Symantec Endpoint Encrypion Full Disk

Transcription

1 Symantec Endpoint Encrypion Full Disk Guide Version 7.0

2 Information in this document is subject to change without notice. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Symantec Corporation Symantec Corporation. All rights reserved. GuardianEdge and Encryption Anywhere are either trademarks or registered trademarks of GuardianEdge Technologies Inc. Microsoft, Active Directory, Windows, and Windows XP are either registered trademarks or trademarks of Microsoft Corporation. Any other trademarks used herein are the property of their respective owners and are hereby acknowledged. Other product and company names mentioned herein may be the trademarks of their respective owners. Printed in the United States of America.

3 Contents Contents 1. Introduction Basics About the Installation Install Snap-in Adding the Snap-in to the SEE Manager Use of the Upgrades Client Operation Installation Return Codes Autologon Order of Precedence Uninstalling an Autologon MSI Deployed Using an Active Directory Policy Symantec Endpoint Encryption Full Disk iii

4 Figures Figures Figure 1 Installer, Welcome Figure 2 Installer, Destination Folder Figure 3 Installer, Ready to Install Figure 4 Installer, Installation Completed Figure 5 Add Standalone Snap-in Figure 6 Management Password Page Figure 7 Management Password Page, SEE Database Instance Authentication Figure 8 Settings Figure 9 Save the MSI package Symantec Endpoint Encryption Full Disk iv

5 Introduction 1. Introduction Basics The SEE Full Disk Autologon feature provides administrators with the ability to bypass the normal pre-windows SEE Full Disk client authentication process. The Autologon feature can be controlled by using an Active Directory Group Policy Object (GPO), a native policy, or by using the described in this document. All methods can be used at the same time, with the client behavior defined according to a strict hierarchy of precedence. About the The is an MMC snap-in intended for use by administrators lacking the necessary rights to create or apply an Autologon Active Directory policy or native policy. As with the Active Directory and native policy versions of Autologon, the is used by administrators to set the number of reboots and active period of time during which the normal pre-windows SEE Full Disk authentication screen is suppressed on the client. After the administrator chooses the settings, the Autologon Utility produces an MSI package that can then be installed on the Client Computers using any standard MSI deployment method. This version of the is compatible with Symantec Endpoint Encryption Full Disk Symantec Endpoint Encryption Full Disk 3

6 2. Installation Install Snap-in To install the snap-in on a Manager Computer, perform the following steps. The SEE Framework must be installed before the can be installed. 1. Locate and launch the installation file Symantec Endpoint Encryption Autologon.msi. The Welcome page of the installer wizard appears. Figure 1 Installer, Welcome 2. Click Next. The License Agreement screen appears. Click I accept the terms in the license agreement. Click Next. The Destination Folder page appears. Symantec Endpoint Encryption Full Disk 4

7 Figure 2 Installer, Destination Folder 3. Click Change to select an installation location other than the default. Click Next. The Ready to Install the Program page appears. Figure 3 Installer, Ready to Install 4. Click Install. When the installation process has finished, the completion screen appears. Symantec Endpoint Encryption Full Disk 5

8 Figure 4 Installer, Installation Completed 5. Click Finish. The snap-in is now ready to be added to the SEE Manager or to a custom MMC. Adding the Snap-in to the SEE Manager 1. Launch the SEE Manager. From the File menu, click Add/Remove Snap-in. To succeed in adding the snap-in to the SEE Manager, the SEE Manager must have been installed in author mode. 2. The Add/Remove Snap-in window appears. Click File, then click Add/Remove Snap-in. 3. The Add/Remove Snap-in window opens. Click Add. The Add Standalone Snap-in window opens (Figure 5). Figure 5 Add Standalone Snap-in Symantec Endpoint Encryption Full Disk 6

9 4. Select. 5. Click Add, then click Close. 6. From the Add/Remove Snap-in window, click OK. SEE appears in the SEE Manager. The is now installed and ready for use. Use of the 1. Open the SEE Manager. 2. In the left pane, click on Symantec Endpoint Encryption. The Management Password page appears in the right pane (Figure 6). Figure 6 Management Password Page 3. Type the Management Password and click Next. If you are not logged on to Windows with read and write privileges to the SEE database, you will be prompted to authenticate to the SEE database using SQL database credentials. Symantec Endpoint Encryption Full Disk 7

10 Figure 7 Management Password Page, SEE Database Instance Authentication 4. Type SQL credentials with read and write privileges on the and click OK. The Autologon Settings page appears. Because the authenticates to the SEE database, you must be connected to your network when using the utility. Figure 8 Settings 5. Type the number of reboots, select the start month/day/year/time, and select the end month/day/year/time. Click Finish. In the dialog box that appears, select a destination location to save the Autologon MSI. Symantec Endpoint Encryption Full Disk 8

11 Figure 9 Save the MSI package You may save the Autologon MSI using a custom name, or accept the default name Autologon [start_date] - [end_date], where start_date and end_date are the starting and ending dates you selected in the Autologon Utility. However, if you plan to upgrade the Autologon MSI later on, the MSI package you upgrade it with must have the same name as the original Autologon MSI package. 6. Click Save. The Autologon MSI is now ready to be installed on Client Computers using any of the standard MSI deployment methods. Note that Client Computers must have both SEE Framework and SEE Full Disk installed. Upgrades You can upgrade from an existing version of the either by using an Active Directory software installation GPO or by invoking the Windows Installer. If the is upgraded as part of a software installation GPO, the Client Computer will restart one time after the upgrade. This mandatory restart will consume one of the remaining grace restarts on the client. On Client Computers where all grace restarts have been exhausted, users are forced to register for a SEE account before being allowed access to Windows. If the is upgraded manually, you can defer the restart by invoking the Windows Installer with the following command line parameters: MSIEXEC /i "[path]\name_of_autologon_package_to_upgrade.msi" REINSTALL="ALL" REINSTALLMODE="vomus" REBOOT=ReallySuppress Where Name_of_Autologon_Package_to_Upgrade is the name of the existing Autologon MSI that you are upgrading. If you prefer to not defer the restart following the upgrade, use the following command line: Symantec Endpoint Encryption Full Disk 9

12 MSIEXEC /i "[path]\name_of_autologon_package_to_upgrade.msi" REINSTALL="ALL" REINSTALLMODE="vomus" Client Operation Use of the Autologon MSI requires that SEE Full Disk is fully installed on the Client Computer. SEE Full Disk is fully installed only after the Client Computer has restarted following the installation of the SEE Framework and Full Disk Client packages. The Client Computer must make and maintain contact with the SEE Management Server in order for the Autologon MSI to remain operational. Use the SEE Manager to verify that successful client-server communication is taking place. The client checks connectivity every 5 minutes. When the Autologon MSI is operational, the Autologon process will be deactivated if the Client Computer loses connectivity with the SEE Management Server. Once the Client Computer has restarted into Windows and re-establishes contact with the SEE Management Server, the Autologon process will resume. If the Client Computer remains shut down for more than ten minutes, the Autologon feature terminates. Installation Return Codes If MsiExec.exe or InstMsi.exe are used to install the Autologon MSI package, the return codes shown in the following table will be written to the Windows system event log on the client to indicate a successful installation. Table 1 Installation Error Codes Error Code Value Description ERROR_SUCCESS 0 The action completed successfully ERROR_SUCCESS_REBOOT_INITIATED 1641 ERROR_SUCCESS_REBOOT_REQUIRED 3010 The installer has initiated a restart. This message is indicative of a success. A restart is required to complete the install. This message is indicative of a success. This does not include installs where the ForceReboot action is run. Symantec Endpoint Encryption Full Disk 10

13 Autologon Order of Precedence Both an Autologon policy as well as an Autologon MSI can be active on the Client Computer at the same time. However, the client will honor each according to the hierarchy shown in Table 2. Table 2 Autologon Order of Precedence Order of Precedence Pre-Boot Authentication Suppression Feature (1) Highest Autologon policy, Indefinite mode Notes When using an Autologon policy in Indefinite mode. (2) High Autologon MSI End date is in the future (even if the start date has not been reached) and the maximum number of reboots has not been reached. (3) Low Autologon policy, normal mode When not using Indefinite Autologon mode. (4) Lowest Grace restarts User has not yet registered. When an MSI or policy-based Autologon expires or is removed, Grace restarts resume with the remaining value. Uninstalling an Autologon MSI Deployed Using an Active Directory Policy As is true of any software deployed using an Active Directory software installation GPO, the Autologon MSI should never be uninstalled manually at the client. Packages deployed using a software installation GPO should only be uninstalled by removing or changing the scope of the software installation GPO. Attempting to remove GPOdeployed client packages by manually uninstalling the packages using the Add or Remove Programs control panel on the client while the software installation GPO is still in effect will result in the packages being reinstalled at the next restart. Further attempts to uninstall the client packages will result in an error. As a Policy Administrator, you should set the appropriate Windows policies to prevent users from manually removing the client packages. Symantec Endpoint Encryption Full Disk 11