Getting Started with Symantec Endpoint Encryption for Bitlocker
Total Page:16
File Type:pdf, Size:1020Kb
Getting Started with Symantec Endpoint Encryption for BitLocker Version 11.3.0 Getting Started with Symantec Endpoint Encryption for BitLocker Legal Notice Copyright © 2019 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo and are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party (“Third Party Programs”). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Software does not alter any rights or obligations you may have under those open source or free software licenses. Please see the Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec product for more information on the Third Party Programs. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 "Commercial Computer Software - Restricted Rights" and DFARS 227.7202, et seq. "Commercial Computer Software and Commercial Computer Software Documentation," as applicable, and any successor regulations, whether delivered by Symantec as on premises or hosted services. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement. Symantec Corporation 350 Ellis Street Mountain View, CA 94043 https://www.symantec.com Document version: 11.3.0 Document release date: June 2019 Contents Getting Started .................................................................................................... 5 About updates to Getting Started with Symantec Endpoint Encryption for BitLocker Guide ................................................................... 5 Using this guide ............................................................................. 5 About Symantec Endpoint Encryption for BitLocker ............................... 6 About authentication ................................................................. 6 Configuring a PIN for Symantec Endpoint Encryption for BitLocker ......................................................................... 7 Configuring a password for Symantec Endpoint Encryption for BitLocker ......................................................................... 8 About encrypting or decrypting your computer volumes ................... 9 How TPM affects encryption and authentication ........................... 10 About decryption on a pre-encrypted BitLocker system .................. 10 About authenticating to a pre-encrypted BitLocker system .............. 11 Viewing the encryption status of the BitLocker client volumes ......................................................................... 14 Ensuring regular communication with the server for the encrypted BitLocker clients .............................................................. 15 About loss of access to a volume encrypted for BitLocker client ............................................................................. 18 Accessing your system using a BitLocker Recovery Key ................ 17 About loss of access to a volume encrypted for BitLocker client ............................................................................. 18 Getting Started About updates to Getting Started with Symantec Endpoint Encryption for BitLocker Guide This guide is updated as new information becomes available. The following table provides the history of updates to this version of this guide: Table 1 Change history for this guide Date Description 27 January, 2020 Beginning with the Symantec Endpoint Encryption 11.3.0 MP1 release, updated this guide to remove references for Windows 7 support. Using this guide This guide is for anyone who uses the Symantec Endpoint Encryption for BitLocker software to protect their data. The guide provides information on configuring a PIN or password for authentication. It covers the following two deployment scenarios of Symantec Endpoint Encryption for BitLocker: ■ Systems that are encrypted after Symantec Endpoint Encryption for BitLocker is installed. See “About Symantec Endpoint Encryption for BitLocker” on page 6. ■ Systems that are pre-encrypted with Microsoft BitLocker, after which Symantec Endpoint Encryption for BitLocker is installed. See “About decryption on a pre-encrypted BitLocker system” on page 10. Getting Started 6 About Symantec Endpoint Encryption for BitLocker About Symantec Endpoint Encryption for BitLocker BitLocker is the Microsoft native encryption solution to encrypt a client computer. Symantec Endpoint Encryption for BitLocker enables your administrator to manage the volumes that are encrypted with Microsoft BitLocker. Symantec Endpoint Encryption for BitLocker also allows you to regain access to encrypted volumes using Help Desk Recovery. With Symantec Endpoint Encryption for BitLocker: ■ You can encrypt or decrypt the boot volume as well as the data volumes on your client computers. ■ Your computer reports status information to the Symantec Endpoint Encryption Management Server. ■ Your computer generates a BitLocker Recovery Key and sends this key to the server. You can retrieve and use this key to access your data in case you forget your PIN or password and get locked out. Symantec Endpoint Encryption for BitLocker provides prompts, so that you know when to configure a PIN or a password. Your PIN or password serves as your logon credential. And only after you configure the PIN or password, encryption starts on the computer. Symantec Endpoint Encryption for BitLocker enables your administrator to manage the BitLocker client computers by: ■ Creating and deploying the BitLocker management software. ■ Providing the encryption and the authentication policy options. ■ Locking the client computer when a predefined time has passed and the client has not checked in with Symantec Endpoint Encryption Management Server through the client monitor feature. ■ Generating the reports that identify which computers are running BitLocker and the encryption status of the computer volumes. ■ Providing a help desk capability, if you should need to use your BitLocker Recovery Key to gain computer access. About authentication If your computer is not yet encrypted by BitLocker, your administrator applies a policy to your computer to begin encryption. Preceding encryption, you are required to configure authentication credentials. You use these credentials to authenticate to the BitLocker preboot authentication screen that appears once your system is encrypted. Your administrator can choose one of the following authentication methods: ■ TPM Getting Started 7 About Symantec Endpoint Encryption for BitLocker If the method is a Trusted Platform Module (TPM), a chip that is embedded in your computer helps prevent unauthorized access to your system and ensure a safe computing environment. The TPM provides the authentication, no user intervention, or credentials are not required. ■ TPM and PIN If the method is a PIN, you may be prompted to configure a PIN to begin encryption. Thereafter, you use the PIN to authenticate to the BitLocker preboot screen every time you start your computer. ■ A password If the method is to use a password when TPM is unavailable, you may be prompted to configure a password to begin encryption. Thereafter, you use the password to authenticate to the BitLocker preboot screen every time you start your computer. If your computer is already encrypted by BitLocker, you may already have a password or PIN that you use for authentication. You do not need to know which policy your administrator has applied to your computer. The prompts lead you through the process to configure credentials for whichever method has been chosen for you. See “Configuring a PIN for Symantec Endpoint Encryption for BitLocker” on page 7. See “Configuring a password for Symantec Endpoint Encryption for BitLocker” on page 8. Configuring a PIN for Symantec Endpoint Encryption for BitLocker If your administrator configured your preboot authentication method to be a PIN, you see a PIN configuration dialog box after Symantec Endpoint Encryption for BitLocker is installed and the BitLocker Recovery Key is sent to the server. The PIN length must be 6 - 20 digits. For improved protection, Symantec recommends that you configure your BitLocker PIN the first time the dialog