UKG Time Collection Host Server Overview (2024)

Devices on the UTC Host need to be authenticated when they are first added, before they can be used. Once a device has been added, the device authentication can be revoked at any time, or the device can be reauthenticated.

1. Select the device in the first column. The Edit Time Clock page appears.
2. At a minimum, select a group and configuration for the device.
3. Ensure the time zone is correct.
4. Rename the device (for example, name can include physical location of the device).

   Important The name of the time clock must match the name of the clock in the time system, including spaces and characters. The names must match in order for employee time punches to process on both the host and the time system.

5. Select Save. If a warning appears about changing configurations, select OK.
6. Select the name of the new device in the list, and then select Authenticate to complete the authentication and the device to the host.

   The device automatically downloads configuration files and applications from the host.

From the Time Clocks page, select any time clock name to view the clock settings. Clock settings are unique to the model of clock. Some of these settings may include serial number, name, OS version, and group. The tabs and options vary depending on if you are viewing a TouchBase, TimeBase, or web clock (mobile) device.

To edit clock settings, select the device name from the list. Some fields are view only, and others can be changed. For example, the Serial Number and External Reference fields are view only, but the Name field can be changed to reflect something descriptive about the clock, such as its location. Be sure to save any changes.

Note The name of the clock must match the clock name that appears in your time system in order for employee time punches to process on both the host and your time system.

The Edit Time Clock page provides several other options:

• Authenticate or Revoke Authentication.
• View Schedules – Enables you to view and modify schedules.
• Delete – Permanently removes the device from the UTC Host.

Several other tabs are available:

• Network Details tab – Applies to TouchBase and TimeBase devices only. This tab displays the connection type and various details on the device network connection (for example, DNS addresses, Ethernet IP, Wi-Fi IP, MAC addresses, and Gateway information). The Last Updated field indicates the last time the network details for this device were updated.
• User Defined Fields tab – Lists user defined fields 1 through 10 that you can change at any time. These fields provide an additional layer of customization for your host and clocks. Contact the Time Collection Support team for more information.
• IP Authentication tab – Applies to web clock devices only. A single web clock can be accessed by multiple devices if multiple IP addresses are authenticated in this list. This tab enables you to add authenticated devices that can access this web clock in any browser, by supplying device IP addresses to the host. Select Add at the bottom of the page to add new, authenticated IP addresses. In the Choose IP Address to Add screen, select all of the IP addresses that should be able to access this web clock from the list, and then select OK. (Refer to the IP Addresses section for more detailed information.)
• OTT Authentication tab – Applies to web clock devices only. A one time token (OTT) can be given to a particular user and browser, enabling that user to access that web clock on his or her machine from any IP address. You can authorize a single user on a specific browser, on a particular machine. For detailed instructions, refer to the Create the Web Clock and One-Time Tokens job aid.
• OTT Restrictions tab – Applies to web clock devices only. This tab enables you to add additional IP restrictions to the OTT authentication. If you select Add at the bottom of the One Time Token Restrictions page, the Choose IP Address to Add page appears where you can select the IP addresses that are allowed to access this web clock. Select Delete to remove any authorized addresses.

TouchBase devices use face detection to detect employee faces when they clock in or out on time clocks. Face detection can prevent time punches when no face is detected.

The Face Detection Enrolled option defaults to True. When the option is set to True, employees must have a face in the photo or they cannot punch on a TouchBase clock.

If this feature is not specified for a device, then it is set for a device group or for individual employees.

Note Face Detection should not be confused with Facial Recognition, which is used to prevent buddy punches. Facial Recognition is performed after a punch is transmitted to the host, and it attempts to identify faces that do not match the profile of the employee clocking in.

The face detection setting has three levels, which are all configured from the host:

• Device – Every employee signing in on the particular device must have a face detected in photos.
• Group – All devices in a device group have face detection required in photos.
• Employee – The device uses face detection in photos only if the employee has the feature enabled. This level is helpful if there are issues with a particular employee.

A higher-level setting overrides a lower-level setting. A setting for a TouchBase device overrides a setting for a TouchBase group and for an individual employee, and a setting for a TouchBase group overrides a setting for an individual employee.

If you are using Face Recognition, the Transmissions Failing Face Recognition page displays all punch transmissions that were flagged as mismatches by TouchBase facial recognition.

To access this page, select List Failed Facial Recognition from the Transmissions page. The page is searchable and shows the actual photo that was flagged along with the details of the original punch, name of the clock, and the employee's badge number and name.

An Export Transmissions button allows authorized UTC Host users to generate a Microsoft Excel file of all flagged punches. Users specify a date range, whether to include only punches that failed facial recognition, and whether to include photos.

The IP Addresses page displays a list of all the authorized network addresses from which web clocks are allowed to connect to your host.

To access this page, select IP Addresses from the secondary menu. Each record lists helpful information about the address, including date and time when the authorized IP address was created. A green check mark indicates the IP address is authorized for use with web clocks, and a red "X" indicates it is not authorized.

To delete, authorize, or unauthorize an address, check the box to the left of the record and then select the respective button at the top of the page.

Select Import at the top of the page to import a CSV with multiple authorized addresses at one time. Contact a Time Collection Support representative for more information.

To create a new authorized IP address:

1. Select Add IP Addresses from the secondary menu.
2. Enter a name and description.
3. Ensure Master is selected as the company to which the address applies.
4. Enter the IP address.
5. Check the Authorized box if you would like to authorize this address for use immediately.
6. Select Save.

To edit an IP address, select the name of the address in the list, make any necessary changes, and select Save. The Edit IP Address page displays a list of mobile web clock devices that have connected to the host using the authorized IP address, as well as the authentication token that was sent to that clock.

A biometric fingerprint scanner validates employee identity in real-time to eliminate costly buddy punching.

The scanner identifies the employee via a finger scan instead of the employee inputting a badge number on the keypad or swiping a badge. The biometric data is immediately encrypted and then stored on the clock and in the UTC Host Server database as a template, which is only used to validate future finger scans at the time clock. This template is never stored as an actual image and cannot be reverse engineered back into an image or other format that would be recognizable to other biometric systems.

A biometric enrollment mode is available for supervisors to walk employees through the fingerprint registration before the first use. A biometric test mode allows employees to test fingerprint scans on the clock without recording a punch.

Additionally, data management options in the UTC Host comply with known data privacy and security measures, including automatic purging of biometric data for inactive employees and purging an employee's biometric data upon request.

The Command Queue displays a list of pending commands that have yet to reach your selected device.

The Command Queue is accessed by selecting the Last Communication time of the device being interrogated. If you select the Show All TouchBases box and the Refresh icon next to it, the page displays all pending commands for the host.

Note For TimeBase devices, a Commands tab appears as well. For TimeBase, host notifications are converted to simple commands first, before they are sent to the device.

To cancel a command, check the box next to any commands in the first column and then select Abort Notifications. Check the box next to Include Server Processed to show commands that have already reached your device.

The Command Queue can be used to alert you about devices that may not be receiving commands from your host (if a request remains in a pending state for an extended period of time). For more information regarding the Command Queue, contact the Time CollectionSupport team.

Using the drop-down menu in the top left corner of the Event Log page, you can quickly switch between the event log of multiple devices.

To view the event log of any device, select the status indicator icon next to the device in the list. The Show Summary link shows the last time important transmissions occurred, including the last successful heartbeat or the last time your device data was updated. The navigation bar along the top of the list enables you to search within the results, filter results by transmission status, and select intervals of time to view. Navigate the list by using the arrows, and check the Auto-Refresh box to automatically update the Event Log as new events occur.

Event statuses include:

• Complete Transmission – The event has been completed and information can be viewed.
• Error – An event failed (for example, failed download or data update attempt due to network issues).
• Warning – A device hasn't been authenticated, but it is communicating.
• In Progress – A command has been processed by either the host or device, but the action has not been completed (for example, a lengthy download).

Be sure to contact UKG before creating new configurations or modifying settings in existing configurations.

1. From the Configurations page, select Create Configuration.
2. Enter a name and description.
3. Select Save.
4. Upload configuration packages before attempting to load this configuration to devices.

The Transmission Stage Details page displays the raw transaction data logged on time clock devices after the data has been parsed and separated into different transactions, and before being processed by the host.

To access this page, select List Stage Details from the Transmissions page. The Transmission Stage Details page displays all communications with the host, not just punches. However, it does not display heartbeats sent to the host. The primary purpose of this view is to see what the host receives before it processes the data.

The page displays the status, date and time the event occurred on the clock, event category (description) and type, and badge number and name of the employee associated with the event. You can select a status icon to view further details about the status (for example, an error may have occurred or the transmission may be delayed).

The Trasmission Stage Masters page displays information about the raw data that the host receives from the device.

To access this page, select List Stage Masters from the Transmission page. On the Transmission Stage Masters page, each row represents the data sent in a single transmission from a device to the host. The transmission includes data from multiple transactions and user actions on the device that occurred since the previous transmission from the device to the host.

The page displays the status, date and time that the host saved the data to the database, location on the host (requested URL) where the device sent the data, server address that received the data, and IP address of the device that sent the data. In an environment with a single host, the server address has the same value for all data transmissions. You can select a status icon to view further details about the status (for example, an error may have occurred or the transmission may be delayed).

The Transmission Event Types page lists all the event types that can be transmitted to your host. All user transactions are associated with one of these event types.

To access this page, select List Event Types from the Transmission page. Each event type listed includes the following information:

• Name of the transmission event type.
• External ID, which is the ID for the event type in the time system where it originates and is populated automatically.
• Description of the event type.

To create new event types specific to your organization, contact the Time Collection Support team.

Most of the information on the Edit Employee page is pulled directly from the time system, and changes are overwritten on the host. However, five settings on the Profile tab can be edited and are not overwritten: Rule Set, Face Detection Enrollment, Alert Eligibility, Fingerprint Threshold, and Face Recognition Threshold.

Be sure to save your changes.

Rule sets are created on the UTC Host. They are used to restrict employee time punches on time clocks and perform punch validation. For example, if your organization has mandatory minimum break times, a rule set can prevent employees from returning to work if they have not met the minimum break time.

To access the Rule Sets page, select List Rule Sets in the secondary menu from the Employees page. The Rule Sets page lists each rule set and the external reference, which is a reference of the rule set for the host itself. To remove any rule set from the host, select Delete in that row.

Note Generally, major rule sets that enforce mandatory local and federal regulations on employee time management are set up for you by the UKG team when you first receive time clocks and your host application. If you need assistance creating new rule sets, contact the Time Collection Support team.

Several employee validation rules are available.

New rule sets can be created to meet your organizational needs.

To access the Create Rule Set page, select Create New Rule Set from the secondary menu. Enter the name and external reference, which must be unique. If the External Ref field is left blank, it is generated automatically. The external reference cannot be changed once it is set. The page displays a list of the rule set conditions that you can use. To run a rule on multiple transaction types, use a comma as a separator.

In soft validation, a rule is checked when an employee checks in on a time clock, but violation of a rule does not prevent the employee from checking in. For example, you may choose to check if employees are punching in too often, but not actually prevent a punch from going through if the rule is broken.

Active rules at the top of the list are checked first; if a punch is rejected due to a particular rule, the remaining rules are not checked. You can use the up and down arrows to the right of each rule to move that rule up or down in the list. Rules can also be present in multiple rule sets. For example, all of your rules sets might check for break length validation, but maybe only one rule set checks for meal length validation as well. This example shows the use of rules in multiple rule sets and the order of checking rules in the list.

To edit a rule set, select the name of the rule set in the list, make any necessary changes, and select Save.

The Profile tab on the Edit Employee page (Employees > select employee) contains two fields that control biometric settings: Fingerprint Matching Strategy and Verification Mode Override.

The Fingerprint Matching Strategy field controls the threshold of what is considered a match when an employee scans a finger. This threshold is useful if employees have trouble with the biometric scanner recognizing the finger; these employees can be set to a lower matching threshold. The clock is more "lenient" on what is considered a match. Or, this threshold is also useful if you want to enforce the highest standard of security. The available settings are High, Medium, Low, and Always Accept. The default is Medium. (The Always Accept setting always accepts any finger scan.) The lower this threshold is, the higher the probability of False Acceptance Rate (FAR). FAR describes the probability at which a matching algorithm makes false acceptance errors. The higher this threshold is, the higher the probability of False Rejection Rate (FRR). FRR describes the probability at which a matching algorithm makes false rejection errors.

For reference, if using the default setting of Medium, the FAR rate is estimated to be 0.01 percent or 1 FAR in every 10,000 attempts.

The Verification Mode Override field drop-down list includes five employee-level verification mode override settings:

• Verification override = [BLANK] – This setting, which is the default, uses clock-level setting.
• Verification override = “Keypad + FP or Badge Card + FP” – This setting requires the employee to input a badge first and then scan an enrolled finger to validate identity (Bio Verify mode).
• Verification override = “Fingerprint Only” – This setting allows the employee to scan a finger without needing to input a badge number (Bio Identify mode).
• Verification override = “Keypad or Badge Card only” – This setting allows keypad or badge swipe input of a badge number but does not prompt the employee for biometric scan (Exempt Bio mode).
• Verification override = “Badge Card only” – This setting allows only a physical badge swipe to input a badge number, but it does not prompt employee for biometric scan (Exempt Bio mode).

These settings take precedence over the clock-level verification mode setting.

In addition, the Employee Fingerprints page (Employees > List Employee Fingerprints) lists all employees so you can quickly see who has an enrolled fingerprint template. The columns on the page include:

• Employee ID – Employee's unique ID number.
• First Name and Last Name – Employee's first name and last name.
• Fingerprint ID – The finger the employee used for enrollment (for example, RIGHT_INDEX for the right index finger or "0" if the employee has not enrolled).
• Alg Version – Name of the "matching algorithm" used to validate employee finger scans. Applies to TimeBase clocks only.
• FP Version – Finger scan module firmware version identifier. Applies to TimeBase clocks only.
• Template Count – Number of successful finger scan templates (for example, "3" for three successful finger scans).
• Origin Time Clock – Name of the time clock where the finger enrollment template was originally captured.
• Device Type – Type of clock device (for example, TouchBase or TimeBase).

The Fingerprints tab on the Edit Employee page (Employees > select employee) allows you to delete an employee's fingerprint enrollment from the host.

1. Select the Fingerprints tab for the selected employee. The enrollments are listed with the name of the clock at the time of enrollment.
2. Select Delete to the right of each enrollment you want to remove.
3. Select Save.
4. Go to the Admin menu.
5. Locate the Sync TouchBase Data job. This job will delete the enrollment from the clock.
6. Select Run Now and wait for the job to complete. A notification is sent to each clock to update information.
7. Check the clock status to confirm the tables have been updated.

Time clock messages keep your employees informed.

1. From the secondary menu of the Employee Messages page, select Create New Message.
2. Enter the name of the message as it will appear on the host, not the content of the message itself.
3. Enter the sender of the message, which defaults to the current user name.
4. Select all the groups you would like to send this message to.
5. Check the Priority box if this message is a priority. The message appears when an employee clocks in and out, and it requires acknowledgement. If this box is not checked, then the message appears in the Messages screen of the TouchBase device.
6. Check the Announcement box if this message is an announcement. The message appears in the idle screen of all devices in the distribution list. This option overrides the Priority option. If this box is not checked, then the message appears in the Messages screen of the TouchBase device.

   Note If a distribution list contains only some employees, but the Announcement box is checked, then all groups which those employees are present on will receive the message. Messages are targeted towards particular employees and groups of employees, and the host decides which devices should display the message.

7. Enter the date and time that the message should first appear (publish) and when it should expire (no longer appear to employees).
8. Enter the content of the message.
9. Select Save.

Distribution lists for each group are automatically added. You can create your own distribution lists as well.

To access the Distribution Lists page, select List Distribution Lists from the secondary menu. The page includes a name and description for each distribution list. Select the name of any list to edit it; you cannot delete or modify any of the default lists created by the host.

To create a distribution list, select Create New Distribution List from the secondary menu.

1. Enter a name and description for the distribution list.
2. Enter a list of employees you would like to target with this list. Begin typing an employee name to see suggestions.
3. Select Save.

New users can be created to access the UTC Host.

1. Select Create New Security User from the secondary menu.
2. Enter the full name of the user.
3. At the Email field, enter the name that the individual uses to sign in to the UTC Host.
4. At the Username field, enter the email address of the user.
5. Enter the password that the individual uses to sign in to the UTC Host.
6. Enter the name of your organization.
7. Select one of the predefined security groups. The Administrator Group includes users who have access to the entire UTC Host application. The Users Group includes users who have access to the entire UTC Host application except for the pages accessed through the Users and Admin menus. Power Users have access to the entire UTC Host application except for the pages accessed through the Admin menu.
8. Check the Enabled box if this user should be active and allowed to sign in to the UTC Host.
9. If the password expires, check the Does Password Expire box.
10. Select Save.

The Jobs page displays a list of jobs that are run on your host and time clock devices.

These jobs may include processing new punches, purging old transactions, or updating time clock configuration packages. The jobs are configured to run on a schedule, but you may select Run Now to immediately begin a job.

Jobs should be configured for your organization when your host is deployed. If you wish to add a new job configuration, contact the Time Collection Support team.

To edit a job configuration, select it from the list. You can toggle jobs on and off using the Enabled check box at the bottom of the page. Select Delete to remove a job from the host.

Alerts are used to send emails to administrators and supervisors to inform them of actions that require their attention (for example, a possible buddy punch or a device that is running low on battery).

To view the Alerts page, select List Alerts from the secondary menu. The page displays all of the alerts and other related information, including the alert's current state and date and time the alert was last run. You may select Run Now to immediately send the alert emails.

To edit an alert, select it from the list. You can toggle alerts on and off using the Enabled check box at the bottom of the page. Select Delete to remove an alert from the host.

To view a list of alerts that have been run on the host, select Alert Logs from the secondary menu.

The Server Log page displays errors logged by the host.

To access this page, select List Server Logs from the secondary menu. The information displayed on the page can assist a Time Collection Support representative if you have issues with your host. Select Show Stack Trace next to a record to view a trace of the original error source.

Administrators can enable and run the Archive Transmissions job on the UTC Host. The Archive Transmissions job generates reports of transmissions for a specified number of days. Reports can be scheduled to run at specific times or at regular intervals.

Reports are stored on the UTC Host in the list of Archive Transmissions. The UTC Host stores 15 archive punch transmission files before the oldest file is overwritten with the most recent file. The UTC Host purges each file 90 days after creation. Limiting the number of files maintains privacy compliance, helps performance, and controls data size.

When a report is generated, the UTC Host sends an email to notify the administrator that the report is available to download. Administrators can view details, download, and delete reports from the list of Archive Transmissions.