What it is and what it's for#
This page is for whoever has to answer the question "who signed in, from where, and what happened when they couldn't?". Normally, the client's IT or compliance area.
WinChange controls access in four layers that operate at the same time:
| Layer | What it prevents |
|---|---|
| Allowed domains | Someone from outside the organisation creating an account. |
| Account verification | An account being used whose email address has not been confirmed. |
| Lockout after failed attempts | Password after password being tried until one works. |
| Two-factor authentication | The password alone being enough to get in. |
And underneath, every access attempt is logged, whether it succeeded or failed.
This page looks at access from the administrator's side. What the person sees and does when signing in (invitation, password, direct access link) is in Users and access.
How to set it up#
1. Allowed domains#
This is the list of email domains that can be used to create an account by self-registration. Any address outside that list receives "Invalid email domain." and no account is created.
The list is not edited from the panel: it is set when the programme is built. When the organisation takes on a new domain (a subsidiary, a brand, a change of corporate email), the change has to be requested from the team before anyone tries to register.
On registration, the password has to meet a minimum: at least 8 characters, with one uppercase letter, one lowercase letter and one number. The account is created unverified and the person receives an email to confirm their address; until they do, they cannot sign in.
2. Account lockout and unlocking#
Each failed password counts as an attempt. The error message tells the person how many attempts they have left. Once they run out, the account is locked and administrators are notified automatically. A successful sign-in resets the counter to zero.
Two-factor authentication has its own counter: five failed codes also lock the account, with the same notice to administrators.
Blocked Users lists the accounts that are locked right now:
| Column | What it tells you |
|---|---|
| ID | The person's internal identifier. |
| Client ID | Their identifier in your systems. |
| Name / Last Name / Email | Who they are. |
| Blocked | Confirms the account is locked. |
| Failed login attempts | How many passwords they got wrong. |
| Failed OTP attempts | How many two-factor codes they got wrong. |
| Unlock | The Unlock button. |
Unlock does three things at once: it lifts the lock and resets both counters, the password one and the code one.
Look at both counters before unlocking. Many failed passwords and no failed codes is usually a forgotten password. Many failed codes with the password right first time is something else: there it is worth talking to the person before giving them access back.
3. Two-factor authentication#
It is switched on per person, not for the whole company. When it is active, after the password a one-time code is generated and sent to them; only with that code is the sign-in completed.
The code has three protections and each one gives its own message:
- It expires. Once its time is up: "The validation code has expired."
- It cannot be reused. If one that has already been used is tried: "You have already attempted to sign in using this validation code. Request a new one."
- It cannot be guessed. A wrong code gives "The validation code is not correct." and adds to the counter that ends in a lockout.
4. The sign-in log#
Signons & attempted signons is the log of access attempts. At the top you have Date from: and Date to: to narrow the period, and Refresh to reload.
| Column | What it tells you |
|---|---|
| Date | When the attempt was made. |
| User ID | The account, if the identifier used corresponded to someone. |
| Name / Email | Who. |
| Status | Whether the attempt succeeded, stopped halfway waiting for the two-factor code, or failed. |
| Reason | Why it failed: wrong password, unverified account, locked account, maintenance. |
| Device | From which device, operating system and browser. |
| Active Status | Whether the account was active at that moment. |
| Blocked | Whether it was locked. |
| Verified | Whether the address had been confirmed. |
It is read-only and every column can be filtered and sorted. It is paginated 15 at a time.
Only administrators see it, and each administrator sees only the sign-ins for their own project. There is no view that crosses projects.
5. Audit trail of changes#
Apart from sign-ins, the system keeps an audit log of changes to the data. Each entry records the action (creation, modification), what it was performed on, how it looked before and how it looked afterwards, which system operation it came from, and which person caused it.
It is written, among other cases, when a user is created, when an account is unlocked, when challenges are assigned and when points are moved.
This log has no screen in the panel. It is there and it is retrievable, but today it is consulted by asking the team, not by looking it up yourself. If your compliance area needs direct access or periodic exports, raise it before you start.
What the employee sees#
- None of this. Neither the sign-in log, nor the change log, nor whether their account is locked because of failed attempts or for some other reason.
- When the password fails, they do see how many attempts they have left before the account is locked.
- If the account is already locked, they see "Account locked. Contact the administrator.": they have to ask someone to unlock it, they cannot do it themselves.
- If they have not yet confirmed their address, they see "Verify your account to continue."
- During a maintenance window, nobody signs in and everyone sees the same message.
Frequently asked questions#
Can I switch on two-factor authentication for the whole workforce at once?
Not from the panel: it is a per-person setting. If you want to impose it on an entire group, that is a request to the team.
Someone says they can't sign in but they don't appear in Blocked Users. What do I look at?
Look them up in Signons & attempted signons and check the Reason column. The usual causes that are not a lockout: unverified account, deactivated account, or typing an email address different from the one on their record.
I can see failed attempts from an email address I don't recognise. Is it an attack?
An email address that does not correspond to any account appears with no User ID. It is usually someone getting the address wrong. What is worth reviewing is the pattern: many attempts in a row, across several different accounts and from the same device. In that case, pass the specific period to the team.
If I unlock someone, do I change their password?
No. Unlocking only lifts the lock and resets the counters to zero; the password remains theirs. An administrator never sees or sets anyone's password.
How long are these logs kept?
That is a question for the team: the retention policy is neither visible nor configurable from the panel.
Can I export the sign-in log?
Narrow the period with Date from: and Date to: to review it on screen. For a formal delivery to an audit, request it from the team.
Limits and warnings#
- Unlocking someone does not resolve why they were locked out. If the account locks again within minutes, stop unlocking and look at Reason in the sign-in log.
- An administrator can only unlock people from their own company and their own project. If the person belongs to another one, the operation is rejected.
- The sign-in log only covers getting in. It does not say what the person did once inside; that is in the audit log, which has no screen.
- The list of allowed domains only affects self-registration. An individual account creation or an import can bring in an address from any domain: the barrier is in whoever imports, not in the system.
- Lockout notices go to the administrators. If nobody watches that inbox, a locked account stays locked indefinitely.
- Sessions last for weeks. Anyone who signs in on a shared device and does not sign out leaves it open for the next person. It is worth saying so explicitly wherever there are shared workstations.
- Encryption, data location, log retention and the processing of personal data are neither visible nor configurable in the panel. They are contractual questions: ask the team for them in writing before the security review, don't infer them from these screens.