Symantec Endpoint Encryption Full Disk Release Notes

Transcription

1 Symantec Endpoint Encryption Full Disk Release Notes Symantec Endpoint Encryption Full Disk Symantec Endpoint Encryption Framework About Symantec Endpoint Encryption Full Disk Symantec Endpoint Encryption (SEE) Full Disk ensures that only authorized users can access data stored on hard disks. This safeguards enterprises from the accidental loss or theft of a laptop or computer and eliminates the legal need for public disclosure. SEE Full Disk provides seamless integration with Microsoft Active Directory for fast, simple deployment of endpoint data protection controls in a familiar administrative environment. What s New What s New in Version Decryption Enforcement Administrators can now set policy to decrypt all the encrypted drives on one or more computers protected by SEE Full Disk This feature had been removed in version What s New in Version Opal-Compliant Drive Management Symantec Endpoint Encryption Full Disk secures primary Opal-Compliant drives with pre-boot authentication. Full Disk takes Opal-compliant drives under management, providing all of the features necessary for your enterprise, such as centralized administration, reporting, and recovery. Full Disk provides instant erasure of Opal-compliant drives for secure disposal or recommissioning. For more information and a list of certified hardware, visit Improved Boot Times This release features expedited boot times through dynamic client data storage. Server-Based Commands Administrators can now encrypt or decrypt drives from the Manager console with a single command. Adding Drives Administrators can now add hard drives to installed clients and apply an upgrade package to take the additional drive under management. Multi-Factor Authentication Enhancements This release of Full Disk features the following enhancements to multi-factor authentication. Additional Readers Supported ExpressCard smart card readers and Argus 3015 USB 2.0 Dual Card Reader (smart card slot only). Additional Smart Cards Tested Oberthur ID-One Cosmo 64 v5.2d Fast ATR with PIV application SDK, Oberthur ID-One 128K v5.5 (dual), and HID Crescendo C700. Additional Software Supported SafeSign Identity Client v and VeriSign PKI Client v Additional Data Model Supported SafeSign v2.1.

2 Configurable Logon Message The pre-boot authentication welcome message is now configurable. Configurable Password Logon Delay You can now configure the length of the delay that is instituted after an excessive number of incorrect password logon attempts. esata Drives Full Disk does not manage esata drives that are connected to built-in esata ports. Resolved Issues For a list of issues that have been resolved in this release, please go to the Symantec Knowledgebase and search for TECH184841, "SEE Full Disk Resolved Issues." Installation Notes Symantec Endpoint Encryption Framework is only compatible with Symantec Endpoint Encryption Full Disk and Symantec Endpoint Encryption Removable Storage If you are running SEE Removable Storage and plan to upgrade to SEE Full Disk 8.2.1, you must also upgrade to SEE Removable Storage Known Issues Third Party Compatibility Hardware Number Hardware Description Workaround MA23923/ Dell Latitude E6520 Dell Precision Lenovo ThinkPad X201 and X220 HP 630 Hibernation is not supported (and will fail resuming if attempted) until the second system restart after installation of SEE-FD. To prevent this issue, manually reboot your system TWICE before it goes into hibernation mode for this particular Windows session. To recover from this issue, power down the system, then run the Recover Program. MA21929/ Dell XPS 1320 If Windows 7 is installed, the computer fails to boot into Windows following the installation of Symantec Endpoint Encryption Full Disk. Do not deploy Symantec Endpoint Encryption Full Disk to the Dell XPS 1320 if Windows 7 is installed. MA21884/ MA21864/ HP Compaq dc5700 and dc5100 If multiple USB devices are inserted at boot time, the computer fails to boot into Windows. Remove USB devices and try again. MA21327/ MA22221/ Panasonic Toughbook CF-U1AQB1GAM HP EliteBook 8740w Users cannot use USB devices such as keyboards and mice during pre-windows authentication. Users cannot use USB 3.0 devices such as keyboards and mice during pre-windows authentication. Users should open laptop and use the internal keyboard and mouse pad to complete pre- Windows authentication. MA21514/ Dell Latitude D631 and D531 Following the removal of the CD/DVD drive, the computer fails to boot into Windows. Uninstall Symantec Endpoint Encryption Full Disk before removing the CD/DVD drive. Page 2 of 11

3 Number Hardware Description Workaround MA20752/ SanDisk 4GB Cruzer Micro USB Flash Drive and HP Compaq dc7700 A SanDisk 4GB Cruzer Micro USB Flash Drive inserted at startup causes HP Compaq dc7700 computers to hang after pre-windows authentication. Remove SanDisk devices before powering on. MA19704/ SanDisk Cruzer Micro 512 MB USB 2.0 Flash Drive (SDCZ4-512-A10) If the SanDisk Cruzer Micro 512 MB USB 2.0 Flash Drive (SDCZ A10) device is inserted at startup, users may experience slow boot times. Remove SanDisk devices before powering on. Third-Party Compatibility Software Number Third-Party Tool Description Workaround Symantec Endpoint Protection 12.1 It takes longer to encrypt a drive when Symantec Endpoint Protection scanning is in progress. Disable or pause Symantec Endpoint Protection scanning when you are encrypting a drive Microsoft BitLocker The system fails to reboot if the boot drive is encrypted with Microsoft BitLocker. Roxio 6.2 The Framework client package fails to install due to a missing drive letter in the primary partition. Do not install SEE FD on a system encrypted with Microsoft BitLocker. Ensure that the following Registry key has the value PartMgr: HKEY_LOCAL_MACHINE\ SYSTEM\CurrentControlSet\ Control\Class\{4D36E967-E325-11CE-BFC BE10318}\UpperFilters MA15919/ Symantec Endpoint Protection 11 Following the installation of Symantec Endpoint Encryption Full Disk on a client, a Network Threat Protection message may alert the end user to a change in the EAFRCliADSI application. Open Symantec Endpoint Protection and click Options in the Network Threat Protection area. Select Configure Firewall Rules from the pop-up menu. Highlight Block IPv6 over IPv4 and click Edit. Select the Allow this traffic option button on the General tab. Open the Ports and Protocols tab. Select All IP Protocols from the Protocol drop-down list. MA12457/ RSA SecurID 800 If a second certificate is added to the token and the first certificate is deleted, the user cannot register with the token. Remove all certificates from the token and add the certificate again. Page 3 of 11

4 Upgrade/Install/Uninstall/Migration MA24186/ MA23202/ MA22161/ MA20747/ MA15465/ MA12748/ MA16499/ If an esata or USB 3.0 drive was connected during the installation of Full Disk and Removable Storage, the message Update Settings failed appears following the post-installation reboot. Novell users with Single Sign-On enabled may have to manually log on to Novell following an upgrade to this version of Full Disk. If a custom destination folder was chosen during the installation of GuardianEdge Management Server 9.2.2, 9.2.1, or 9.2.0, the default upgrade destination folder path won t include the final subdirectory. For example, if you chose C:\GuardianEdge\Management Server\ for your original installation files, the default path will be C:\GuardianEdge. If a local instance is selected during the installation of the Symantec Endpoint Encryption Management Server, uninstallation fails with the message, Could not connect to Microsoft SQL Server. If power is lost during an upgrade or migration of the client, the client may blue screen and fail to boot into Windows. If password authentication is selected during the installation of Symantec Endpoint Encryption Framework Manager console, but the policy requires token authentication, users cannot register. Following the successful application of a Symantec Endpoint Encryption migration package to an Encryption Plus Hard Disk , 7.1.0, or workstation, users must log on to Encryption Plus Hard Disk one last time. Shut the computer down. Remove the drive. Power on. Instruct the user to open the Novell SSO panel and select the Reset Single Sign-On to Novell Netware check box. Click Change and navigate to the desired destination of the Symantec Endpoint Encryption Management Server files. Locate the GEServerConfig.xml file on the Symantec Endpoint Encryption Management Server. Find (local). Replace with the computer name of the Symantec Endpoint Encryption Management Server. Save and close the file. Try the uninstall again. Run Recover /d. If Recover /d fails, try Recover /b. If the Recover Program completes successfully, first back up important files, then uninstall Encryption Plus Hard Disk or reinstall Symantec Endpoint Encryption Full Disk. If this fails, reinstall Windows or reimage the computer. Page 4 of 11

5 esata Drives MA23909/ On Windows computers, Full Disk may encrypt an esata drive not connected using an esata port that was built into the original computer. For example, esata drives connected using PCI, PCMCIA, or ExpressCard ports may get encrypted. If the Windows Safely Remove Hardware option is not available for an esata drive, Full Disk may encrypt it. Ensure that the computer is fully powered down before removing or connecting the drive. Do not connect the drive to any other computer. Reboot computer. Update the firmware. Update the BIOS. Update the disk controller driver. Opal-Compliant Drives MA23843/ Computers hang after resuming from sleep mode. Disable sleep mode on clients with Opal-compliant boot drives. Mac OS X Clients MA23248/ MA23418/ BU25451/ BU25612/ BU28838/ BU24999/ BU11936/ BU28805/ The Symantec Endpoint Encryption Full Disk client application hangs after receiving a policy containing a Client Administrator whose name is the same as one of the users. The Manager Console won t refresh the Mac OS X operating system version number if the operating system is upgraded after a policy has already been assigned. Users who restart to complete a software update during disk encryption may experience difficulty booting. A Certificate Trust prompt displays following the installation of Symantec Endpoint Encryption Full Disk on the Mac, if HTTPS communications are configured. Kernel panic occurs if an encrypted disk is erased or reformatted. NitroAV PCMCIA/FireWire 800 removable devices are unavailable for encryption. After being encrypted and decrypted many times, disks may disappear from the list of drives. Create and apply a new policy containing a Client Administrator with a name that differs from any user. Move the Mac OS X computer to the Unassigned group and back again to refresh the value. Turn off automatic updates during disk encryption. If difficulty booting occurs, use target disk mode. Provide administrative credentials and accept the changes. Decrypt the disk before erasing or reformatting it. Close PGP Desktop and then reopen PGP Desktop. BU28780/ Additional users cannot see the PGP Desktop icon. Additional users must open PGP from the Applications folder once for the PGP Desktop icon to be displayed. Page 5 of 11

6 BU28815/ BU28925/ BU28943/ BU28944/ Decryption does not begin when the user clicks Decrypt during re-encryption, re-encryption merely pauses. The User Access List in PGP Desktop may not display all users, such as after a successful WDRT process or when a large number of users are added. After reinstalling Symantec Endpoint Encryption Full Disk or gaining access to the Mac OS X system using the Whole Disk Recovery Token (WDRT), a message may indicate that the PGP Engine has stopped. Also, the PGP Desktop icon may disappear from the menu bar. Click Resume to resume re-encryption. Decrypt after re-encryption completes. Press OPTION as you select the PGP icon in the menu bar and select Quit. Then locate the PGP Desktop application on your system (usually in the Applications folder) and double-click the file. Locate the PGP Desktop application on your system (usually in the Applications folder) and double-click the file Decrypting a disk while the system is on battery power is not supported in this release This version of Symantec Endpoint Encryption Full Disk is not compatible with FileVault 2 encryption on Mac OS X 10.7 systems Symantec Endpoint Encryption Full Disk is not compatible with the Thunderbolt interface on Mac OS X systems. Do not decrypt an encrypted disk while you are running on battery power. Do not use Apple FileVault. Do not use the Thunderbolt interface. Token Authentication MA23633/ MA19987/ MA20673/ MA21516/ MA24025/ Dell Latitude D610 embedded readers cannot be used for token authentication. Tokens cannot be used for pre-windows authentication on the Acer Aspire The GemPC Express reader cannot be used for pre-windows authentication on an HP Compaq 6535b. ExpressCard SCM SCR3340 smart card reader users are prompted to type their PIN, even though Single Sign-On is enabled. Provide the user with an external card reader. Drive Fragmentation MA21057/ The following error message is displayed on the first reboot after installation, EPHD BIOS Translation Driver: heap allocation error. One or more drives are severely fragmented. Decrypt all drives. Uninstall Symantec Endpoint Encryption Full Disk. Defragment the drive(s). Reinstall Symantec Endpoint Encryption Full Disk. Page 6 of 11

7 Windows Power Management MA21816/ MA18851/ Autologon may not succeed on Windows 7 computers following hibernation of the endpoint if the Disengage if power lost check box is selected. Following the installation of Symantec Endpoint Encryption Full Disk, Vista computers missing the Sleep power option hibernate on a schedule that does not correspond to the Windows power plan. If the Disengage if power lost check box is selected, ensure that Windows 7 computers do not go into hibernation for the duration of the Autologon GPO policy. Apply all of the latest Vista updates. Safe Mode Reboot Option MA21491/ The Safe Mode reboot option may fail to allow administrators to access safe mode on certain computer models, such as the HP Compaq dc5800. Reboot. Provide Client Administrator credentials and select the Safe Mode Reboot check box. Click OK. Click Restart Computer. Watch screen closely. As soon as Starting SEE Full Disk displays, press F8. Select Safe Mode. Press F8. Select Safe Mode again. Manager Console MA23154/ MA21307/ MA20559/ Removable devices encrypted using Full Disk on a Mac OS X client are listed in the Fixed Drives tab as many times as they are encrypted. If an XPS print job is canceled, the following error may be displayed, The data area passed to a system call is too small. After clicking a column heading, the sort arrow is displayed to the left of the column heading if the operating system is Vista or Server Page 7 of 11

8 MA16623/ Deploying an Active Directory policy that contains a change to the Client Administrator settings from a Symantec Endpoint Encryption or later Manager to Symantec Endpoint Encryption or earlier and/or GuardianEdge Framework or earlier clients results in: a failure of the new Client Administrator policy to be applied, a deletion of all existing Client Administrator policies, and a return to the Client Administrators specified in the original installation settings. When deploying an Active Directory policy from a or earlier Manager, add the following WMI filter: Select * FROM Win32_Product WHERE (name= Symantec Endpoint Encryption Framework Client AND Version <= ) OR (name= GuardianEdge Framework Client OR name= Encryption Anywhere Framework Client ) AND version <= )) When deploying an Active Directory policy from a or later Manager, add the following WMI filter: Select * FROM Win32_Product WHERE (name = Symantec Endpoint Encryption Framework Client AND version > "6.1.0") OR (name = GuardianEdge Framework Client AND version > "9.0.0") Client Keyboards MA19021/ MA19019/ MA16958/ MA18893/ MA19067/ MA19335/ MA23142/ Users may be unable to combine the ^ (Circumflex), (Diaeresis), ` (Grave) and (Acute) dead keys with l (0131), I (0049), Shift+i (0069) or Shift+I (0130) from the Turkish Q keyboard. The Turkish Q character İ; (0130) may display as I in pre-windows. Users cannot type the following characters from Canadian French keyboards in pre-windows: á ç The CAPSLOCK key behaves like the SHIFTLOCK key for non-alphabet characters in pre-windows for the Belgian (Period), French, and German keyboards. The character ł (0142) displays as Ł (0141) in pre-windows when the Hungarian keyboard is used. CTRL+ALT combinations do not produce the expected special characters in pre-windows. If the Portuguese (Brazil) character ; (0x20A2) displays as a box with a hex character inside during pre-windows authentication. Ignore the incorrect display. Page 8 of 11

9 Single Sign-On MA15304/ MA15302/ Users are unregistered from Symantec Endpoint Encryption after pressing CRTL+ALT+DEL in Windows Vista, clicking Change Password, and: Provides the incorrect old password causing an error, or Is prevented from changing their password due to Windows policy and then cancels out. Visit kb/ Obtain and apply the hot fix. Pre-Windows Help and Keyboard Layout Windows MA18231/ Users cannot use the Keyboard Layout window if Help is open. Close the Help window and try again. Section 508 MA16937/ JAWS does not always announce all of the information in the Registration wizard and User Client consoles. Users should follow these steps: 1. Press INSERT+F9. 2. Select the frame that is of interest from the resultant Frames List dialog. 3. Click OK. 4. Press P. If this doesn t work, restart JAWS and try the steps again. Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or Web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our Web site at the following URL: Page 9 of 11

10 All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Contacting Technical Support Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes Licensing and registration If your Symantec product requires registration or a license key, access our technical support Web page at the following URL: Customer service Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals Page 10 of 11

11 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, Africa North America, Latin America Copyright and Trademarks Copyright (c) 2012 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. Page 11 of 11