7 8 9 10 10 11 12
Reader
11 12 13 14
LNL- 13 14 15
1300 15 16
16
~8 LNL-1200
This example shows a button interrupt setup that will allow the cardholder to
select floors 1, 2, 4, 5, 10, 12, 14 and 15 but only chooses floor 1.

LNL-1300 or LNL-1300e Floor Tracking Example
To
ISC Elevator
Control
Room
Reader
LNL-
1300
Elevator
Floor 1 2 3 4 5
Buttons 6 7 8 9 10
1 2 11 12 13 14
3 4 15 16
5 6
~8 LNL-1100 ~8 LNL-1200

Elevator Control Access Panels
Elevator Control must be enabled at the ISC for all types of elevator
controls
• Reserves memory in the ISC
• Allows readers to be configured for elevator control
LNL-2220 and LNL-2210 supports elevator controls for downstream

readers only (readers from LNL-1320 or LNL-1300 or LNL-1300e)
• On-board readers from the LNL-2220 and LNL-2210 cannot be configured as elevator
readers

Elevator Control Access Panels

Reader Setup
LNL-1320 Elevator Control
• Button Interrupt
LNL-1300 or LNL-1300e Elevator Control
• Button Interrupt
• Floor Tracking

Lenel LNL-1320 Button Interrupt
• Track floors not available

• Reader two disabled
• Additional elevator hardware not used
• On-board relays control outputs associated with elevator
floors
• Up to 6 floors supported
• Auxiliary inputs 1 and 2 are available and can be
configured under Readers and Doors


Elevator Control Levels and Access Levels
Comparing Access Levels and Elevator Control

Levels
• Elevator Control Levels
• Combination of Timezones, Relay Outputs and Floors
• 256 Elevator Control Levels Supported
• Elevator Control Levels used to configure:
• Elevator Access Level assigned to badge
• Day mode for free access to floors
• Access Levels
• Combination of Readers and Elevator Control Levels
• Elevator control level treated as a multi-floor timezone
• Standard readers and elevator readers may be combined into the
same access level

Elevator Control Levels

Elevator Control Levels

Using Elevator Control
Access Granted Events
• Pulses LNL1320 relays based on assigned Elevator

Controls
• Pulse duration is set by adjusting each reader’s strike
time

Using Elevator Control

LNL-1300 / LNL-1300e – Without Floor Tracking
Lenel LNL-1300 / LNL-1300e Button Interrupt
• Enable ‘Elevator Support’

• System Admin > Access Control > Access Panel > Options
• Select LNL-1300 / LNL-1300e Reader and select ‘Elevator’
• System Admin > Access Control > Readers and Doors >
General tab
• Both Reader 1 and 2 from the LNL-1300e support elevator
• Additional elevator hardware must be used
• Need the LNL-1200 Output Control Module
• Must be configured through the Reader Elevator Hardware tab


Activation of LNL-1200 relays control which

floor a cardholder will travel to
• Up to 8 LNL-1200 Output Control Modules for use in
elevator control to allow up to 128 floors
• Without Floor tracking selected, LNL-1200 is the only
hardware available

LNL-1300 / LNL-1300e – Adding Elevator Hardware

LNL-1300 / LNL-1300e – Renaming Floors
• Outputs may be renamed to match floor names

• System Administration > Access Control > Alarm Panels > Alarm
Outputs

Create Elevator Control Levels
• Assignment of Elevator Outputs to Floor to Timezone
Assign Elevator Control Levels to Access Levels
Assign Access Levels to Cardholders

LNL-1300 / LNL-1300e – Floor Tracking
Lenel LNL-1300 / LNL-1300e Floor Tracking
• Enable ‘Elevator Support’

• System Admin > Access Control > Access Panel > Options
• Select LNL-1300 / LNL-1300e Reader
• Select ‘Elevator’ & ‘Track Floors’
• One or both readers from the LNL-1300e can be selected
• System Admin > Access Control > Readers and Doors >
General tab


Additional elevator hardware must be used
• Must be configured through the Reader Elevator Hardware tab

• LNL-1100 and LNL-1200 required
• Up to 8 LNL-1100s and LNL-1200s can be configured per elevator to support
up to 128 floors
Elevator buttons wired to LNL-1100 inputs are linked to the

elevator control unit
• Used only for Floor Tracking
• Used to detect which floor has been requested

LNL-1300 / LNL-1300e – Adding Elevator Hardware

Rename outputs to reflect elevator floors
Create Elevator Control Levels
• Assignment of Elevator Outputs to Floor to Timezone
Assign Elevator Control Levels to Access Levels
Assign Access Levels to Cardholders

Custom Day Mode
Pre-defined floors have free access during

active day mode timezone
• Each floor may use a different time zone
• LNL-1320 will have output(s) energized
• LNL-1300 / LNL-1300e requires button selection
Day Mode Elevator Control assigned per

reader
• Access Control > Reader > Control Tab > Elevator Control
Settings

Custom Day Mode

Online Facility Code
Online Facility Code – No Floor Tracking
• All outputs defined in the Elevator Control Level (ECL) selected from
the drop down box will energize when granted facility code is issued at
the reader
• Works for LNL-1300 and LNL-1320 elevator solutions
• The reader must be on-line and in facility code mode
Online Facility Code – With Floor Tracking enabled for

LNL-1300 / LNL-1300e
• Outputs defined in the Elevator Control Level (ECL) selected from the
drop down box will be available
• Selection of the floor via elevator button is necessary
• The reader must be on-line and in facility code mode

Online Facility Code

Offline Access
LNL-1320 offline from ISC
• Output 1 will energize when a badge (with valid facility code) is presented
to the elevator reader
LNL-1300 / LNL-1300e offline from ISC
• No Floor Tracking – all outputs defined in the Elevator Control Level (ECL)
selected in the drop down box for Online Facility Code will energize
• With Floor Tracking enabled – the outputs defined in the Elevator Control
Level (ECL) selected in the drop down box for Online Facility Code will be
available
• Selection of the floor via elevator button is necessary

OnGuard Elevator – KB References
• kb.lenel.com references for OnGuard Elevator

Articles
Description
How to configure elevator control using an LNL-1320
How to set up dynamic elevator control
How to configure elevator Day Mode settings in OnGuard
How to extend relay output time for elevator hardware
Elevator dispatching configuration

Segmentation

Introduction to Segmentation
Segmentation is: The process of dividing an access control database into

smaller subsets known as Segments
Initial objects assigned to each segment

• Users
• Access Panels
• Access Levels
Adds additional levels of permissions to be assigned

to objects
• "<All Segments>"
• "Segment" (Individual)
• "Segment Groups"

Segmentation Options
• Additional segmentation options that can be enabled/disabled

• Card Formats
• For organizations who need many different card formats
beyond the 8 per system (16 card formats in 7.4)
• Allows 8 card formats per segment (16 card formats in 7.4)
• Badges Types
• For organizations who wish to control user and cardholder
access to certain badge types
• Cardholders and/or Visitors
• Useful when cardholders reside in their own segment or
additional segments

Segmentation Options
• Additional segmentation options that can be enabled/disabled

• Segment Groups
• Allows management of multiple segments simultaneously
• Access Levels
• Intended for users who need to assign access levels that
belong to another segment
• List Builder
• Allows List Builder entries that are segment specific to be
customized and viewable in a single segment, segment
group or all segments

Why Segment?
• Hardware Limitations
• Since Access Panels are limited in memory, segmentation allows
segment related information to reside on that access panel
• Each segment can determine what features and options to
choose for their panels
• Some examples
• Cardholders
• Access Levels
• Badges
• Hardware limits
• Anti-passback options

Why Segment?
• Manage User Access

• Users are assigned to one or more segments
• Users have visibility of objects that only belong in their
segment(s) and objects that are system-wide
• More efficient Cardholder downloads
• For high cardholder populations
• Only badges that have access to a segment are
downloaded to the access panel in that segment

Scenarios
• Landlord / tenant scenarios where one building houses

multiple companies and the landlord controls the security of
the building
• A single company with multiple large divisions who wish to
manage users, cardholders and features within their own
segment
• Users and Cardholders can belong to multiple segments
or segment groups

Initial objects assigned to each segment
• Users
• Access Panels
• Access Levels
Adds additional levels of permissions to be

assigned to objects
• “<All Segments>”
• “Segment” (Individual)
• “Segment Groups”

<All Segments>
• Any user can view an <All Segments> records/objects

• Only <All Segments> users can add, modify, and delete <All Segments>
records/objects
Segment (individual)
• Users can only add, modify, and delete records/objects that have that
same segment assignment as they do.
Segment Groups
• Users can add, modify and delete records/objects that are assigned at
least one of the segments that are contained within the segment group
assigned to the user.

Segmentation allows an additional level of

permissions to be assigned to an object
• Full control
• View only access
• No Access

User and Object Assignments
When an <All Segments> user logs into <All Segments>, that user can view, add,
modify and delete any object with any segment assignment*
User User Object

Assigned User 1 Logged In Object 1 Assigned
Segments Segment Segments
<All >Segments User 2 <All Segments> Object 2 <All Segments>
Segment 1 Segment 1 Segment 1
User 3 Object 3
Segment Segment Segment
Group User 4 Group Object 4 Group

User 5 Object 5
*Provided that the user has the proper user permissions to do so.

When an <All Segments> user logs into a segment, they can add, modify and
delete only those objects in that segment. The user can also view any object that
belongs to <All Segments> or an additional segment that matches their segment*
User User Object

User 3 Object 3

User 5 Object 5

A user assigned to a single segment can add, modify and delete only those
objects in their segment . The user can also view any object that has an <All
Segments> assignment or an additional segment that matches their segment*
User User Object

User 3 Object 3

User 5 Object 5

When a user logs into their segment group, they can add, modify and delete only
those objects that belong to that segment group. The user can also view any
object that belongs to <All Segments> or an additional segment that matches any
segment in their segment group*
User User Object

User 3 Object 3

User 5 Object 5

When a user logs into a segment within a segment group, they can add, modify
and delete only those objects that belong to that segment. The user can also
view any object that belongs to <All Segments> or an additional segment that
matches the segment that the user has logged into*
User User Object

User 3 Object 3

User 5 Object 5

Additional <All Segments> Rules
System wide settings can only be configured

by an <All Segments> user
• BadgeDesigner
• FormsDesigner
• Archiving Events and Transactions
• System Cardholder Options
• General System Options
• User segment access permissions must be modified,
otherwise, all users will have <All Segments> access
Note: Being an <All Segments> user is not the same as

having access to each individual segment

Enabling Segmentation
Once enabled, Segmentation cannot be disabled
• Default segment is created for placement of pre-existing records

Post-Enabled Segmentation View
Segmentation
Enabled
New
Segment
Tabs or
Headers

Adding New Segment
Segments may be added independently or to a

new or existing segment group
• A segment is created by the New Segment Wizard

• Hardware may be moved to new segment
• Existing data may be copied to new segment
• Access levels and groups may be copied or moved

Segmentation Wizard
Segmentation Deployment Wizard
• Unique segment name

• Segment group assignment (optional)
• Move panels from another segment
(optional)
• Hierarchy of readers and alarm panels will be
maintained
• Perform full panel download after move
• If “Do not copy records or move panels from
another segment” is chosen then all associated
access levels will not be copied and lost

Segmentation Wizard
Copy records from another segment

• Select records to be copied
Copy empty access levels and groups

• Allows creating a similar access level/group
scheme in the new segment
Cleaning up source segment

• Removes access levels and groups that may
become empty after moving hardware

Segmentation Wizard
Prefix or append text to the names of records for unique identification
• Record names are enforced to be unique per segment
Define segment hardware settings
Restart the LS OpenAccess Service when Segments are added or

removed

Features Controlled Per Segment
System wide limits are now per segment

• Holidays – 20-255 supported
• Timezones – 127-255 supported
• Access levels – 255-31999 supported
• Badge number length – 7-18 digits supported
• Number of elevator floors – 1-128 floors
• Access level assignments per badge
• Maximum of 128 Access Levels supported by default
• Total Access Levels
• Level allowing no activation dates
• Level allowing activation dates
• Maximum of 255 Access Levels supported with Extended Cardholder Options
enabled
• Anti-Passback
• User Commands
• Access Levels / Assets

Features Controlled Per Segment
• Some System Options become Segment specific options

Segmenting Hardware
Segmenting Access Panels

• All downstream devices are automatically given
the ISC’s segment assignment and can’t be
changed
• Pre-segmentation
• Configured hardware usually receives
assignment during the segmentation process
• Post-segmentation
• Configured hardware is assigned a segment
during the add hardware process
• Hardware segment assignment can be
modified

User Segmentation
Initially, users are assigned to <All Segments>
• User segments may need to be modified to accommodate

your customers needs
• Specific segment assignments will restrict permissions to
view objects in other segments

User Segmentation
• Enabling Segmentation and applying Segments to Users

Advanced Segmentation
Segment Options
• Card Formats
• Badges via Badge Types
• Cardholders or Cardholders and Visitors
• Allow segments to belong to more than one segment group
• Access level assignment
• Non-system List Builder lists

Advanced Segmentation Features
Additional control over objects that belong to

multiple segments
• Primary Segment
• Primary segment assignment can be either an <All Segment>, an
individual segment or a segment group
• Users can add, modify and delete objects and records with the same
segment assignment.
• Additional Segment
• Additional segment assignment can be either an individual segment or a
segment group
• Users can only view/use objects and records in the additional segment

Card Format Segmentation
• Card Formats become assignable per segment

• Each segment may now have up to 16 unique card formats (with Extended
Cardholder storage enabled, 8 otherwise)
• Useful for organizations that require many different card formats

• Card formats that belong to <All Segments> will reserve a format for
every segment

Badge Types Segmentation
Badges controlled by Badge Type
• Pre-Segmentation
• Users* can add, modify, and delete all badge types
• Users* can add, modify, and delete cardholder badges
• Users* can add, modify, and delete access levels from badges*
• Post-Segmentation
• Badge Types are initially assigned Primary = <All Segments>
• Only <All Segments> users* can add, modify, delete badges
• Badge Types are not initially set as ‘No restrictions’
• Users* can only add, modify, and delete access levels from all badges
*Provided that the user has the proper permission level to perform this task.

Badges controlled by Badge Type (cont.)
• Available to All (No Segment Restrictions)

• Only <All Segments> Badge Types can be set for ‘No restrictions’
• Only <All Segments> users can edit the Badge Type itself
• Allows users to add, modify, and delete cardholder badges of that type
as well as access levels
• Primary and Additional Segments
• Users* with Primary Segment (or <All Segments>) access can add,
modify, and delete badge types or cardholder badges
• Users* with Additional Segment access can ONLY assign or remove
access levels from their segments to existing badges

Badge Management within a

Segmented System
• If Badge Types and Cardholders are Segmented
then…..
• To assign a Badge Type to a Cardholder:
• Badge Type’s Segment** must match with
• Cardholder’s Segment** which must also
match with
• User’s current Segment access*
• Or
• Badge Type’s Segment is <All Segments> with
‘No restrictions’ enabled
• Cardholder’s Segment** must match with
• User’s current Segment access*
*Provided that the user has the proper permission level to perform this task
** Primary or Secondary Segments

Cardholder Segmentation
Segment Cardholders
• Allows Cardholder permissions to be

controlled based on segment access
Segment Visitors
• Allows Visitor permissions to be

controlled based on segment access
• Visitor segmentation can only be done
if cardholders are segmented

Cardholder Segmentation
Access to Cardholder/Visitor controlled by Segmentation
• Pre-Segmentation
• Users* can add, modify, and delete all cardholders
• Users* can add, modify, and delete cardholder badges
• Users* can add, modify, and delete access levels from badges
• Post-Segmentation
• Cardholders are initially assigned Primary = <All Segments>
• Only <All Segments> users* can add, modify, delete cardholder records
• Any user* can view <All Segments> cardholder records
• Any user* can assign access levels from their own segment to existing
badges
• Cardholders can be assigned primary and additional segments
• Users* access to these cardholders is then based on their segment

Users vs. Cardholder’s Segment
User’s Segment = Cardholder’s Primary Segment
When the user logs into a segment that is the

cardholder’s Primary Segment, the user has full
control over that Cardholder’s record and Badge

User’s Segment = Cardholder’s Additional Segment
When the user logs into a segment that is the

cardholder’s Additional Segment, the user is able to
• View the cardholder but not change the cardholder’s personal
information
• Modify access levels
• Issue ‘One Free Pass’ for anti-passback
• Execute an APB move badge
• Display global APB areas

User who is not an ‘<All Segments>’ user
• This User can only view ‘<All Segments>’ Cardholders and add issue
Badges Types from their Segment(s) to the ‘<All Segments>’ Cardholders
• This User can add/modify/delete Cardholders and add Badges Types from
their Segment(s)

Segment Groups
A segment group is a collection of one or more

segments
• Using segment groups can reduce management effort and complexity
• For example, when a new segment is added to the system, the
administrator simply adds it to the appropriate segment group. Users
and cardholders with those groups assigned are granted access to the
new segment.
It is recommended to use segment group assignments

where possible, especially for users and cardholders.

Segment Groups
Allow segments to belong to more than one segment

group
• A segment group may contain one or more segments
• A single segment optionally may be allowed in multiple segment groups
• Determined in Segment Options tab

Access Level Additional Segments
Allows access levels to be configured

as assignable by users in other
segments to their badges
• Allows a user to assign access levels from
segments they are not currently logged into
• Selected Badge Type must span the segments
that the access levels are being applied from
• Typically with a Segment Group or via
nominated Additional Segments applied to the
Badge Type
• Typical use is for common access doors leading
to segmented access areas
• Segmented area user must apply the common
area access levels to their badges without
having access to the common area segment

List Builder Segmentation
List Builder Simple Lists can be

filtered based on segment
Most lists can have a segment

assignment
• ‘Badge Status’ and ‘Two Man Type’
cannot

List Builder Segmentation
If an attempt is made to add an entry

already in use in another segment,
then the following error will be
displayed
When viewing, adding, modifying or searching in the Cardholder,

Asset, or Visitor UI, the drop down menu options will be filtered to
show only the available items based on segmentation
• If the Cardholder’s current selection is something you can’t view, <Restricted Entry>
will be displayed
• Example: User logs into Segment A & B via a Segment Group
• Cardholder is added to Segment A
• List item selected belongs to segment B
• New user logs into Segment A only
• New user sees the Cardholder but the list item shows <Restricted Entry>
Summary of Advanced Access Course
Alarms Configurations
Single Sign On
Invalid Badge
FormsDesigner Lite
Area Interlock
Monitoring Options
Anti-Passback
Device Groups
Mustering
Action Groups
Area Access Manager
Scheduler Destination Assurance
Local IO Selective Cardholder Download
Custom EOL Resistance

Global IO
Hold Time
First Card Unlock
Debounce
Double Card Unlock / Toggle
Elevator Control
Map Designer
Segmentation

Certification Testing Center
• Follow the link within email sent to

you
• You can pause the exam and return
to answer more questions later or
change earlier answers
• Don’t forget to submit the exam within
30 days

Upon Completion of Class
• You have 30 days to complete the exam

• 70% for a Pass
• 80% if not passed first time
• 80% if not passed second time
• Training licenses can be renewed provided your certification is current
• Practice, Practice Practice !

Student Transcripts and Certificates
Student transcripts and certificates are available

online through the Training Portal at Partner Center
and can be viewed, downloaded, or emailed at any
time

Expectation Review
Thank you for your attendance and participation
Please take the time to complete the survey that

will be emailed to you. We value your feedback
and use it to improve our training classes.
Did we meet your expectations for this course?

Thank you for your attendance
• Please make sure to take all personal items with you. Leave badges on your desk.

Advanced Access Control-8.1!02!20 2023US IG

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Advanced Access Control-8.1!02!20 2023US IG

Uploaded by

Copyright:

Available Formats

OnGuard Advanced Access

• Welcome to LenelS2 Training

THIS PRESENTATION AND ITS CONTENT ARE STRICTLY CONFIDENTIAL and

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

• Who ? ( You and your employer ?)

• Where ? (Are You From ? )

• What ? ( Is your Role and Experience with Regard to Access Control

• What are your expectations for this course?

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

• LenelS2 Training Information

• Please keep yourself muted when not

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

• At the bottom of your screen, you • Opening the Participant list

• From left to right: • Yes

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Configure Device groups to allow multiple devices to be controlled by User Action in

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Understand the concept of Anti-Passback and how to configure in Onguard.

Convert an OnGuard System from non-segmented to segmented, understand

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

• Your certificate will be available as a .PDF at

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Day One Topics Day Two Topics Day Three Topics

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

All course materials are available

Also available at Partner Center

Materials to populate your Lenel

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

• Course Name: Advanced Access Control

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Day One Topics Day Two Topics Day Three Topics

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Allows the user to log on to any OnGuard desktop application

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

• A user account where the authentication information is saved

• A user account where the OnGuard user is linked to the

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Directory must first be configured

• System Administration > Administration > Directories

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Select domain hostname

• Other default parameters will automatically be populated

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Determines how OnGuard will authenticate to

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Advanced Configuration for LDAP directories (Not available

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Log in to any OnGuard desktop application

• Launch the OnGuard desktop application

Auto Logon will be started

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

• Allows for cosmetic changes to the cardholder form

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY

Functionality controlled through the license

Separate OnGuard application located in the

A CARRIER COMPANY CONFIDENTIAL AND PROPRIETARY