symantec encryption desktop cancel encryption

Scenario 10: Enable Invisible Silent Enrollment.Scenario 8: Disable All components except for Drive Encryption (Leave Drive Encryption enabled).Scenario 7: Disable all components except for Email Encryption.Scenario 6: Disable all components except for File Share Encryption.Scenario 5: Disable All Email Encryption.Scenario 4: Disable File Share Encryption.Scenario 3: Disable Drive Encryption including SSO functionality, Virtual Disk and POP/IMAP Email Encryption.Scenario 2: Disable only the Virtual Disk Component.Scenario 1: Disable only the Drive Encryption and single sign-on components.To uninstall, you will first need to decrypt the drives which is really not a good use of time. This is obviously a time consuming task and if the clients are already on the latest release you will need to completely uninstall Encryption Desktop and install it again. If you disable a component using an msiexec switch, the only way of enabling it is to upgrade every client machine to a newer release and enable the component using the same msiexec switch. You will never use File Share Encryption and wish to ensure the file sharing driver is not installed.You will never need to integrate mail encryption with SMTP, POP3 or IMAP.Only drive encryption uses single sign on so it is logical to disable single sign on too.

You will never use drive encryption and wish to ensure that the encryption driver is not installed.There are reasons, however, why you should consider using msiexec switches to disable functionality for managed Encryption Desktop clients: You can enable or disable nearly all functionality by modifying the relevant consumer policy. Since the product is designed to encrypt per user, a user must be created before encryption can begin.The only way you can disable licensed functionality in an unmanaged Encryption Desktop client is to install it or upgrade it using appropriate msiexec switches.Įncryption Desktop clients that are managed by Encryption Management Server will be members of a particular consumer policy. The product was designed to be implemented with the desired end user, not encrypted before distribution.

It definitely is not the most elegant solution, but I think it will accomplish what you are after. They should then be able to use Single Sign On without getting any prompts, etc. When they log into Windows, it should detect that they are in the first group, and force them to be added to the drive as a user for authentication. When it is given to an end user, it should start up once without asking for a Bootguard authentication. After encryption completes, add a single use bypass per This should also add any WDE Administrator user as set in the policy.Ħ. Encrypt the drive to a passphrase only user. After the initial reboot after installation, log onto the system with a member of the second group (Allow SSO, has encryption permissions).ĥ. Install following the directions for invisible silent enrollment from Ĥ. Download a package that is set to auto-detect policy.ģ. The second group should have permissions to encrypt the drive.Ģ. One should force users to use single sign on for authentication, and the other should Allow, but not force it. Create two groups using AD Sync, and two policies on the server. There is no official method for deploying pre-encrypted systems from Symantec, but if you are using a management server, and don't require preboot authentication until a system is delivered to an end user, I would do the following:ġ. Is there a requirement that the laptops be encrypted and protected by preboot authentication during the 'storage' period? It may be possible to create a passphrase-only user to encrypt the drive to, then create a single-use Bootguard Authenticated Bypass user per the instructions here: It is based on Active Directory Sync through the encryption management server and your AD structure for authentication. There is more information that we also need to know to assist you with this:Īre the clients standalone, or managed by a Symantec Encryption Management Server? If it is not a managed environment, silent enrollment will not work.

Symantec encryption desktop cancel encryption