Symantec Endpoint Encryption Full Disk

Transcription

1 Symantec Endpoint Encryption Full Disk Installation Guide Version 7.0

2 Information in this document is subject to change without notice. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Symantec Corporation Symantec Corporation. All rights reserved. Encryption Anywhere and Authenti-Check are either trademarks or registered trademarks of GuardianEdge Technologies Inc. Microsoft, Active Directory, Windows, Windows 2000, Windows XP, Windows Vista, Windows 2000 Server, and Windows Server 2003 are either registered trademarks or trademarks of Microsoft Corporation. Novell is a registered trademark of Novell, Inc. Any other trademarks used herein are the property of their respective owners and are hereby acknowledged. Other product and company names mentioned herein may be the trademarks of their respective owners. Printed in the United States of America.

3 Contents Contents 1. Introduction Overview Architecture Services and Associated Ports/Protocols System Requirements Basics SEE Management Server Novell edirectory Active Directory SEE Database Instance Manager Computer(s) Client Computers SEE Installation Sequence Account Provisioning SEE Database Instance SEE Management Server SEE Manager SEE Client SEE Roles Policy Administrator Client Administrator User SEE Management Server Overview Basics Database Instance Prerequisites SEE Management Server Prerequisites HTTPS Prerequisites Summary of Steps SEE Management Server InstallShield Wizard Basics Active Directory Synchronization Novell edirectory Synchronization Selected Both Active Directory & edirectory Synchronization Selected Verification SEE Management Server SEE Database Instance Log Files Backup SEE Manager Overview Default and Serverless Installation Modes HTTPS Prerequisite Microsoft Administration Tools Basics Symantec Endpoint Encryption Full Disk iii

4 Contents Group Policy Management Console Windows Server 2003 Administration Tools Pack SEE Manager Setup Process Framework InstallShield Wizard Full Disk InstallShield Wizard Add Forest One-Time Password Program Basics Installation Creating SEE Policy Administrators Steps to Create Verification Policy Administrator Default Capabilities Establishing Default SEE Policies Basics Limiting Access to the SEE Snap-ins Creating a Policy that Restricts Access to Snap-ins Restricting Access to Snap-in Extensions Creating a Policy that Permits Access to Snap-ins Segmenting Support Duties Client Installation Package Creation Framework Installation Settings Wizard Basics Client Administrators Registered Users Single Sign-On Password Authentication Removable Storage Certificates Authentication Message Authenti-Check One-Time Password Communication Encryption Saving the Framework Client Installer MSI Full Disk Installation Settings Wizard Basics Startup Logon History Encryption Installer Customization Client Monitor Saving the Full Disk Client Installer MSI Client Installations Overview Deploying Client Installer Packages Third-Party Tool Deployment Group Policy Deployment Manual Client Installations Basics Symantec Endpoint Encryption Full Disk iv

5 Contents Framework Install Full Disk Install Upgrades Overview SEE Management Server Basics Prerequisites Running the Key Exporter Script Verification SEE Manager Basics Version Number Determination Framework Upgrade Full Disk Upgrade SEE Client Computers Basics Creating Client Upgrade Packages Upgrading Client Installer Packages Client Upgrade Methods Deploying and Installing Client Module Upgrades Uninstallation Overview SEE Management Server SEE Manager SEE Client Computer Basics Client Packages Deployed Using a GPO Using a Command Line Appendix A. Extending Domain User Rights with DSACLS Overview Prerequisites Summary of Steps Install ADAM Administrator Tools Grant List Children & Read Property Access Permissions Testing AD Synchronization Glossary Index Symantec Endpoint Encryption Full Disk v

6 Figures Figures Figure 1.1 Architectural Overview Figure 2.1 Database Server Figure 2.2 Database Configuration Figure 2.3 Directory Synchronization, Active Directory Selected Figure 2.4 Active Directory Synchronization, Account Credentials Figure 2.5 edirectory Synchronization, Account Credentials Figure 2.6 Directory Synchronization, Policy Precedence Figure 2.7 IIS Client Account Credentials Figure 2.8 Client Server Communications, HTTP Protocol Figure 2.9 Client Server Communications, HTTPS Protocol Figure 2.10 Destination Folder Figure 2.11 Ready to Install Program Figure 3.1 Framework Manager Installer, Destination Folder Figure 3.2 Framework Manager Installer, Database Server Figure 3.3 Management Password and Random String Backup Figure 3.4 Framework Manager Installer, Ready to Install the Program Figure 3.5 Framework Manager Installer, Database Server Figure 3.6 Framework Manager Installer, One-Time Password Key Figure 3.7 Management Password and Random String Backup Figure 3.8 One-Time Password Key, Use an Existing OTP Key Figure 3.9 Full Disk Manager Installer, Destination Folder Figure 3.10 Full Disk Manager Installer, Ready to Install Program Figure 3.11 Group Policy Management Console Add Forest Figure 3.12 One-Time Password Program Installer, Destination Folder Figure 3.13 Add/Remove Snap-In without OTP Figure 3.14 Add Standalone Snap-In Figure 3.15 Add/Remove Snap-In with OTP Figure 3.16 SEE Manager, Human Resources OU Figure 3.17 Restricted Snap-in Warning Screen Figure 3.18 Restricted Snap-in Error Screen Figure 4.1 Framework Installation Settings, Client Administrators Figure 4.2 Framework Installation Settings, Registered Users Figure 4.3 Framework Installation Settings, Single Sign-On Figure 4.4 Framework Installation Settings, Password Authentication Figure 4.5 Framework Installation Settings, Removable Storage Certificates Figure 4.6 Framework Installation Settings, Authentication Message Figure 4.7 Framework Installation Settings, Authenti-Check Figure 4.8 Framework Installation Settings, One-Time Password Figure 4.9 Framework Installation Settings, Communication Figure 4.10 Framework Installation Settings, Encryption Figure 4.11 Save MSI Package, Framework Client Figure 4.12 Full Disk Installation Settings, Startup Figure 4.13 Full Disk Installation Settings, Logon History Figure 4.14 Full Disk Installation Settings, Encryption Figure 4.15 Full Disk Installation Settings, Installer Customization Figure 4.16 Installation Settings, Client Monitor Figure 4.17 Select Output MSI Package, Full Disk Client Figure 5.1 Group Policy Object Editor Figure 5.2 Changing the Scope of the Software Installation Policy Figure 5.3 Framework Client Installer Destination Folder Figure 5.4 Framework Client Ready to Install Symantec Endpoint Encryption Full Disk vi

7 Figures Figure 5.5 Framework Client Installer Restart Figure 5.6 Full Disk Client Installer Destination Folder Figure 5.7 Full Disk Client Ready to Install Figure 5.8 Full Disk Client Installer Restart Figure 6.1 Software Installation GPO, Add Upgrade Package Figure 7.1 Add or Remove Programs Wizard Warning Figure 7.2 Remove SEE One-Time Password Program Figure 7.3 Remove SEE Full Disk Figure 7.4 Remove SEE Framework Symantec Endpoint Encryption Full Disk vii

8 Tables Tables Table 1.1 Service Ports and Protocols Table 1.2 SEE Management Server Hardware Requirements Table 1.3 SEE Management Server Software Requirements Table 1.4 SEE Database Instance Software Requirements Table 1.5 Manager Computer Hardware Requirements Table 1.6 Manager Computer Software Requirements Table 1.7 Client Computer Hardware Requirements Table 1.8 Client Computer Software Requirements Table 1.9 Required Accounts Table 1.10 Synchronization Accounts Table 1.11 Optional Accounts Table 1.12 Optional Groups Table 1.13 Client Administrator Levels of Privilege Table 5.1 MSIEXEC Parameters for Framework Table 5.2 MSIEXEC Parameters for Full Disk Table 6.1 Parameters of the Key Export Script Symantec Endpoint Encryption Full Disk viii

9 Introduction 1. Introduction Overview Symantec Endpoint Encryption Full Disk ensures that only authorized users can access data stored on hard disks. This safeguards enterprises from the accidental loss or theft of a laptop or PC and eliminates the legal need for public disclosure. As part of Symantec Endpoint Encryption, SEE Full Disk leverages existing IT infrastructures for seamless deployment and operation. This Guide is intended for use by the team of administrators responsible for provisioning and deploying the system. This chapter provides you with an overview of Symantec Endpoint Encryption using an architectural diagram and defines the required system components and software you need prior to installation. The sections are as follows: Architecture on page 1 Services and Associated Ports/Protocols on page 2 System Requirements on page 3 SEE on page 5 SEE Roles on page 7 Architecture Refer to Figure 1.1 to view SEE components, communications protocols between components, and their interrelationships. Included in this diagram are the protocols used for communication between SEE Client Computers, the SEE Management Server, Active Directory, and optionally, Novell edirectory. While the diagram shows all clients as members of a domain, multi-domain configurations within a single Active Directory forest are supported. Multiple Active Directory forests and multiple Novell edirectory trees are not supported. Symantec Endpoint Encryption Full Disk 1

10 Introduction HTTP(S)/SOAP Client Group Policy ODBC LDAP Active Directory Domain Controller Client Manager Computer Database Server Novell edirectory Server SEE Management Server Client your-org.com Client your_tree Client Figure 1.1 Architectural Overview Services and Associated Ports/Protocols Refer to the following table to see a list of each service, and its associated default port(s) and protocol(s), as shown in Figure 1.1. Table 1.1 Service Ports and Protocols Service(s) Purpose(s) Used by Port/Protocol Protocol Server Message Block (SMB) Group Policy Objects (GPOs) Client Computers 445 TCP/UDP Lightweight Directory Access Protocol (LDAP); LDAP ping Global Catalog LDAP LDAP HTTP/HTTPS Apply GPOs; retrieve Active Directory and edirectory GUIDs Synchronize data from Active Directory and edirectory Synchronize data from Active Directory and edirectory Client-Server communication Client Computers 389 TCP/UDP SEE Management Server SEE Management Server Client Computers SEE Management Server 3268 TCP 389 TCP configurable TCP/SSL Symantec Endpoint Encryption Full Disk 2

11 Introduction System Requirements Basics An Active Directory domain is required for hosting the SEE Management Server, SEE database instance, Manager Computer(s) and all must reside in the same Active Directory forest. It is recommended that the Global Catalog Server be located in the same site and/or domain as the SEE Management Server. SEE Management Server The SEE Management Server should be installed on a member server. Table 1.2 SEE Management Server Hardware Requirements Component Type Processor RAM Free disk space Requirement 1.3 GHz Intel Pentium 4 or higher processor (or equivalent) 1 GB 80 MB Table 1.3 SEE Management Server Software Requirements Operating System Edition(s) Service Pack(s) Windows Server 2003 Standard or Enterprise SP1 or SP2 Includes Windows Server 2003 R2 Additional Software Microsoft.NET Framework 2.0 Internet Information Services (IIS) application server v6.0 with ASP.NET installed Novell edirectory SEE supports synchronization with Novell edirectory versions and Active Directory SEE supports synchronization with an Active Directory that has a domain functional level of Windows 2000 native or higher and a forest functional level of Windows 2000 or higher. SEE Database Instance The SEE database instance can be hosted on an existing server in the corporate datacenter, on the SEE Management Server, or on any computer that is a member of the Active Directory forest/domain. Hosting the SEE database instance in the corporate datacenter is recommended, as it can leverage existing enterprise-wide backup procedures. It is recommended that the SEE database instance be located in the same domain as the optional domain local groups: the One-Time Password group, and the Policy Administrators group. The SEE database instance must be configured to use mixed mode authentication. In addition, both local and remote connections must be allowed, using both TCP/IP and named pipes. Table 1.4 SEE Database Instance Software Requirements Component Type Supported versions of Microsoft SQL Server Free disk space Requirement Microsoft SQL Server 2005 Standard Edition Microsoft SQL Server 2005 Enterprise Edition Microsoft SQL Server 2005 Express Edition with Advanced Services 1 GB minimum, more depending on the number of Client Computers Symantec Endpoint Encryption Full Disk 3

12 Introduction Manager Computer(s) Each Manager Computer must be a member of the Active Directory forest/domain. Table 1.5 Manager Computer Hardware Requirements Component Type Processor RAM Free disk space Requirement 223 MHz or faster 512 MB or more recommended 80 MB Table 1.6 Manager Computer Software Requirements Operating System Edition(s) Service Pack(s) Windows XP Professional SP2 or SP3 Windows Server 2003 Standard or Enterprise SP1 or SP2 Windows Vista Business, Ultimate, or Enterprise None or SP1 Additional Software Microsoft.NET Framework 1.1 and Microsoft.NET Framework 2.0 Microsoft Management Console 3.0 Group Policy Management Console with SP1 (GPMC.msi) Server 2003 Administration Tools Pack (adminpak.msi) Microsoft.NET Framework 2.0 Microsoft Management Console 3.0 Group Policy Management Console with SP1 (GPMC.msi) Server 2003 Administration Tools Pack (adminpak.msi) Client Computers Basics Fast user switching is not supported. The system BIOS must support extended INT 13h. SCSI devices that do not use INT 13h to access the hard disk are not supported. The NTFS and FAT32 formats are supported for the primary hard disk. Symantec recommends disabling the USB emulation setting in the system BIOS. Client Computers configured to boot from more than one partition (i.e. a dual or multi-boot system), must be reconfigured to boot from a single partition before SEE Full Disk can be installed. SEE Full Disk relies on the Master Boot Record (MBR). System restore tools that replace the MBR, such as IBM Rescue and Recover, can cause serious problems to Client Computers and are not compatible with SEE Full Disk. SEE Full Disk relies on its client database files and cannot protect them before Windows has loaded. Boot-time defragmentation programs will scramble the client database files and prevent the computer from booting. Single Sign-On (SSO) SEE s Single Sign-On feature will synchronize with Novell Client 4.91 Service Pack 3 (SP3). Section 508 SEE Full Disk provides Section 508 compliant text-to-speech capability for its Windows user interface components when used with JAWS version or later. Symantec Endpoint Encryption Full Disk 4

13 Introduction Hardware Table 1.7 Client Computer Hardware Requirements Component Type Processor RAM Free disk space Software Requirement 223 MHz or faster 512 MB or more recommended 65 MB Canadian French Chinese Bopomofo IME* French German Italian Keyboard Japanese* Korean* Portuguese Spanish United Kingdom US English * Users will only be able to enter those characters that can also be typed from the US English keyboard. Table 1.8 Client Computer Software Requirements Operating System Edition(s) Service Pack(s) Additional Software Windows XP Professional or Tablet* SP1, SP2 or SP3 Microsoft.NET Framework 1.1 or 2.0 Microsoft Internet Explorer 6.0 with SP2 or Internet Explorer 7 Windows 2000 Professional SP4 Microsoft.NET Framework 1.1 or 2.0 Microsoft Internet Explorer 6.0 with SP2 Windows Vista Business, Ultimate, or Enterprise None or SP1 * A keyboard is required for tablet PCs. Windows Vista is only supported when run on Vista Capable hardware. SSO synchronization with Novell Client SP3 is not supported on Windows Vista. SEE Installation Sequence SEE must be installed in the following sequence: 1. Required account provisioning, 2. SEE database instance, 3. SEE Management Server, 4. SEE Manager, and 5. SEE client. Symantec Endpoint Encryption Full Disk 5

14 Introduction Account Provisioning Basics SEE uses several domain user accounts and domain groups for its operation. The following tables list the accounts that must be provisioned prior to installation of the SEE Management Server, as well as accounts and groups that are optional to deployment. Required Accounts The following accounts are required to deploy the product in its minimum configuration. Table 1.9 Required Accounts Account IIS client account Database creation account Policy Administrator account Description Each Client Computer shares a single domain user account to authenticate to IIS on the SEE Management Server. No specific privileges are required for this account. A Windows or SQL Server account with sufficient privileges to create a database is required to execute the SEE Management Server installation. Policy Administrators must be provisioned with read-write access to the SEE database. Either a Windows or a SQL account can be used for this purpose. This account will allow the Policy Administrator to use the snap-ins of the SEE Manager. If you choose to use a Windows account for database access, a Policy Administrators group may ease administration. See Optional Groups on page 6. Synchronization Accounts The following accounts are required to enable the synchronization feature. Table 1.10 Synchronization Accounts Account Active Directory synchronization account edirectory synchronization account Description To enable synchronization with Active Directory, a domain user account in the same domain that the SEE Management Server has been joined to is required. The Active Directory synchronization service uses this account to bind to Active Directory. If the account does not have domain administrator privileges, you must extend the account privileges so that they include read permissions to the deleted objects container in Active Directory. One method of doing so is described in Appendix A, Extending Domain User Rights with DSACLS, on page 80. To enable synchronization with Novell edirectory, an edirectory account with read-only permissions to the edirectory tree is required. Optional Accounts The following accounts are optional. Table 1.11 Optional Accounts Account IIS administrator account One-Time Password account Description To effect changes to the IIS configuration using the Configuration Editor, an account with administrative rights in IIS is required. If you plan to allow certain Policy Administrators access to the One-Time Password Program snap-in only, provisioning them with a read-only database account is recommended. This account can be either a Windows or a SQL account. If you choose to use a Windows account for database access, a One-Time Password group may ease administration. See next section. Optional Groups The following groups may be used to ease the administration of Policy Administrator database accounts, if Windows authentication is chosen for this purpose. In order to create domain groups, you will need an account with create child Symantec Endpoint Encryption Full Disk 6

15 Introduction permissions in Active Directory. Locating the groups in the same domain as the SEE database instance is recommended. Domain local groups can be assigned member permissions only within the same domain, but can contain accounts or groups from any domain. Table 1.12 Optional Groups Account Policy Administrators group One-Time Password group Description An optional domain local group with read-write permissions to the SEE database. It is used for managing Policy Administrator accounts when Windows authentication to the database is used. An optional domain local group with read-only permissions to the SEE database. It is used for managing One-Time Password accounts, when Windows authentication is chosen. SEE Database Instance The SEE database instance is a standard installation of a supported version of Microsoft SQL Server 2005 configured for mixed mode authentication. The database and necessary tables are created during installation of the SEE Management Server. SEE Management Server The SEE Management Server enables all aspects of SEE policy management and application, accepts data reported by Client Computers and stores that data in the SEE database instance, and (optionally) synchronizes information from Active Directory and/or edirectory to the SEE database instance. SEE Manager Installing the SEE Manager setup packages creates a customized Microsoft Management Console (MMC) containing the SEE snap-ins and snap-in extensions. The SEE Manager setup packages consist of the following two files: Symantec Endpoint Encryption Framework.msi Symantec Endpoint Encryption Full Disk Edition.msi SEE Client The SEE client installation packages deliver the client software, software upgrades, and initial settings to Client Computers. The client installation packages consist of two MSIs and two log files. The log files document the contents of the associated MSI. Symantec Endpoint Encryption Framework Client.msi FrameworkSettings month_day_year-hour.minute.sec.log Symantec Endpoint Encryption Full Disk Edition Client.msi HardDiskSettings month_day_year-hour.minute.sec.log where month, day, year, hour, minute, and sec are the date and time the package was created SEE Roles Policy Administrator Policy Administrators perform centralized administration of SEE. Using the Manager Console and the Manager Computer, the Policy Administrator: Creates and deploys client installation packages. Updates and sets client policies. Runs reports. Changes the Management Password. Symantec Endpoint Encryption Full Disk 7

16 Introduction Reconfigures the SEE Management Server if necessary. Runs the One-Time Password Program. Creates the computer-specific Recover DAT file necessary for Recover \B. Policy Administrators log on to their workstation using a Windows account. Access to the individual snap-ins of the SEE Manager can be restricted by Windows privilege. The Policy Administrator will require access privileges to the SEE database. These can be provided through their Windows account or the Policy Administrator can be required to log on to the SEE database using SQL authentication. Read and write access to the SEE database is required for all snap-ins except the One-Time Password Program. Only read access is necessary for the One-Time Password Program. The Policy Administrator s account privileges are maintained by Windows and Microsoft SQL Server; SEE does not manage these accounts. Policy Administrators should be trusted in accordance with their assigned level of privilege. Client Administrator Client Administrators provide local support to SEE users and guarantee that SEE protected computers are always accessible even when all SEE users have been removed from those computers. Each Client Computer must have at least one Client Administrator account and can have up to 100. The Policy Administrator creates and maintains Client Administrator accounts, using the SEE Manager. Because Client Administrator accounts are managed entirely by SEE and do not relate to Windows accounts, Client Administrators can support users who are not a part of the domain. The Policy Administrator assigns one of three privilege levels to each Client Administrator account. At least one Client Administrator account with a privilege level of high must exist on each workstation. Table 1.13 Client Administrator Levels of Privilege Level Can Unlock Computer Can Extend Next Communication Due Date Client Administrators should be trusted in accordance with their assigned level of privilege. There must be at least one Client Administrator on each workstation to allow hard disk recovery. Client Administrator passwords are managed by the Policy Administrator and cannot be changed on the workstation. This single-source password management allows Client Administrators to remember only one password as they move among many Client Computers. If password(s) were local to each computer, then remembering multiple passwords would become unwieldy. Client Administrator accounts have the following restrictions: Client Administrators do not have either of the authentication assistance methods (Authenti-Check and One-Time Password) available. Client Administrators cannot use Single Sign-On. Can Run Recover Program Can Decrypt Hard Disk Can Unregister Users High Medium Low User SEE Full Disk protects the data stored on the Client Computer by encrypting it and requiring valid credentials to be provided before allowing Windows to load. During the registration process, users set their SEE credentials, allowing them to power the machine on from an off state and gain access to Windows. Only the credentials of registered users and Client Administrators will be accepted by SEE Full Disk. At least one user is required to register with SEE on each Client Computer. Symantec Endpoint Encryption Full Disk 8

17 Introduction A wizard guides the user through the registration process, which involves a maximum of four screens. The registration process can also be configured to occur without user intervention. Authentication to SEE Full Disk can be configured to occur in one of three ways: Single Sign-On enabled The user will be prompted to authenticate once each time they restart their computer. Single Sign-On not enabled The user must log on twice: once to SEE Full Disk and then separately to Windows. Automatic authentication enabled The user is not prompted to provide credentials to SEE Full Disk; the authentication process is transparent. This option relies on Windows to validate the user s credentials. To ensure the success of this product in securing your encrypted assets, do not define users as local administrators or give users local administrative privileges. Symantec Endpoint Encryption Full Disk 9

18 SEE Management Server 2. SEE Management Server Overview Basics This chapter describes how to install the SEE Management Server on a member server. After ensuring that all prerequisites have been met, you will run the SEE Management Server installer. Database Instance Prerequisites Prior to installing the SEE Management Server, the SEE database instance must be provisioned according to the following requirements: A member server running Windows 2003 Server for hosting the SEE database instance. This server must be a member of the same Active Directory forest as and accessible to the SEE Management Server. The member server must be installed with.net Framework 2.0. The member server must be installed with a supported version of Microsoft SQL Server SQL Server must be configured to allow mixed-mode authentication. SQL Server must be configured to allow local and remote connections, using both TCP-IP and named pipes. SEE Management Server Prerequisites Once the SEE database instance has been provisioned, you can begin installation of the SEE Management Server on a computer that meets the following requirements: A member server running Windows 2003 Server for hosting the SEE Management Server. This server must be a member of an Active Directory forest domain that contains at least one Global Catalog server in the same site and/ or domain that the SEE Management Server has been joined to, and must be on the same corporate network as and accessible to the SEE database instance. The member server hosting the SEE Management Server must be configured as an application server (IIS) with ASP.NET installed. One Active Directory domain user account with limited access privileges, the IIS client account. This account is shared among all SEE Client Computers and is used to authenticate to IIS on the SEE Management Server. One Active Directory domain user account, the database creation account. This account must have administrative privileges on the server hosting the SEE database instance, and is used during installation of the SEE Management Server. Alternately, you can use an SQL account that has administrative privileges, for example, the built-in SA account. One or more Active Directory domain user accounts assigned to the Policy Administrator role. These accounts can be given membership in the optional Policy Administrators group, allowing them read-write access to the SEE database from the SEE Manager. One Active Directory domain user account, the Active Directory synchronization account. This account is only required if synchronization with Active Directory is enabled. This account must have domain administrator privileges in the same site and/or domain that the SEE Management Server has been joined to. Note that if your corporate security policy prohibits the use of an administrator account, a non-administrator account can be used, provided that it has been granted read permissions to the Active Directory deleted objects container. See Extending Domain User Rights with DSACLS on page 80. One Novell edirectory account, the edirectory synchronization account. This account must have read-only privileges to edirectory. This account is only required if synchronization with edirectory is enabled. Symantec Endpoint Encryption Full Disk 10

19 SEE Management Server One optional Active Directory domain user account, the IIS administrator account. This account is necessary to effect changes to IIS configuration using the Configuration Editor. One optional Active Directory domain user account, the One-Time Password account. This account can be given membership in the optional One-Time Password group, allowing it read-only access to the SEE database. One optional domain local group with read-write permissions to the SEE database. It is used for managing Policy administrator accounts. One optional domain local group with read-only permissions to the SEE database. It is used for managing One- Time Password accounts. The installer file, Symantec Endpoint Encryption Management Server.msi. This file could be located on a shared network directory, on the SEE Management Server, or in some other location. The person who provided you with this Guide should be able to direct you to this location. A domain user account with administrative privileges on the member server. This domain user account will be used for running the SEE Management Server installer. The user names and passwords of two of the required Active Directory domain user accounts: the IIS client account and the database creation account (see Table 1.9 on page 6). The user names and passwords of any optional accounts: the Active Directory synchronization account, and/or the edirectory synchronization account (see Table 1.10 on page 6). HTTPS Prerequisites If you plan to use HTTPS communication between Client Computers and the SEE Management Server, you must install the server-side certificate on the SEE Management Server. This certificate must be valid for IIS and possess the following characteristics: Valid during the period in which it will be used. Enabled for server authentication. Contain the private key. Have a common name (CN) that is the computer name of the SEE Management Server. Summary of Steps This chapter will walk you through the remaining steps necessary to complete installation: 1. Install the SEE Management Server InstallShield Wizard from the GUI or the command line. 2. Verify correct operation of the SEE Management Server. 3. Perform a backup of the SEE database instance. If you are upgrading from a previous version of SEE, you must also run a script that migrates important data objects from the existing ADAM-based SEE Server to the new SQL-based SEE database instance. See the Upgrades chapter of this Guide for information on how to run this script. Symantec Endpoint Encryption Full Disk 11

20 SEE Management Server SEE Management Server InstallShield Wizard Basics Locate the SEE Management Server installer (Symantec Endpoint Encryption Management Server.msi) and launch it from the GUI or command line. Running the installer from the command line allows you to specify a output log file, which can be helpful for troubleshooting installation problems. To run the installer from the command line, click Start, click Run, type cmd, then click OK to open a new command prompt window. Invoke the Windows Installer (msiexec.exe) with the following command-line parameters: MSIEXEC /i "[path]\symantec Endpoint Encryption Management Server.msi" /lvx [logpath]\logfile where [path] is the actual path on the member server where the SEE Management Server installer package is located, and [logpath]\logfile is the path and name of the output log file that will be created. The Welcome page of the SEE Management Server InstallShield Wizard appears. Click Next. The License Agreement page appears. Select the option I accept the terms in the license agreement, then click Next. The Database Creation page appears. Figure 2.1 Database Server This page allows you to specify the database instance on which to create the SEE database. Click Browse to select from a list of available instances, or type the Windows computer name of the instance. A database server is recommended, but you can also install the SEE database instance locally on the SEE Management Server, if a supported version of Microsoft SQL Server has been installed. Choose the account you will use to connect to the database instance, either the currently logged on Windows user, or a SQL Server account. If you choose to connect using an SQL Server account, you must specify the account Symantec Endpoint Encryption Full Disk 12

21 SEE Management Server credentials. Click Next. The installer will attempt to authenticate to the instance, and the Database Configuration page will appear. Figure 2.2 Database Configuration This page allows you to create a new database or use an existing one. If you are reinstalling the SEE Management Server and want to use an existing SEE database, choose Use existing database, type the credentials of an existing SQL account, click Next, and skip to the IIS Client Account InstallShield Wizard page on page 17. If you are installing SEE Management Server for the first time, use the default choice, Create a new database. This allows you to specify a limited privilege database user account that is created on the database server and used for secure communication between the SEE Management Server and the SEE database instance. Type the user name, password, and password confirmation of the new account, then click Next. The Directory Service Synchronization page will appear. Figure 2.3 Directory Synchronization, Active Directory Selected This page allows you to select the directory services from which the SEE database instance will be populated. The SEE Management Server ensures that the SEE database instance remains up to date with information from these Symantec Endpoint Encryption Full Disk 13

22 SEE Management Server directory services. For example, when computer or container objects are added to or deleted from Active Directory and/or edirectory, directory service synchronization propagates those changes to the SEE database instance. This allows you to use the SEE Manager to view and apply SEE native policies to the computers in your organization according to the directory OUs or containers in which they reside. From this point forward, the successive pages of the SEE Management Server InstallShield Wizard will differ depending on whether you select Microsoft Active Directory, Novell edirectory, or both. If you select: Microsoft Active Directory, continue reading. Novell edirectory by itself, skip to Novell edirectory Synchronization Selected on page 15. Both boxes and click Next, skip to Both Active Directory & edirectory Synchronization Selected on page 16. If your deployment doesn t use directory services, or you don t want to enjoy the benefits of directory service synchronization, leaving both boxes unselected and clicking Next will take you to the IIS Client Account page on page 17. Note that directory service synchronization can be changed after installation using the SEE Configuration Manager Utility. See the Policy Administrator Guide for more details. Active Directory Synchronization If you selected Microsoft Active Directory by itself or in combination with Novell edirectory, and then clicked Next, the following InstallShield Wizard pages will appear. Figure 2.4 Active Directory Synchronization, Account Credentials The installer will prefill the Forest Name box with information about the forest the SEE Management Server resides in. Type the user name, password, and NetBIOS or DNS domain name of a user account that has administrative privileges in the same domain that the SEE Management Server has been joined to. The Active Directory synchronization service binds to Active Directory using this account, and requires administrative privileges for accessing deleted objects in Active Directory. If your corporate security policy prohibits using an account with administrative privileges, you can use a nonadministrative domain account that has been granted read permissions to the deleted objects container. See Extending Domain User Rights with DSACLS on page 80. Symantec Endpoint Encryption Full Disk 14