This article details the best practices to use prior to performing Symantec Drive Encryption 10.3.2 and above as well as Symantec Endpoint Encryption 11.1.3 and above.
The following best practices are recommended for preparing to encrypt your disk with Symantec Drive Encryption. Please follow the recommendations below to protect your data during and after encryption. Before you encrypt your disk, there are a few tasks you must perform to ensure successful initial encryption of the disk.
Security Best Practices
Security is always top priority for Symantec, and Symantec Encryption is a critical component that adds to the overall security of the enterprise. In addition to an aggressive patching strategy and a layered approach to network defense, Symantec recommends using security products, such as Symantec Endpoint Protection (SEP) to lower the attack surface of unprivileged malware in general within the enterprise. Additionally, Symantec recommends the following measures to reduce risk of attack:
• Restrict access to administrative or management systems to authorized privileged users.
• Restrict remote access to trusted/authorized systems only.
• Keep all operating systems and applications current with vendor patches.
• Deploy network-based and host-based intrusion detection systems to monitor network traffic for signs of anomalous or suspicious activity. This may aid in the detection of attacks or malicious activity related to the exploitation of latent vulnerabilities.
1. Determine whether your target disk is supported
Symantec Endpoint Encryption and Symantec Drive Encryption secures your desktop or laptop disks (either partitions, or the entire disk), external disks, and USB flash disks. CD-RW/DVD-RWs are not supported using Drive Encryption.
Supported Disk Types
- SSDs (Fully supported with all versions). As part of SSD performance technology, see article TECH180373 for tips to ensure best performance using TRIM.
- NVMe Drives (Supported starting in version 10.3.2 MP13)
- M2 Drives (Fully supported)
- Desktop or laptop disks, including solid-state drives (either partitions, or the entire disk).
- External disks, excluding music devices and digital cameras.
- USB flash disks.
- GPT partitions with UEFI for Windows 8: Refer to article TECH203071 for more details and requirements on UEFI support and Symantec Drive Encryption (Windows 7 UEFI is supported only with 64-bit and Symantec Drive Encryption 10.3.2 and above).
- The following formatted disks or partitions are supported: 04 (FAT16), 06 (FAT16B), 07 (NTFS), 0B (FAT32).
- Logical Partitions are not supported with Symantec Endpoint Encryption 11 (Etrack 4220167).
TIP: If a drive is being repurposed that has previously been used for testing, or previously had an operating system installed on it, and has been reformated, ensure all the partitions have been completely removed using a cleanup tool, such as DBAN or Diskpart. Remnant partitions left on drives, especially if the drive was previously encrypted can cause issues when being re-purposed for encryption.
Symantec Endpoint Encryption 11 supports Opal Drive management. For more information on Opal drives, see article TECH226779.
Symantec Drive Encryption 10 (PGP-Heritage Products) will support Opal drive as long as the self-encrypting hardware encryption is not used. Symantec Drive Encryption's native encryption can then be used to encrypt these drives.
Unsupported Disk Types
- Dynamic disks.
- SCSI/SAS drives/controllers.
NOTE: MSINFO32 reports will commonly misreport some drives, such as SSDs as SCSI. This can be ignored when reviewing these types of reports. Validating the drive is, in fact, SSD is enough and will not cause any issues with Drive Encryption.
- Software RAID disks.
- Diskettes and CD-RW/DVD-RWs.
- exFAT formatted disks.
- Any configuration where the system partition is not on the same disk as boot partition.
TIP: Some external hard drives are now coming with "exFAT" filesystems. This is for flexible OS compatibility between various operating systems, however, if trying to encrypt a hard drive with exFAT, Symantec Drive Encryption will fail. Reformat the drive using NTFS for Windows, or the native filesystem for the OS and this should allow encryption of the drive.
Warning on Basic-to-Dynamic Disk Conversion: Never perform a conversion from a Basic disk format to a Dynamic disk on the boot drive of a system that has already been protected using Symantec Endpoint Encryption or Symantec Drive Encryption. This conversion, from a basic-type disk to a dynamic one will render the drive unusable.
2. Confirm Operating System support
See the System requirements articles for full details:
TECH236572 - Symantec Encryption Desktop 10.4.1 for Windows - System Requirements
INFO3170 - Symantec Endpoint Encryption 11.1.x for Windows - System Requirements
Note: See the following article TECH203071 - Running Symantec Encryption Desktop on Microsoft Windows 8 UEFI Systems for more information on using Drive Encryption on Windows 8 systems.
3. Back up the disk before you encrypt it
Before you encrypt your disk, be sure to back up the data so that no data will be lost if your laptop or computer is lost, stolen, or you are unable to decrypt the disk. Also be sure to make regular backups of your disk.
4. Ensure the health of the disk before you encrypt it
If Symantec Drive Encryption or Symantec Endpoint Encryption encounters a hard drive or partition with bad sectors, the encryption process will pause. This pause allows you to remedy the problem before continuing with the encryption process, thus avoiding potential disk corruption and lost data.
In Symantec Encryption Management Server or Symantec Endpoint Encryption Management Server managed environments, if a hard drive or partition with bad sectors is encountered, an event is added in the server logs.
Before you attempt to use Symantec Drive Encryption products, use a third-party scan disk utility that has the ability to perform a low-level integrity check and repair any inconsistencies with the drive that could lead to CRC errors. Third-party software such as SpinRite or Norton Disk Doctor can correct errors that would disrupt the encryption of the disk.
Note: As a best practice, highly fragmented disks should be defragmented before you attempt to encrypt the disk.
5. Confirm keyboard support (Symantec Encryption Desktop 10)
Be sure that you are using a keyboard with one of the supported languages. For a list of the supported languages, see the following links for your operating system:
Important tip for Quick Boot in BIOS: For UEFI systems, disable Fastboot/Quckstart/Quickboot in the BIOS. Quick Boot does not allow all peripherals to be enabled during the boot process, and can sometimes prevent external keyboards from working, especially if USB 3.0 ports are being used. Especially when systems come provisioned with solid state drives, the fast startup does not offer a noticeable increase in speed during the boot process.
6. Create a recovery disk
While the chances are extremely low that a master boot record could become corrupt on a boot disk or partition protected by Symantec Drive Encryption or Symantec Endpoint Encryption, it is possible. Before you encrypt a boot disk or partition using Drive Encryption, create a recovery disk.
See the following articles for Recovery using WinPE:
For Symantec Drive Encryption 10.4 Recovery ISOs, see article TECH235059.
7. Be certain that you will have AC power for the duration of the encryption process
Because encryption is a CPU-intensive process, encryption cannot begin on a laptop computer that is running on battery power.
Do not remove the power cord from the system before the encryption process is over. If loss of power during encryption is a possibility or if you do not have an uninterruptible power supply for your computer consider choosing the Power Failure Safety option.
8. If encrypting a Laptop set the Power Management options to Performance/Always On
Almost all laptops are configured to use the Power Save or Balanced modes of Power Management. This can cause the CPU and Hard Disk to throttle back as well as hibernate to conserve energy. The problem with this is that it can either extend or interrupt the Whole Disk Encryption process making it progress much more slowly.
To ensure maximum speed for encryption we recommend changing the Power Management profile to be Performance or Always On for the duration of the encryption process.
Please consult your Laptop Manufacturers Documentation or the Help section of your Operating System for steps on modifying these settings.
9. Run a pilot test to ensure software compatibility
As a good security practice, it is recommended to test Symantec Drive Encryption on a small group of computers to ensure that are not any conflicts with any software on the computer before rolling it out to a large number of computers. This is particularly useful in environments that use a standardized Corporate Operating Environment (COE) image.
The following software is not compatible with Symantec Drive Encryption:
- Faronics Deep Freeze (any edition)
- Utimaco Safeguard Easy 3.x
- Absolute Software's CompuTrace laptop security and tracking product. Drive Encryption is compatible only with the BIOS configuration of CompuTrace. Using CompuTrace in MBR mode is not compatible.
- Caution: Any other Drive Encryption software should be completely removed prior to installing Symantec Drive Encryption or Symantec Endpoint Encryption. Having two drive encryption solutions may render a machine unusable and unrecoverable, and is unsupported.
10. Perform Disk Recovery on Decrypted Disks
Where possible, as a best practice, if you need to perform any disk recovery activities on a disk protected with Drive Encryption, it is recommended that you first decrypt the disk. Once the disk is decrypted, proceed with your recovery activities.
11. Windows Upgrades for Windows 10
In order to perform an in-place upgrade, please consult the following articles to successfully upgrade:
HOWTO125875 - Upgrading Encrypted Computers to the Windows 10 Creators Update from Earlier Versions of Windows with Symantec Endpoint Encryption 11.1.2 and later
HOWTO125876 - Upgrading Encrypted Computers to the Windows 10 Creators Update from Earlier Versions of Windows with Symantec Encryption Desktop 10.4.1 MP1 and later
12. Best Practice for performance on Solid State Drives
The following information will help if performance degradation is observed after encrypting a Solid State Drive
TECH180373 - SSD Performance issues with certain drives using Symantec Endpoint Encryption 11 or Symantec Encryption Desktop 10
13. Best Practices for Installing or Upgrading Symantec Endpoint Encryption 11:
It is always recommended to install Endpoint Encryption with verbose MSI options enabled as this information is useful in diagnosing many scenarios in troubleshooting. To install Endpoint Encryption, run the following command with proper administrative permissions from the command line:
msiexec /i "SEE installation.MSI" /l*vx c:\path-of-log-file.txt
For instances where troubleshooting will require SEE client debugging, the following command will install the Endpoint Encryption client and automatically enable debug logging in the client. This is not always necessary, but is useful when it is required to also capture the SEE client debug logs:
msiexec /i "SEE installation.MSI" /l*vx c:\path-of-log-file.txt MALOGLEVEL=DEBUG
It is also recommended that systems be rebooted just prior to the install/upgrade of Symantec Endpoint Encryption 11 to ensure the best success as pending reboots can cause the install/upgrade process to fail. Starting in Symantec Endpoint Encryption 11.2, an additional MSIEXEC parameter can be added to the install string, which will halt the install if a system is pending a reboot. To add this check, add the following to the MSIEXEC command:
Adding the above will halt the install if a system must first be rebooted due to a previous installation such as a Windows update, or other third-party install that requires a reboot. It is always best to reboot a system to clear out this pending state for best success during an upgrade.
PRE_INSTALL_REBOOT_CHECK=YES Option is for SEE 11 only. This option does not work for Symantec Encryption Desktop 10.
14. Best Practices for Installing or Upgrading Symantec Encryption Desktop 10
As mentioned in bullet 13, rebooting the system after Symantec Drive Encryption 10 is highly recommended. Although some deployments may opt to not immediately reboot, it is very much advised to reboot the system very soon after Symantec Drive Encryption has been installed or upgraded on a system.
Failing to reboot can cause some unexpected behavior, such as when Symantec Encryption Desktop 10 has been installed, and then postponed, and later, another update, such as Windows is installed. Other scenarios exist which may put the install/upgrade at risk. For best success, it is recommended to reboot after install/upgrade.
15. Slaving Drives for Drive Recovery
Symantec Endpoint Encryption 11.x and Symantec Drive Encryption 10.x operate differently when it comes to slaving drives.
Symantec Drive Encryption (SED - PGP-Heritage products) is able to accept encrypted boot drives on other systems with Symantec Drive Encryption installed as "slaved" and be able to authenticate the drive. As an example, a boot drive encrypted with SED could be removed from the machine, and slaved to another machine with SED installed, and can be prompted to enter the passphrase. The reason this works is Symantec Encryption Desktop is also able to encrypt external USB drives with its Drive Encryption component, and has actual code logic to detect these conditions. Slaving encrypted boot drives as an external USB drive is fully supported, and is a nice way to copy data from a drive that may not be otherwise booting.
Symantec Endpoint Encryption (SEE) operates differently, and does not support encrypting external USB drives with the Drive Encryption piece. Because this is not part of the code logic design, a drive that was encrypted with Symantec Endpoint Encryption and slaved to another machine with Symantec Endpoint Encryption Drive Encryption will not prompt for authentication. Using the eedadmincli.exe utility to authenticate the drive has been known to work successfully, however, is not officially supported at this time.
Imported Document Id