Dell Data Protection | Encryption Enterprise Edition Administrator GuideDDP|E Encryption Client, SED, Advanced Authentication, BitLocker Manager, and

10 Enterprise Edition Administrator GuidePre-existing Folders with Unencrypted Files. . . . . . . . . . . . . . . . . . . . . . . . . 171Access a C

100 Enterprise Edition Administrator GuideUninstall SED Client• The uninstallation is performed using the EMAgent_XXbit_setup.exe, DP_XXbit_setup.exe,

Enterprise Edition Administrator Guide 101Example Command Line UninstallationNOTE: Be sure to enclose a value that contains one or more special charac

102 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 103SED and OS RecoverySelf-Recovery, OS LogonThis workflow enables an end user to log on with provisioned recov

104 Enterprise Edition Administrator Guide2Clicking the link displays the questions selected by the end user during their initial setup in the Securit

Enterprise Edition Administrator Guide 105The end user selects one option and clicks Next.NOTE: If none of the options are selected within the Windows

106 Enterprise Edition Administrator GuideSelf-Recovery, PBAThis workflow enables end users to log on with provisioned recovery questions.Once the end

Enterprise Edition Administrator Guide 1073The end user enters the correct answers to the recovery questions and clicks Finish.

108 Enterprise Edition Administrator GuideAssisted Recovery, PBA• Assisted recovery will be needed if you cannot gain access to the computer using any

Enterprise Edition Administrator Guide 109How to Turn Off Manager SSL Trust ValidationWhen using SED or BitLocker Manager and you want to turn off Man

Enterprise Edition Administrator Guide 11IntroductionThis guide details how to install and configure the DDP|E encryption client, SED management clien

110 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 111How to Use the Initial Access Code PolicyThis policy is used to log on to a computer when network access is

112 Enterprise Edition Administrator GuideHow to Create a PBA Log File for TroubleshootingThere may be cases when a PBA log file is needed for trouble

Enterprise Edition Administrator Guide 113Section V. User Experience - Credential Management and Authentication Applications

114 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 115Configure Credentials in the Security Console• The Security Console is the centralized user interface for al

116 Enterprise Edition Administrator GuideThe end user enters their Windows password to verify their identity and clicks Next.5Recovery QuestionsA que

Enterprise Edition Administrator Guide 1176Choose CredentialsOn the Choose Credentials page, the end user can select which additional credentials to e

118 Enterprise Edition Administrator GuideThe end user clicks the desired finger to enroll and clicks Save. The end user may also click Skip fingerpri

Enterprise Edition Administrator Guide 119To delete an enrolled fingerprint, click the highlighted fingerprint. A confirmation dialog displays, which

12 Enterprise Edition Administrator Guide3Deploy the appropriate client (or clients) to end users.4Learn how to monitor your Enterprise and issue comm

120 Enterprise Edition Administrator GuidebCard EnrollmentTo set up a built-in contactless card, place the card very close to the reader. Once the con

Enterprise Edition Administrator Guide 1218The Encryption tab displays the protection status of the computer. Once provisioned (encrypted), the status

122 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 123Use the Authentication ApplicationsThe Security Console provides access to three applications through the ti

124 Enterprise Edition Administrator GuideCredentialsThe Credentials application provides a way to enroll end user credentials. By default, end users

Enterprise Edition Administrator Guide 125Windows PasswordThe Windows Password page allows end users to easily change their Windows password from with

126 Enterprise Edition Administrator GuideBackup and RestoreThe Backup and Restore Wizard helps end users securely back up passwords managed by Passwo

Enterprise Edition Administrator Guide 127Back up Data1Click Back up data to launch the Backup and Restore Wizard.The first page of the wizard allows

128 Enterprise Edition Administrator Guide5On the third page of the wizard, the end user must enter and confirm a password to protect the data in the

Enterprise Edition Administrator Guide 129Restore Data1Click Restore data to launch the Backup and Restore Wizard and to restore the data that was pre

Enterprise Edition Administrator Guide 13RequirementsEncryption Client• The user account performing the installation must be a local or domain Admin u

130 Enterprise Edition Administrator GuideThe end user clicks Finish to close the dialog.

Enterprise Edition Administrator Guide 131Password ManagerPassword Manager allows an end user to automatically fill in and submit data required to log

132 Enterprise Edition Administrator Guide• After performing one of the above-listed actions, the Add Logon to Password Manager dialog displays.Add Lo

Enterprise Edition Administrator Guide 133NOTE: If there are several editable fields on the logon screen, the software may not choose the desired edit

134 Enterprise Edition Administrator Guide• For logon to applications, Submit changes. A drop-down list of available options displays.• When saving th

Enterprise Edition Administrator Guide 135Web Domain Support• If an end user has trained a logon screen for a specific web domain but then wants to ac

136 Enterprise Edition Administrator Guide• The end user must authenticate according to the Session Logon authentication policy in force, which is con

Enterprise Edition Administrator Guide 137For the password, the end user can use their Windows password.All options above are hard-coded and cannot be

138 Enterprise Edition Administrator GuidePassword Change• Password Manager provides a change password functionality that helps the end user create st

Enterprise Edition Administrator Guide 139Password Manager Page•The Password Manager page allows an end user to launch their trained logons and to add

14 Enterprise Edition Administrator GuideHardware RequirementsThe following table details supported hardware.Windows Hardware• Intel Pentium-class or

140 Enterprise Edition Administrator Guide• Logons are grouped by domain. If an end user has multiple logons for the same web domain, the logons will

Enterprise Edition Administrator Guide 141• If the end user clicks the Add category, the Add Category dialog displays.Settings Page •On the Settings p

142 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 143Section VI. BitLocker Manager

144 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 145BitLocker Manager Installation Tasks• You can install BitLocker Manager by itself by extracting the child in

146 Enterprise Edition Administrator GuideParametersThe following table details the parameters available for the installation.Log File Parameters/l*v

Enterprise Edition Administrator Guide 147BitLocker Manager Uninstallation TasksThese instructions detail the process of uninstalling BitLocker Manage

148 Enterprise Edition Administrator GuideOptionsThe following table details the display options that can be specified at the end of the argument pass

Enterprise Edition Administrator Guide 149BitLocker Manager RecoveryTo recover data, you obtain a recovery password or key package from the Remote Man

Enterprise Edition Administrator Guide 15Operating SystemsThe following table details supported operating systems.NOTE:The Encryption client does not

150 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 151How to Turn Off Manager SSL Trust ValidationWhen using SED or BitLocker Manager and you want to turn off Man

152 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 153Section VII. Cloud Edition

154 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 155Cloud Edition Installation TasksBefore you begin installing Cloud Edition, you must first complete a few tas

156 Enterprise Edition Administrator GuideSet Up the Server for Automatic Downloads of the Windows Cloud Client (Optional)1On the server hosting your

Enterprise Edition Administrator Guide 157WhitelistThe whitelist allows specific users or groups of users to register with the DDP Server and to use C

158 Enterprise Edition Administrator GuideUse Dropbox for BusinessCloud Edition with Dropbox for Business offers additional functionality:• Remote Wip

Enterprise Edition Administrator Guide 159Remote Wipe a Team Member AccountIf your enterprise has Dropbox for Business, you can remotely remove a team

16 Enterprise Edition Administrator GuideOperating Systems for External Media Edition (EME)The following table details the operating systems supported

160 Enterprise Edition Administrator GuideRun ReportsReports about your Cloud Edition environment are available through Dell Compliance Reporter, a co

Enterprise Edition Administrator Guide 161Client TasksYou can install the Cloud Edition client by itself by extracting the child installer out of the

162 Enterprise Edition Administrator GuideOptionsThe following table details the display options that can be specified at the end of the argument pass

Enterprise Edition Administrator Guide 163Cloud Edition Uninstallation TasksIf an end user has a local Administrator account, they can uninstall Cloud

164 Enterprise Edition Administrator GuideBox1In the system tray, right-click the Box icon and select Open Box web site 2In the Box web site, right-cl

Enterprise Edition Administrator Guide 165Example Command Line Uninstallation• The uninstallation is performed using the Cloud_XXbit_setup.exe file lo

166 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 167Section VIII.User Experience - Cloud Edition

168 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 169Cloud Edition Activation and User ExperienceActivate Cloud EditionAfter Dell Data Protection | Cloud Edition

Enterprise Edition Administrator Guide 17Language SupportThe Encryption client is Multilingual User Interface (MUI) compliant and supports the followi

170 Enterprise Edition Administrator GuideAuthenticate Dropbox for BusinessIf you install Dropbox for Business, Cloud Edition prompts for authenticati

Enterprise Edition Administrator Guide 171BoxTo sync folders:1In the system tray, right-click the Box icon and select Open Box web site.2In the cloud,

172 Enterprise Edition Administrator GuideAccess a Cloud Storage ProviderDropboxIn the system tray, click the Dropbox icon and select Dropbox.com.NOTE

Enterprise Edition Administrator Guide 173Dropbox for BusinessDropbox for Business has specific requirements. See Cloud Sync Clients.Connect Cloud Edi

174 Enterprise Edition Administrator GuideUnderstand the Cloud Edition System Tray Menu ItemsDetails ScreenYou can use the Details screen for troubles

Enterprise Edition Administrator Guide 175Audit: Lists modules, user ID, and event type. Information is in queue in this audit log and then sent to th

176 Enterprise Edition Administrator GuideUsing Cloud Edition with iOS or AndroidThis section describes basic information on installing Cloud Edition

Enterprise Edition Administrator Guide 177Share Files With External UsersAn external user is one with a non-domain email address. If an internal user

178 Enterprise Edition Administrator GuideCloud Edition Frequently Asked Questions (FAQs)Administrator FAQsQuestionI changed the Obfuscate Filenames c

Enterprise Edition Administrator Guide 179Folder Management FAQsNOTE: To use the Manage Folders option, you may need to request permission from your A

18 Enterprise Edition Administrator GuideClient PrerequisitesThe installer installs these components if not already installed on the computer.Prerequi

180 Enterprise Edition Administrator GuideSolutionTo remove the old sync client option from the Manage Folders utility, delete the folder that houses

Enterprise Edition Administrator Guide 181Miscellaneous FAQsQuestionI moved the cloud provider’s sync folder to Program Files, and now I cannot decryp

182 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 183AChange Secure Boot/UEFI to Legacy Boot Mode in BIOSThe features available as of v8.3 with HCA are supported

184 Enterprise Edition Administrator Guide5In Settings > Secure Boot > Secure Boot Enable, ensure that the Secure Boot Enable selection is Disab

Enterprise Edition Administrator Guide 185GlossaryActivate(d) - Activation occurs when the computer has been registered with the Server and has receiv

186 Enterprise Edition Administrator GuideSystem Data Encryption (SDE) – SDE policies encrypt the System Drive, the Fixed Drives, or both - depending

0 XXXXXA0 X

Enterprise Edition Administrator Guide 19Operating SystemsThe following table details the supported operating system.Windows Operating Systems (32- an

© 2014 Dell Inc. Registered trademarks and trademarks used in the DDP|E, DDP|ST, and DDP|CE suite of documents: Dell™ and the Dell logo, Dell Precisio

20 Enterprise Edition Administrator GuideOperating SystemsThe following table details supported operating systems.Windows Operating Systems (32- and 6

Enterprise Edition Administrator Guide 21BitLocker Manager Client• If Windows BitLocker is not yet deployed in your environment, consider reviewing Bi

22 Enterprise Edition Administrator GuideLanguage SupportBitLocker Manager is Multilingual User Interface (MUI) compliant and supports the following l

Enterprise Edition Administrator Guide 23Cloud Sync ClientsThe following table details the latest tested sync clients. Sync clients release updates fa

24 Enterprise Edition Administrator GuideOperating SystemsThe following table details supported operating systems. Windows Operating Systems (32-bit a

Enterprise Edition Administrator Guide 25InteroperabilityDeprovision and Uninstall Dell Data Protection | AccessIf DDP|A is installed now or has been

26 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 27Pre-Installation Configuration to Enable DDP|HCAIf the computer targeted for encryption is equipped with a De

28 Enterprise Edition Administrator GuideeSelect Get drivers and downloads in the left menu.fClick View All Drivers.gScroll down to Refine your result

Enterprise Edition Administrator Guide 29DDP|HCA Pre-Installation BIOS ConfigurationIf the following hardware and BIOS instructions are not completed,

Enterprise Edition Administrator Guide 3ContentsIntroduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

30 Enterprise Edition Administrator GuideReset System Password If the computer is equipped with legacy HCA, and you forget your System password, log i

Enterprise Edition Administrator Guide 31Pre-Installation Configuration to Set Up a BitLocker PBA Partition• You must create the PBA partition before

32 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 33Set GPO on Domain Controller to Enable Entitlements• If your clients will be entitled from the factory or you

34 Enterprise Edition Administrator Guide5The Group Policy Management Editor loads. Access Computer Configuration > Preferences > Windows Settin

Enterprise Edition Administrator Guide 357Click OK.8Log out and then back into the workstation, or run gpupdate /force to apply the group policy.

36 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 37Extract the Child Installers from the Master InstallerTo install each client individually, first extract the

38 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 39Commonly Used Scenarios• To install each client individually, the child executable files must first be extrac

4 Enterprise Edition Administrator GuideExtract the Child Installers from the Master Installer . . . . . . . . . . . . . . . 37Commonly Used Scenar

40 Enterprise Edition Administrator GuideDDP|E Client and Advanced AuthenticationSee Configure Credentials in the Security Console and Use the Authent

Enterprise Edition Administrator Guide 41Then:DDP|E Encryption Client - C:\extracted\Encryption • The following example installs the client with defau

42 Enterprise Edition Administrator GuideThen:Advanced Authentication Client - C:\extracted\Security Tools\Authentication • The following example inst

Enterprise Edition Administrator Guide 43Drivers - C:\extracted\Drivers • The following example installs the drivers at the specified location, does n

44 Enterprise Edition Administrator GuideCloud Client - C:\extracted\Cloud • The following example installs Cloud Edition (silent installation, no reb

Enterprise Edition Administrator Guide 45BitLocker Manager and External Media EditionBitLocker Manager Client - C:\extracted\Security Tools • The foll

46 Enterprise Edition Administrator GuideIf your DDP Server is pre-v7.7:DDPE_XXbit_setup.exe /s /v"EME=1 SERVERHOSTNAME=server.organization.com

Enterprise Edition Administrator Guide 47EMAgent_XXbit_setup.exe /S /v"CM_EDITION=1 SERVERHOST=server.organization.com SERVERPORT=8888 SECURITYSE

48 Enterprise Edition Administrator GuideDDP|E Client and Advanced Authentication for Computers with HCANOTE: Drivers are needed for Advanced Authenti

Enterprise Edition Administrator Guide 49Then:DDP|E Encryption Client - C:\extracted\Encryption • The following example installs the client with defau

Enterprise Edition Administrator Guide 5Section II. Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

50 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 51Section I. Dell Data Protection Installer (Master Installer)

52 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 53Dell Data Protection Master Installer• The Dell Data Protection Master Installer is commonly known as the Mas

54 Enterprise Edition Administrator GuideInstall DDP|E Interactively•Use these instructions to install DDP|Enterprise Edition interactively. This meth

Enterprise Edition Administrator Guide 556Click Next.7 In the Dell Enterprise Server Name field, enter the fully qualified host name of the DDP Server

56 Enterprise Edition Administrator Guide8Click Next.9Click Next to install the products in the default location of C:\Program Files\Dell\Dell Data Pr

Enterprise Edition Administrator Guide 5711Click Next.12Click Install to begin the installation.

58 Enterprise Edition Administrator GuideA status window displays. This may take several minutes.13Select Yes, I want to restart my computer now and c

Enterprise Edition Administrator Guide 59Install DDP|E Using the Command Line• Command line options are case-sensitive. SwitchesThe following table de

6 Enterprise Edition Administrator GuideTroubleshooting HCA Recovery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83Check the Rec

60 Enterprise Edition Administrator GuideUninstallation ProcessTo uninstall, each product must be uninstalled separately, in a specific order. 1Extrac

Enterprise Edition Administrator Guide 61Section II. Drivers

62 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 63Drivers Installation Tasks• Drivers are needed for Advanced Authentication if installing on Dell hardware. Th

64 Enterprise Edition Administrator GuideOptionsThe following table details the display options that can be specified at the end of the argument passe

Enterprise Edition Administrator Guide 65Section III. DDP|E Encryption Client

66 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 67Encryption Client Installation Tasks• You can install the Encryption client by itself by extracting the child

68 Enterprise Edition Administrator GuideCommand Line InstallationFor a command line installation, the switches must be specified first. The /v switch

Enterprise Edition Administrator Guide 69Example Command Line Installation• The installation is performed using the DDPE_XXbit_setup.exe file located

Enterprise Edition Administrator Guide 7Uninstall SED Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100Comma

70 Enterprise Edition Administrator Guide•The following example installs EME only (silent installation, no reboot, with logs at the specified location

Enterprise Edition Administrator Guide 712In the Setup window, specify the network location where you want to store the extracted files, and click Ins

72 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 73Encryption Client Uninstallation and Decryption TasksWhen using System Data Encryption (SDE), User, or Common

74 Enterprise Edition Administrator Guide• Optionally create an Encryption Removal Agent log file to aid in troubleshooting. See How to Create an Encr

Enterprise Edition Administrator Guide 75ParametersThe following table details the parameters available for the uninstallation.Parameter SelectionCMG_

76 Enterprise Edition Administrator GuideExample Command Line Uninstallation• The uninstallation is performed using the DDPE_XXbit_setup.exe file loca

Enterprise Edition Administrator Guide 77How to Create an Encryption Removal Agent Log File (Optional)Before beginning the uninstall process, you can

78 Enterprise Edition Administrator GuideAll files could not be decrypted – The decryption sweep is complete, but all files could not be decrypted. Th

Enterprise Edition Administrator Guide 79Encryption Client Data RecoverySituations such as operating system failure or hardware failure may cause encr

8 Enterprise Edition Administrator GuideLogging on to Trained Logon Screens. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135Filling in

80 Enterprise Edition Administrator GuideRecover Data using Current ComputerThese instructions restore access to encrypted files by forcing DDP|E to r

Enterprise Edition Administrator Guide 81Prepare the Environment (or Slaved Drive)SDE Environment PrerequisiteThe computer must be booted into the app

82 Enterprise Edition Administrator Guide5Cancel the recovery dialog box.Now you can use the LSARecovery file to run the recovery from a command line.

Enterprise Edition Administrator Guide 83When the computer restarts, it downloads the updated HCA Critical Data to complete the recovery. It will atte

84 Enterprise Edition Administrator GuideRecover User Access to a Computer Equipped with HCASelf-RecoveryThis workflow enables end users to log on wit

Enterprise Edition Administrator Guide 853The end user enters the correct answers to the recovery questions and clicks Finish.

86 Enterprise Edition Administrator GuideRecover Access using Challenge/Response Codes 1As a Dell Administrator, open the Remote Management Console.2I

Enterprise Edition Administrator Guide 87Configure Dell Key ServerThis section explains how to configure components for use with Kerberos Authenticati

88 Enterprise Edition Administrator Guide4Go to <add key="epw" value="<encrypted value of the password>" /> and change

Enterprise Edition Administrator Guide 89Remote Management Console Instructions1If needed, log on to the Remote Management Console.2Click Domains and

Enterprise Edition Administrator Guide 9Use Dropbox for Business . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158Run Repo

90 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 91Use WSScanWhen uninstalling the Encryption client, follow your existing process for decrypting data, such as

92 Enterprise Edition Administrator GuideWSScan OutputWSScan information about encrypted files contains the following information.Example Output:[2010

Enterprise Edition Administrator Guide 93Section IV. SED Management and Advanced Authentication

94 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 95SED Management and Advanced Authentication Installation Tasks• You can install the SED management client and

96 Enterprise Edition Administrator GuideCommand Line InstallationFor a command line installation, the switches must be specified first. The /v switch

Enterprise Edition Administrator Guide 97Example Command Line Installation• Special drivers are needed for Advanced Authentication if installing on De

98 Enterprise Edition Administrator Guide

Enterprise Edition Administrator Guide 99SED and Advanced Authentication Deactivation and Uninstallation TasksThese instructions detail the process of