This article lists the Opal drives that are compatible with Symantec Endpoint Encryption Drive Encryption 11

• Opal v2-compliant drives
• Microsoft eDrive support – Opal v2-compliant drives

Note: All systems must be running Windows 8 or greater and boot in UEFI mode.

Update History

Manually adding Opal drives certified as compatible between releases of Symantec Endpoint Encryption Drive Encryption

Drive Encryption software uses registry entries to identify which drives are whitelisted. When Symantec releases a new version of Endpoint Encryption, Symantec updates the whitelist and populates the registry entries as part of the release. If Symantec tests and approves Opal drives between releases, Symantec updates the whitelist in this KB, but you must populate the new registry entries. You only need to do this if you are interested in using one or more of those drives. 

To learn how to create the registry entries that identify an Opal drive as whitelisted, see the following article:

163518 - How to add computers and drives to the Opal whitelist

Symantec Endpoint Encryption 11.2, 11.3, and 11.4.

SEE Native Drive Encryption is the preferred method of Drive Encryption over Opal.  Although the SEE Client can manage Opal for Drive Encryption, Opal comes with some limitations:

*Opal drives must be decrypted prior to installing any Windows Feature Updates.
*NVMe Opal are not supported (Contact Symantec Encryption Support to be added to this functionality).
*Opal Recovery Keys must be sent to the server.
*No SEE Client Administrators can be used to manage these drives.
*No connectionless recovery.

When using SEE Native Drive Encryption, the type of drives are agnostic, but most importantly, have SEE Client Administrators for granular access control.

SEE Native Drive Encryption also includes connectionless recovery which means the SEE Client never needs to talk to the server for recovery to occur.

SEE Native Drive Encryption includes the ability to upgrade Windows Feature Updates without the need to decrypt drives. 

For any further guidance if you should choose SEE Native Drive Encryption over Opal, reach out to Symantec Encryption Support for further guidance. 

Symantec Endpoint Encryption 11 Compatible Opal Drives

Whitelist for Opal v2-compliant drives

The following two tables comprise the whitelist for Opal v2-compliant drives for Symantec Endpoint Encryption Drive Encryption, which have been certified with SEE versions 11.2 and above.  At the time of this writing, the current version is Symantec Endpoint Encryption 12):

• Table 1: Supported OEM vendors and computer models
• Table 2: Supported disk vendors and drives models

In addition to the computers listed in the table, any computer is supported that has these required protocols:

• ATA_Passthru
• Secure Storage

Table 2: Supported drive vendors and models

For an Opal v2-compliant drive to be hardware encrypted:

• The drive must appear on the whitelist, and
• Drive Encryption must be able to provision the drive in Global Range Mode, if it is not in Single User Mode.

Otherwise, the drive is software encrypted.

Whitelist for Microsoft eDrive-support Opal v2-compliant drives

The following two tables comprise the whitelist for Microsoft eDrive support - Opal v2-compliant drives for Symantec Endpoint Encryption Drive Encryption 11:

• Table 3: Supported OEM vendors and computer models
• Table 4: Supported disk vendors and drive models

For a Microsoft eDrive-support Opal v2-compliant drive to be hardware encrypted:

• The drive must appear on the whitelist, and
• Default partitions must be created during a default Microsoft Windows installation. when multiple partitions exist on a drive, the number of ranges must be properly mapped with the number of partitions.

Otherwise, the drive is software encrypted.

Symantec Endpoint Encryption Drive Encryption provides software-based encryption on unsupported laptops or if provisioning fails.

Client administrators can encrypt Opal v2-compliant drives using the Drive Encryption Administrator Command Line. The status command output for a hardware-encrypted drive differs, depending on how the drive was provisioned:

• A hardware-encrypted Opal v2-compliant drive shows that the whole disk is encrypted.
• A hardware-encrypted Microsoft eDrive support - Opal v2-compliant drive shows that only the C drive is encrypted.

Hardware Encryption characteristics/behavior

For unsupported laptops, or if provisioning fails, Symantec Endpoint Encryption Drive Encryption provides software-based encryption.

Client administrators can encrypt Opal v2-compliant drives using the Drive Encryption Administrator Command Line. The status command output for a hardware-encrypted drive differs, depending on how the drive was provisioned:

• A hardware encrypted Opal v2-compliant drive shows that the whole disk is encrypted.
• A hardware encrypted Microsoft eDrive support - Opal v2-compliant drive shows that only the C drive is encrypted.

172490 - Compatible Opal v2-compliant drives for Symantec Endpoint Encryption Drive Encryption 11

163518 - How to add computers and drives to the Opal whitelist in Symantec Endpoint Encryption (SEE)

161498 - Compatible Opal v2-compliant drives for Symantec Endpoint Encryption Drive Encryption 11.1.x