Building Access Rights Exception Requests OVERVIEW As we move forward we are moving to a model in which each staff member will be given the appropriate access rights for the buildings in which their job requires them to have access rights to. This will be based on each staff members role and job responsibilities. For example, the Central Database Manager, by default only needs access to the CVL office, but not the campuses, since their primary job responsibilities are at CVL. If there is a need for the Database Manager to get into a campus building after hours, they will need to make sure that this visit is scheduled to take place during open business hours OR they will need to coordinate a time in which someone with access to that building can be there to let them inside. PRIMARY ACCESS TYPES The two primary types of access rights are… External/Internal door access (the ability to access both external and internal doors) Internal door access (the ability to access secure doors inside the building). WHO HAS WHAT ACCESS TYPE? EXTERNAL & INTERNAL DOOR ACCESS   INTERNAL DOOR ACCESS ONLY Full Time Staff   Contractors Part Time Staff   Volunteers Contracted Employees (Not contractors)     FILTERING REQUESTS As a Supervisor, it is important that you help filter and limit requests to actual needs and/or by helping your team member find alternative ways to accomplish the need within the existing building access options (i.e. if possible, going to that building during business hours when someone is already there, etc.). When exception requests are brought to you by your team members, please note that ALL EXCEPTION REQUESTS NEED TO BE SUBMITTED BY YOU through Fresh Service. This can be done by clicking the +NEW button in the top right corner of the screen. Then select the “SERVICE REQUEST” option (See below)…  Next, choose the “Building Security” option (See below)… Next, choose the “Building Access/Keys” option (See below)... PROVIDE AS MUCH DETAIL AS POSSIBLE Please provide details for the exception request. If this is a temporary need, (please provide start and end dates and times) or a permanent need. If you have any questions, please email wes.pederson@eaglebrookchurch.com

Honeywell Vector Occupant App This application is used on iPhone and Android devices to act as a virtual “security badge” for building access. Currently installed and configured at Anoka, Centerville, Lino Lakes, Spring Lake Park, and White Bear Lake. This setup is in three parts: 1. Create user in the Honeywell Cloud 2. Add virtual badge to building security system 3. User installs and configures app on their device PART 1 à Create user in the Honeywell Cloud 1.    Log into the Honeywell Cloud https://manage.honeywellcloud.com/ Current administrators:            Tom Tulberg Amanda Peterson Wes Pederson Tim Jett 2.    Navigate to "Organizations > Eagle Brook Church > Users" 3.    Click on the "Add User" icon  Enter the first name, last name and email address  Scroll down and put a check next to "Vector Occupant App" 4.    Click "Create" The icon under 'Assigned Apps' next to the username will show "Import in progress" 5.    Refresh the user page after 1-2 minutes 6.    The icon under 'Assigned Apps' next to the username will show "Invitation Ready" 7.    Expand the user and write down the card number and invitation code 8.   Check the box next to the new username and click the “email” icon at the top of the screen to send the invitation code to the user. This provides directions to the user for how to install the application and provides them with their invitation code. Once the user successfully registers the app, the icon under 'Assigned Apps' next to the username will show "Invitation code in use" and turn green.         PART 2 à Add virtual badge to building security system 1.    Using the card number from the Honeywell Cloud, in EBI enter this as an additional card to an existing user or create a new user on the building system. For Kantech, you should be able to scan the device before setting it up and then gathering the complete card number including the site code from the log on the system Format will be XX:6xxxx Anoka = Honeywell Blaine = see Facility Manager Centerville = Honeywell Lino Lakes = Honeywell Spring Lake Park = Honeywell White Bear Lake = Honeywell Woodbury = Honeywell

Managing Access Control for the EBC Campuses Connecting to the Campus Facilities PC Workstation 1. Connect to Kaseya at https://saas17.kaseya.net and log in  User Name: email address  Password: 2. Select the Remote Control menu option 3. Select the campus facilities machine 4. Click on the agent icon on the left of the screen for the selected campus connection 5. Click on Remote Control 6. Once connected to the facilities workstation, open the campus access control application 7. Select the icon that lets you manage user Cards 8. Enter or select the user to edit or the icon to create a new user 9. Add the new card as Card #1 and the Vector app as Card #2. Use both the facility code and ID number, i.e. 10:12345 (you likely will need to scan the HID cards to capture the facility code in a “Failed” access attempt. The Vector app uses facility code 36 for all users. (26bit formatted card converted to hexadecimal today – not a true facility code) 10. Assign the appropriate access role to the card 11. Save or Close the card record 12. Facility codes are 1 for Cards, 36 for Vector Connecting to EBI Security Station for CVL, SLP, WBL 1. Use RDP to connect to the Eagle 11 server (on Mac) 2. Log in using Active Directory user credentials (on Mac) 3. On your workstation (Windows) or the server desktop (Mac), select the EBI-Security shortcut 4. Log in using Active Directory user credentials 5. On the Eagle Brook Church map select the location, if needed 6. For Access Cards, select the cardholder detail icon (F11) or use the menu drop down in the upper left corner, Configure, Cardholder Management, Search a. Use an * in the search field to bring up the full list of users, external and employees b. Select Card holder to edit an existing user 7. For new Cards, select Add Employees or External Personnel from the Cardholder Management menu a. Add the user first name and last name b. For employees add the user's position title c. For employees add their home campus/building designation (e.g. 10 – White Bear Lake) d. Select Cards tab to add/issue a new card ID or Vector ID e. Card State = Active f. Select the Access Rights tab i. Highlight the appropriate Available Access Rights ii. Click on the Assign button iii. Click on the Save button (green dot appears on the Assigned access rights) 8. To search for existing users enter the user name in the Quick Search Field, click Go 9. Select the Cards tab a. Add to enter a new card or Vector ID (follow steps 7d-f) b. Edit Card State to deactivate, Delete to remove a card or Return to remove an existing card or from a user and put it back into inventory c. For Vector IDs (60000 series cards) use the Delete Card option to remove the ID when a new code is issued/added. Each user can only have one Vector ID at a time 10. Click Save to save changes

NOTE: Exceptions at this time where these profiles don't apply are Wayzata and Lakeville (mobile sites in the school). 4/24/19 These are the approved access levels for all of our campuses. the "XXX" in the spreadsheet represents the three letter campus acronym. Every user receives Full access (24x7) access to their home location - campus or Centerville - and then Limited access (5am-10pm) to all other locations. For example, a Centerville staff person will have Full access to CVL and Limited access to all campus buildings, and a LLK staff person will have Full access to LLK and Limited access to all other buildings. There are specific access limitations at Anoka, Blaine and Lino Lakes that are noted in the attached spreadsheet. All questions can be directed to the Director of Safety & Security.

What do you want done with employees who no longer work here?  **By default we should DELETE these individuals from the system. There may be times in which we request that an individual be left in the system for investigative purposes – but that will be a very rare exception. Is the general standard for employees FULL at their campus and LIMITED at every other campus?  **All staff members (FT/PT) should have FULL access at their primary OFFICE building and LIMITED access to all other facilities.   Moving forward, who will be getting a badge and who will be getting vector?  If I’m part time and lose my badge, do I get a new one or do I, at that point, transition over to vector?   **See chart below… ACCESS CARD VS. VECTOR APP DISTRIBUTION STAFF Physical Access Card              A physical access card should be issued to all Full Time and Part Time employees. Vector Mobile App                          The Vector virtual access card (mobile application) is to be issued to all NON-REGULAR employees (Contract employees, Interns, Temp staff, On-call and Board Members).  These individuals should not be issued a physical access card. VOLUNTEER Volunteer Access Cards Physical access cards are provided at the campus and are to be checked out/in by the campus ministry, production or Facilities staff for service hours at the campus. Select volunteer leaders who serve multiple times per month may be issued the Vector mobile app at the request of campus staff and reviewed by the Director of Safety & Security for approval consideration. * Any exceptions to the above should be submitted via Fresh Service for Safety & Security Director consideration.     I’ve noticed some retail people, facilities people (Barton, Bill, etc), and musicians have full access at multiple and/or all campuses.  I’m assuming this is okay and should just be left as is?  **Yes, this is ok for staff… Some musicians have also been given exceptions and are also given campus access. What’s the difference between the “external personnel” and “employee” buckets?  For example, I have seen some interns in the external group and some in the employee group (i.e. Alana Dittes and Grant Berggren).  Why are some of our generic cards (i.e. Safeguarding 01, Volunteer) listed under employees and others (i.e. EBC Guest) listed under external?   **Interns should be set up as Employee and Volunteers and contractors are External.

If a Vector user doesn't use their app for an extended period the user's app will be disabled by the Vector management software. Restarting the Vector service requires the one step in the attached document.