Symantec 8.2.1 Endpoint Encryption Removable Storage User Guide
Symantec Endpoint Encryption Removable Storage 8.2.1 protects against data loss arising from the misplacement or theft of removable storage devices. It provides various measures to secure data, including restricting access, allowing read-only access, automatically encrypting all files, and encrypting data on demand. Your organization determines which measures are enforced on your computer.
Advertisement
Advertisement
Symantec Endpoint Encryption
Removable Storage
User Guide
Version 8.2.1
ii
Copyright © 2012 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Authenti-Check is a registered trademark of GuardianEdge Technologies Inc. (now part of
Symantec). Other names may be trademarks of their respective owners.
The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any.
THE DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS,
REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE
DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID.
SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES
IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE
INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.
The Licensed Software and Documentation are deemed to be commercial computer software as defined in
FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 “Commercial Computer
Software - Restricted Rights” and DFARS 227.7202, et seq. “Commercial Computer Software and
Commercial Computer Software Documentation”, as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and
Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.
Symantec Corporation
350 Ellis Street
Mountain View, CA 94043 http://www.symantec.com
Contents
Chapter 1
Chapter 2
Introduction
Registration, Re-Registration & Default Password Expiration
iv Contents
Chapter 3
Chapter 4
User Client Console
File Encryption/Decryption
Contents v
Chapter 5
Chapter 6
Self-Extracting Executables
Removable Storage Access Utility
vi Contents
Chapter 7
CD-DVD Burner
Appendix A Multimedia File Types Excluded
Appendix B Token Usage
Appendix C Error Messages & Prompts
Glossary ...........................................................................................................95
Index ................................................................................................................97
Chapter
1
Introduction
■
■
■
■
This chapter includes the following topics:
Overview
Symantec Endpoint Encryption Removable Storage allows your organization to protect against loss of data arising from the misplacement or theft of removable storage devices.
Removable Storage secures data in one of the following ways:
■
■
By allowing no access to removable storage devices,
By allowing only read access to removable storage devices,
■
■
By automatically encrypting all files written to or accessed on removable storage devices,
By automatically encrypting all files written to removable storage devices,
■
■
By automatically encrypting files per Symantec Data Loss Prevention for Endpoint,
By automatically encrypting data written to CD/DVD media, and/or
■
By encrypting files written to a removable storage device on demand.
Your organization determines which of these measures will be in effect on your computer.
These preventative measures reduce the likelihood of data breach incidents.
Removable Storage is Section 508 compliant if Job Access with Speech (JAWS) is installed and running.
JAWS will read the graphical user interface of Removable Storage aloud. A visually simplified User Client
Console will be displayed if JAWS is running.
Important Concepts
Encryption
Encryption is the ancient art of exchanging secret messages. Love and war have driven the evolution of cryptography over the centuries.
Today, very complex algorithms are used to scramble information into an indecipherable series of cryptic characters. Only those in possession of the “key” can decrypt the data, thereby rendering it intelligible again.
2 Introduction
Important Concepts
Keys
The key, in the case of Removable Storage, is derived from either a password or a certificate. Both encryption and decryption require a key.
Default Passwords and Default Certificates
If your machine is configured to encrypt files on removable storage devices and/or CD/DVDs automatically, you can either provide a password or a certificate on a per file basis or set Default Password(s) and/or
Default Certificate(s) to be used for all files.
Default Passwords and Default Certificates eliminate the need for Removable Storage to prompt you each time it encrypts a file. Furthermore, Default Passwords and Default Certificates reduce the need for
Removable Storage to ask for a password when it attempts to decrypt a file.
For example, if you have Removable Storage installed both at home and at work, you may wish to set up your home and work machines to use the same Default Password(s) and/or Certificate(s). Removable
Storage will not need to prompt you to encrypt or decrypt files shared between machines configured to use the same Default Password(s) or Default Certificate(s).
Default Password(s) and Certificate(s) might also be useful if you and other people at work frequently share files via removable storage devices. If you and these other users were to set the same Default or Session
Default Password or Certificate(s), you would be able to share files without any prompts. So these should be users that you can trust with your removable storage device files.
Whether you have the ability to set up to three Default Password(s), and/or up to ten Default Certificates depends on your organization.
Icon Overlays
Removable Storage identifies encrypted files with lock icon overlays.
If Removable Storage has the key for the file, the lock will be golden .
If Removable Storage doesn’t have the key, the lock will be red .
If the lock is red, Removable Storage will prompt you for the password or certificate that was used to encrypt the file when you try to open it.
Registration
Once Removable Storage has been installed on your machine, you will need to register with Symantec
Endpoint Encryption before you can access any removable storage devices. During registration, you create your Symantec Endpoint Encryption account. At least one user must be registered on each workstation once a designated number of grace restarts has passed.
Registration is a highly configurable process, involving a maximum of five screens. Your administrator may also have configured it to occur silently, so that the process is completely transparent to you.
User Client Console
You may be prompted to enter your Symantec Endpoint Encryption password or PIN before you access the
User Client Console. If your computer is set for automatic authentication or you have Single Sign-On (SSO), you will not have to log on to the User Client Console.
The User Client Console provides you with the ability to view and modify your Symantec Endpoint
Encryption settings. At a minimum, you can use the User Client Console to:
■
■
View the other users that have registered to Symantec Endpoint Encryption on your machine.
Find out which Symantec Endpoint Encryption products are installed on your machine and their version numbers.
Introduction
Tips and Tricks
3
■
See which policies are being enforced by Removable Storage.
In addition, you may be able to:
■
Add or change your Symantec Endpoint Encryption password.
■
Add or change the token you use to authenticate to Symantec Endpoint Encryption.
■
■
Set or change your Authenti-Check questions and answers.
Set or modify your Default Password(s) and/or Default Certificate(s).
■
Change your automatic encryption setting.
Policy Administrators
The Policy Administrator performs centralized administration activities, such as defining installation settings and policies that are pushed out to Client Computers.
Client Administrators
The Client Administrator is your primary Symantec Endpoint Encryption administrator contact. The Client
Administrator can help you if you forget your Symantec Endpoint Encryption password or are unable to decrypt a file.
Tips and Tricks
Work Locally
We recommend that you use your own hard drive as the primary place of storage for your files and removable storage devices as the means of transporting these files from one place to another. Copy files from a removable storage device to your hard drive before you begin to work on them. Once your work is complete, copy them to your removable storage device.
Save As Versus Save
Removable Storage will encrypt differently depending on whether you select Save or Save As from the File menu. If you select Save and the file was already encrypted, it will use the existing password and/or certificate(s) under which the file was encrypted. If you select Save As, it will use the Default Password(s) and/or Certificate(s) specified in the User Client Console or it will prompt you to enter a password and/or select a certificate.
This is good to remember if a fellow Removable Storage user lends you their removable storage device and you access a file on that device. If you select Save, they would be able to open that file more easily than if you select Save As. If you select Save As, you may need to tell them the password it was encrypted under, or provide them with your Default Certificate or the certificate you selected at the prompt, before they can open the file again.
Double Encryption
It might seem that encrypting a file twice would make it twice as secure.
But if you encrypt something once with a product from one vendor and a second time with a product from another vendor, you may never be able to decrypt it again.
Some removable storage devices offer encryption services of their own. If your administrator has configured your installation of Removable Storage to always encrypt, do not utilize any additional encryption services that may be offered by your removable storage device, as you may not be able to decrypt the data.
4 Introduction
Best Practices
Best Practices
Password/PIN Strength
Define a password or PIN that you can remember, so that you don’t have to write it down. Try to choose passwords and PINs that are closer to the maximum length allowed rather than to the minimum length allowed. Include a variety of characters, including upper and lowercase letters mixed with numbers and special characters, if allowed. When you create a password, think of one that is hard to guess; for example, don’t use a commonly known fact, such as your spouse’s name, or a fact that can be easily researched, such as your mother’s maiden name.
Password/PIN Secrecy
You are responsible for your password or PIN’s security. Change your password or request a new PIN if you feel that your password or PIN may have become compromised. Some situations to be mindful of are:
■
You wrote your password or PIN on a piece of paper but now you can’t find that paper.
■
Someone looked over your shoulder and watched you type your password or PIN.
Trusted Software
Be familiar with the software that is authorized to run on your computer. Be careful if you download software from the Internet. This software could contain spyware, viruses, malware, Trojan horses, or worms. Also use caution when opening email attachments.
Backups
If your organization does not perform automated backups, you should do so yourself on a regular basis.
This will allow you to recover from theft or hard disk failure. Store your backups in a physically secure location, such as a locked cabinet.
Chapter
2
Registration, Re-Registration &
Default Password Expiration
■
■
■
■
This chapter includes the following topics:
■
Overview
One of the first signs that Removable Storage has been installed may be a prompt for registration. If you are prompted to register, you are encouraged to do so as soon as possible, even if registration is optional.
You will not be able to access your removable storage devices until you register.
You also may be prompted to re-register. This can occur if your organization is switching authentication methods.
Registration Prompts
Basics
After Removable Storage is installed and your computer reboots, if you haven’t registered already, you may be prompted to do so.
Grace Restarts Available
Grace restarts are the number of times you can reboot without having to register. If you were provided with grace restarts and have not used them all, the registration prompt will identify how many remain.
Figure 2-1 Registration Prompt, Grace Restarts Available
6 Registration, Re-Registration & Default Password Expiration
Registration Wizard
While you can click Cancel and continue working normally, it’s best to click Register Now and begin the registration process (
“Registration Wizard” on page 6).
Registration Mandate
Once your grace restarts expire, or if your administrator did not give you any grace restarts, you will be forced to register. A prompt will be displayed, stating this mandate.
Figure 2-2 Registration Prompt, Mandate
If you can’t complete registration now, click Log Off Windows. The next time you boot up, you will receive the same registration mandate.
Multiple Users
If at least one user has already registered on this computer, you may be prompted to register on an optional basis.
Figure 2-3 Registration Prompt, Multiple Users
Click Register Now to begin the registration process (see “Registration Wizard” on page 6).
If you click Ask Me Later or Don’t Ask me Again, you will be unable to access removable storage devices.
Registration Wizard
Basics
The Registration wizard guides you through the registration process. This wizard is the same for both registration and re-registration. The steps in this process will vary according to how your computer has been configured.
If you click Cancel in the Registration Wizard, your Symantec Endpoint Encryption account will not be created. You will be prompted to confirm that you really want to cancel.
To display Quick Help, click the help icon . The Quick Help pane appears. To close the Quick Help pane, click the help icon again.
Registration, Re-Registration & Default Password Expiration
Registration Wizard
7
Registration Password
You may need a password to begin the registration process. If you don’t see the Registration Password
Figure 2-4 Registration, Registration Password
A registration password is a way for your administrator to limit the number of users allowed to register on this computer. The registration password is not your Symantec Endpoint Encryption password; the registration password admits you to the registration process.
You should have received this password ahead of time. If you do not have the password, call your help desk or click Cancel.
Otherwise, type the password and click Next.
If the password is accepted, the next panel in the registration process appears.
If the password is not accepted, a message appears and you will need to correct the password then click
Next to resubmit it, or click Cancel. The Back button is not available.
Preferred Authentication Method
If your administrator has chosen to allow you to authenticate with either a password or a token and Single
Sign-On is not enabled, the Preferred Authentication Method panel will be displayed. If the Preferred
Authentication Method panel is not displayed, refer to the section that corresponds to your authentication method:
■
If you authenticate with a password, skip to “Password Registration” on page 8.
■
■
If you authenticate with a token, skip to
“Token Registration” on page 9.
If you don’t authenticate (automatic authentication), skip to
8 Registration, Re-Registration & Default Password Expiration
Registration Wizard
Figure 2-5
Registration, Preferred Authentication Method
Select the method of authentication that you prefer and click Next. If you select Password, continue to the next section. If you select Token, skip to
“Token Registration” on page 9.
Note: While the Registration Wizard will only escort you through your preferred authentication method, you can add a second method using the User Client Console at any time following registration.
Password Registration
Basics
The password registration process will vary according to whether or not you have Single Sign-On enabled.
Single Sign-On Enabled
If Single Sign-On is enabled, the Registration wizard will display the Single Sign-On panel. If you don’t see
the Single Sign-On panel, skip to “Single Sign-On Not Enabled” on page 9.
Figure 2-6 Password Registration, Single Sign-On Enabled
Registration, Re-Registration & Default Password Expiration
Registration Wizard
9
The credentials associated with your Windows account will be used for your Symantec Endpoint
Encryption account. Click Next to continue.
Single Sign-On Not Enabled
If Single Sign-On is not enabled, the Account Password panel will be displayed.
Figure 2-7
Password Registration, Account Password
The Account Password panel will display the account information of the user currently logged on to
Windows.
Define a password that you can remember, so that you don’t have to write it down. Try to choose passwords that are closer to the maximum length allowed rather than to the minimum length allowed. Include a variety of characters, including upper and lowercase letters mixed with numbers and special characters, if allowed. When you create a password, think of one that is hard to guess. Avoid obvious choices, such as your spouse’s name and your mother’s maiden name.
Follow the guidelines shown below the Confirm password field, if any. The password must be within the
Password length specified. The Symbols allowed parameter identifies which of the symbols on your keyboard may be included in the password. The Include at least field identifies the number of required symbols, uppercase letters, lowercase letters, and/or digits that your password must contain, if any.
Tab to or click on the Confirm password field and type your password again. Click Next.
If the password does not meet the requirements, the requirement that the password does not meet will be displayed in red. If the Password field and Confirm password field do not match exactly, the password fields turn red.
Token Registration
Basics
Token registration may require up to three steps:
1 Token insertion (
“Token Insertion” on page 10),
10 Registration, Re-Registration & Default Password Expiration
Registration Wizard
2
PIN entry ( “Single Sign-On Not Enabled” on page 10),
3 Certificate Selection (
“Certificate Selection” on page 11).
Token Insertion
If your token was inserted when the Registration Wizard began, you do not see a token-insertion prompt
panel. Skip to the next section ( “Single Sign-On Not Enabled” on page 10).
Otherwise, you will be prompted to insert your token. For details about token insertion and errors, refer to
Single Sign-On Not Enabled
If Single Sign-On is not enabled, you will be prompted to enter your PIN. If you aren’t prompted, skip to the
next section ( “Confirmation” on page 10).
Figure 2-8 Token Registration, PIN Entry
Type your PIN in the PIN field, then click Next.
Confirmation
For both SSO and non-SSO accounts, the next registration panel confirms the token information that
Symantec Endpoint Encryption will use to authenticate you.
Figure 2-9
Token Registration, Summary
Registration, Re-Registration & Default Password Expiration
Registration Wizard
11
Verify the information and click Next.
Certificate Selection
If the Select Certificate window does not appear, skip to the next section
Figure 2-10 Token Registration, Select Certificate
Select your Symantec Endpoint Encryption certificate by clicking on the appropriate row, then click OK.
Skip to the next section.
If you don’t know which of the certificates listed are valid, contact the appropriate administrator.
If you receive an error message, refer to “Token Registration” on page 83.
Authenti-Check
If you have Authenti-Check enabled, then you will see the Authenti-Check panel. If you don’t see this panel
skip to the next section ( “Completion” on page 13).
12 Registration, Re-Registration & Default Password Expiration
Registration Wizard
Figure 2-11
Registration, Authenti-Check
Authenti-Check is a self-help recovery tool that allows you to gain access to the User Client Console if you forget your password, PIN, or token. It can also be used if you get a new token and need to change tokens.
One Authenti-Check question is always required. Up to three questions may be required, depending on how your system is configured.
Questions identified as required must be entered and answered.
If a question is identified as optional, you are encouraged to enter a question and an answer. The more question-answer pairs you have, the more secure your User Client Console access is. For maximum security, enter three questions and three answers.
Sometimes your Policy Administrator predefines questions for you. These questions you cannot change and you must provide answers for.
Try to choose answers that other people cannot guess easily. Follow similar guidelines for your questions and answers as you would for your password. Create pairs that:
■
Do not contain commonly known information,
■
■
Are longer rather than shorter, and
You can remember without writing down.
See Table 2.1 for examples of secure and less secure questions.
Table 2-1 Authenti-Check Sample Questions
Secure
Who was your favorite teacher?
Who was your childhood hero?
What is the street name where your favorite relative lived?
Less Secure
What is your social security number?
Where were you born?
What is your mother’s maiden name?
Registration, Re-Registration & Default Password Expiration
Re-Registration
13
Do not let others watch you enter them. Unlike passwords, the question-answer pairs are not displayed as asterisks or dots on your screen; they display in plain text.
When you have entered all questions and answers, click the Next button to submit your information. If your questions and answers fall within established guidelines, your information will be accepted; otherwise, fields that contain errors are highlighted in red. Correct any highlighted information then click
Next.
Completion
The final Registration panel notifies you that your Symantec Endpoint Encryption user account is active.
Figure 2-12 Registration Success
Click Finish to complete the wizard and dismiss the panel. This will result in the launch of the User Client
Console.
See Chapter 3
“User Client Console” on page 17 for information about using the User Client Console.
Re-Registration
Your Policy Administrator may dictate a change in your Symantec Endpoint Encryption authentication method either as part of an upgrade or by policy update. Should this occur, you may be required to reregister.
If you were not provided with a grace period or your grace period has expired, you will be forced to reregister.
Figure 2-13 Sample Re-Registration Mandate
Click Re-register to launch the Registration wizard.
14 Registration, Re-Registration & Default Password Expiration
Default Password Aging
If you need to re-register for a password-based account, follow the instructions under “Password
If you need to re-register for a token-based account and you have been issued your token, follow the instructions under
“Token Registration” on page 9.
If you can’t complete re-registration, click Log Off Windows. This could occur if you receive the prompt before you receive your token. The next time you boot up, you will receive the same re-registration mandate.
Default Password Aging
Basics
You may have set a Default Password and/or Session Default Passwords for encryption and/or decryption.
If your Policy Administrator applied password aging requirements, your Default and/or Session Default
Passwords have a minimum age and a maximum age.
Warning
When a Default or Session Default Password’s maximum age begins to approach, you will receive a warning message when you log on to Windows.
Figure 2-14 Default Password Expiration Warning
Expiration
If a Default or an active Session Default Password expires during your current Windows session, you will be notified.
Figure 2-15 Default Password Expiration, During Windows Session
You are able to continue using the password during this Windows session, but if you were to log off the
Windows session without changing the Default or Session Default Password, then the next time you log on
Registration, Re-Registration & Default Password Expiration
Default Password Aging
15 this password cannot be used for encryption; instead, unless you have another active default password, you will be prompted for a password every time you try to encrypt a file. As a best practice, go to the User Client
Console when you see this message and change your expiring password.
If your Default Password or a Session Default Password has expired, you will be notified upon logging on to
Windows.
Figure 2-16 Default Password Expiration, Upon Windows Logon
You must use the User Client Console to change the password or you will not be able to use it for encryption; instead, you may be prompted to enter a password every time you try to encrypt a file, if you do not have another active default password.
16 Registration, Re-Registration & Default Password Expiration
Default Password Aging
Chapter
3
User Client Console
■
■
■
■
■
■
■
■
■
■
■
■
This chapter includes the following topics:
Account Settings, Password Panel
Account Settings, Authenti-Check Panel
Removable Storage, Default Passwords Panel
Removable Storage, Certificates Panel
■
Overview
Basics
The User Client Console is available once Windows has loaded and allows you to:
■
View the other users that have registered to Symantec Endpoint Encryption on your machine.
■
Find out which Symantec Endpoint Encryption products are installed on your machine and their version numbers.
■
See which policies are being enforced by Removable Storage.
In addition, you may be able to:
■
Add or change your Symantec Endpoint Encryption password.
■
■
Add or change the token you use to authenticate to Symantec Endpoint Encryption.
Set or change your Authenti-Check questions and answers.
■
■
Set or modify your Default Password(s) and/or Default Certificate(s).
Change your automatic encryption setting.
18 User Client Console
Logon Panel
Launch
■
■
■
■
The User Client Console launches automatically when you complete the registration wizard, to encourage you to review your settings.
To launch the User Client Console, click Start, point to All Programs, point to Symantec Endpoint
Encryption Client, and then click Symantec Endpoint Encryption Client. Alternatively, right-click the
Symantec Endpoint Encryption icon in the Windows notification area and select Launch Symantec
Endpoint Encryption User Client. One of four results will occur:
The Logon panel appears (
The Home panel appears ( “Home Panel” on page 21).
You are prompted to register ( “Registration Wizard” on page 6).
You are advised that all user account slots have been taken and you cannot register. Contact your Client
Administrator.
Single Sign-On
If Single Sign-On is enabled, when you click the close button on the User Client Console, you will be asked whether you want to log off of your Symantec Endpoint Encryption session. If you click Yes, the next time you launch the User Client Console, you will need to authenticate. If you click No, you will not have to log on to the User Client Console the next time you launch it in this Windows session.
Logon Panel
Basics
If your computer is set for automatic authentication, you should not need to log on to the User Client
Console. Skip to
Otherwise, when the User Client Console launches, it prompts you for your credentials. Only the user currently logged on to Windows can log on to the User Client Console. For password authentication,
skip to
“Authentication Assistance” on page 20.
Password
If you have a Symantec Endpoint Encryption password, you can use it to log on to the User Client Console.
Figure 3-1
User Client Console Logon, Password
User Client Console
Logon Panel
19
Token
The Authentication Method drop-down list will only be displayed if you are allowed to authenticate with either a password or a token and you have defined both. To log on to the User Client Console with a password, ensure that Password is selected.
To log on to the User Client Console with a password, type your Symantec Endpoint Encryption password in the Password field, then click Log On.
If your password is not correct, the logon fails. Check your password and re-enter the information.
You may be forced to wait before you can log on. Logon delays protect against automated passwordguessing attacks. The length of the delay will be shown as a countdown.
If you registered with a token or you added a token to your account following registration, you can use it to log on to the User Client Console.
20 User Client Console
Logon Panel
Figure 3-2
User Client Console Logon, Token
The Authentication Method drop-down list will only be displayed if you are allowed to authenticate with either a password or a token and you have defined both. Select Token from the Authentication Method drop-down list.
If your token is not already inserted, insert it now. For proper insertion of your token and for a description
been read before you proceed with authentication.
In the PIN field, type your PIN, then click Log On.
If the Select Certificate dialog appears, continue reading, otherwise, skip to the next section.
Once you have successfully entered your PIN, if your token contains multiple valid certificates or no certificates, you may be asked to select a certificate.
Figure 3-3 Token Logon, Select Certificate
Select your Symantec Endpoint Encryption certificate by clicking on the appropriate row in the Select
Certificate dialog, then click OK.
If you don’t know which of the certificates listed are valid, or if no valid certificates are listed, contact your
Messages & Prompts” on page 83 for possible causes and resolution.
Authentication Assistance
If your administrator has provided you with the Authenti-Check feature and you have defined your question-answer pair(s), the Authentication Assistance button will be available from the Logon panel.
Click Authentication Assistance if you forgot or do not have the credentials associated with your account.
Figure 3-4
User Client Console Logon, Authenti-Check
User Client Console
Home Panel
21
■
■
Authenti-Check involves up to three question-answer pairs established either during registration or from the User Client Console.
In each box that appears beside a question, type the correct answer. The answers are not case-sensitive.
Once you have answered the questions, click Log On. One of the following will result:
■
The Home panel will be displayed.
You will be advised that your answers were incorrect.
Your Policy Administrator may have implemented a logon delay to occur when one or more incorrect logon attempts are made. This delay helps protect the computer against password-guessing attacks. If such a setting or policy is in place and you or someone else triggers that restriction, you are returned to the Logon panel where the Account name and Password fields are unavailable. A message informs you that the number of allowed logon attempts has been exceeded and a running countdown displays how long you must wait before you can try again.
Home Panel
The User Client Console opens with the Home panel, an enabled navigation pane, and tasks that you may want to perform but have not yet completed, if any.
22 User Client Console
Home Panel
Figure 3-5
User Client Console, Home
From time to time, your Policy Administrator may push out new policies that require you to take action.
You will be notified of your action items on the Home panel. If a panel is included in the action item, go to the panel listed by clicking its link, then update the information as specified on the Home panel. Each time you submit the updated information, you are returned to the Home panel and that action item is removed from the list.
Figure 3.5 shows action items that could appear. All of the possible action items, their meaning, and the action you need to take are described in the following table.
Home Panel Action Items Table 3-1
Action Item Meaning Action
Please go to the Authenti-Check panel to update your Authenti-Check question/answer pairs.
Either the questions and/or their type (pre-defined, required, or optional) have changed, or Authenti-
Check is being enabled for the first time.
From the navigation pane, click Authenti-Check .
Refer to “Account Settings, Authenti-Check
You may add a password to your account. To do this, please navigate to the Password panel and follow the instructions there.
You may add a token to your account.
To do this, please navigate to the Token panel and follow the instructions there.
You are allowed to authenticate with either a token or a password. You registered with a password but can add a token. Once you have defined both methods, you can use either one to authenticate to
Symantec Endpoint Encryption.
To specify one or more default certificates for Removable Storage, go to the Certificates panel.
You are allowed to authenticate with either a token or a password. You registered with a token but can add a password. Once you have defined both methods, you can use either one to authenticate to
Symantec Endpoint Encryption.
You haven’t set any Default Certificates.
From the navigation pane, click Password . Refer
to “Account Settings, Password Panel” on page 26.
From the navigation pane, click
To set one or more Default Certificates, click
Certificates in the navigation pane. Refer to
“Removable Storage, Certificates Panel” on page 34.
Token
“Account Settings, Token Panel”
. Refer to
User Client Console
Navigation
23
Table 3-1
Home Panel Action Items
(Continued)
Action Item Meaning Action
To specify a Default Password and one or more Session Default Passwords for
Removable Storage, please go to
Default Passwords panel. You will be prompted for a password to protect each file you save to removable storage devices until you have created a Default
Password or one or more Session
Default Passwords.
You haven’t set any Default or Session Default
Passwords.
Your Removable Storage default password has expired. To change it, go to the Default Passwords panel.
A password aging policy has been applied to your
Default Password.
To set a Default and/or Session Default
Password(s), click Default Passwords
in the
Default Passwords Panel” on page 33.
Your Removable Storage session default password has expired. To change it, go to the Default Passwords panel.
Session Default Passwords are deactivated at the end of each Windows session.
Session Default Passwords are deleted at the end of each Windows session.
A password aging policy has been applied to your
Session Default Passwords.
You will be forced to activate your Session Default
Passwords when you begin a new Windows session.
You will need to create your Session Default
Passwords when you begin a new Windows session.
To set a Default Passwords, click Default
Passwords in the navigation pane. Refer to
“Removable Storage, Default Passwords Panel” on page 33.
To set one or more Session Default Passwords, click Default Passwords in the navigation pane.
Refer to “Removable Storage, Default Passwords
To activate one or more Session Default
Passwords, click Default Passwords in the
navigation pane. Refer to “Removable Storage,
Default Passwords Panel” on page 33.
To set one or more Session Default Passwords, click Default Passwords in the navigation pane.
Refer to “Removable Storage, Default Passwords
There are one or more device encryption exemptions in place. When an exempted device is inserted into your computer, you will be presented with a pop-up message informing that the device is exempted from encryption and that files written to the device will not be encrypted.
Certain devices have been exempted from automatic encryption. If you have been provided with the ability to initiate encryption on demand, you won’t be able to do so on an exempted device.
Your Symantec Endpoint Encryption password has been changed successfully to match your Windows password.
A Single Sign-On policy has been applied to your account. Removable Storage has synchronized your
Symantec Endpoint Encryption password with your
Windows password.
The next time you log on, use your Windows password as your Symantec Endpoint
Encryption password.
Navigation
User Interface Elements
The User Client Console is divided into several sections.
24 User Client Console
Navigation
Figure 3-6
User Client Console, User Interface Elements
Banner
Navigation
Pane
Main
Pane
Quick
Help
Pane
The sections are as follows:
■
The banner displays the product logo, the name of the currently logged on user, and the user’s domain or local computer name.
■
■
The navigation pane contains hyperlinks to all panels. A panel loads into the main pane when its link is clicked. The links are clustered under the following headings: Registered Users, Account Settings,
Removable Storage, and an About link.
The main pane changes in response to your clicking a link in the navigation pane. For example, if you click Registered Users , the main pane displays the Registered Users panel.
Standard visual indicators are used to identify the user interface element that has focus. A dotted line outlines the link, button, check box, or icon having focus. Highlighting or a blinking cursor indicates the input field that has focus.
You can navigate the User Client Console using a mouse or keyboard.
Mouse Navigation
If you are using a mouse to navigate the User Client Console:
■
■
To load a panel, click the desired hyperlink in the navigation pane; the panel loads into the main pane.
To display Quick Help, click the help icon . The Quick Help pane appears. To close the Quick Help pane, click the help icon again.
User Client Console
Registered Users Panel
25
Keyboard Navigation
Access Keys
Use the keys listed in Table 3.2 to directly access User Client Console panels.
Table 3-2
Access Keys
To Go To This Panel
Registered Users
Account Settings
Removable Storage
About
Password
Token
Authenti-Check
Removable Storage
Default Passwords
Certificates
User Choice
Press This Key
ALT+U
ALT+P
ALT+K
ALT+A
ALT+R
ALT+F
ALT+T
ALT+O
ALT+B
TAB Key Access
You can also use the TAB key to navigate the User Client Console.
■
To load a panel, press the TAB key to the desired link in the navigation pane, then press ENTER. The panel loads into the main pane and focus moves to the panel.
■
■
To display Quick Help, press the TAB key until the focus is on the help icon , then press ENTER or the SPACEBAR. To close the Quick Help pane, press ENTER or the SPACEBAR again. Note that Quick
Help applies at the panel level; context-sensitive Quick Help is available only when using a mouse.
To select a check box, press the TAB key to place focus on the box, then press the SPACEBAR. To toggle off the selection, press the SPACEBAR again.
■
■
■
■
■
To activate a button, press the TAB key to place focus on the button, then press ENTER or the
SPACEBAR.
The TAB key follows standard user-interface behavior:
Tabbing order within each panel is top to bottom, left to right.
To move down, press the TAB key; to move up, press SHIFT+TAB.
To scroll, use the UP ARROW key and the DOWN ARROW key.
To select a check box or activate a button, press the TAB key to place focus on the check box or button, then press ENTER or the SPACEBAR.
You may need to press TAB more than once to place the focus on the next desired link, input field, button, or icon, depending on the location of the current focus.
Registered Users Panel
The Registered Users panel provides a view of all Symantec Endpoint Encryption registered user accounts on this computer.
From the navigation pane click Registered Users . The Registered Users panel appears, listing all current users.
26 User Client Console
Account Settings, Password Panel
Figure 3-7
User Client Console, Registered Users
The Registered Users panel can be useful for seeing who else has registered with Symantec Endpoint
Encryption on your computer and how many more users can register.
Account Settings, Password Panel
Basics
You can use the Password panel to change your Symantec Endpoint Encryption password if Single Sign-On is not enabled. You can also use the Password panel to add a Symantec Endpoint Encryption password if you have your choice of authentication methods: password or token. Click Password from the navigation pane. The Password panel appears.
Single Sign-On Not Enabled
If Single Sign-On is not enabled and you need to add or change your Symantec Endpoint Encryption password, the New password and Confirm new password boxes will be displayed.
Figure 3-8
User Client Console
Account Settings, Password Panel
27
User Client Console, Account Settings, Password, SSO Not Enabled
Define a password that you can remember, so that you don’t have to write it down. Longer passwords are more secure than short passwords. Include a variety of characters, including upper and lowercase letters mixed with numbers and special characters, if allowed. When you create a password, think of one that is hard to guess; for example, don’t use a commonly known fact, such as your spouse’s name, or a fact that can be easily researched, such as your mother’s maiden name.
If password management is enabled, the Password panel displays the required password length and the symbols that are allowed in your password, and any requirements for the number of symbols, uppercase letters, lowercase letters, and/or digits that your password must contain. Your panel will also describe any overall requirements, such as, “Your new password must be different than the last 10.”
Symbols allowed identifies which of the non-alphanumeric characters on your keyboard may be included in the password. Include at least displays the number of required symbols, uppercase letters, lowercase letters, and/or digits that your password must contain, if any.
In the New password field, enter your new Symantec Endpoint Encryption password.
In the Confirm new password field type your new password again.
Click OK.
■
If your password meets the requirements, your password is updated and the Home panel ( “Home
Panel” on page 21) replaces the Password panel.
■
■
If the password change is not allowed—for example, if not enough time has elapsed since you last changed your password—the fields and buttons become unavailable. An error message box will inform you of the nature of the problem. On the message box, click OK to dismiss the box. You can select another task from the navigation pane or click to quit the User Client Console.
If the password change is allowed but the password does not comply with the password requirements, then the requirement that the password does not satisfy is highlighted in red. Make the changes necessary to bring it into compliance, then click OK to resubmit the password.
At any time you may exit the panel by choosing another task from the navigation pane or clicking to quit the User Client Console. Your password will not be changed.
If you click Cancel, the fields are cleared and your password is not submitted.
28 User Client Console
Account Settings, Token Panel
Single Sign-On Enabled
If Single Sign-On is enabled and you have your choice of authentication methods, you can use the Password panel to add a Symantec Endpoint Encryption password to your account. This option is useful if you registered using a token, but have both a token and a password account in Windows, and want to be able to log on to Full Disk with either. To add a password, you must first log on to Windows using your password account. If you aren’t already logged on to Windows with your password account, the Password panel will prompt you to do so.
Figure 3-9 User Client Console, Account Settings, Password, SSO Enabled
To add a Symantec Endpoint Encryption password to your account, select the Use my Windows password
to create my Symantec Endpoint Encryption password account check box. Then click OK. A confirmation message will be displayed.
Account Settings, Token Panel
Basics
Use the Token panel to add or change the token that you use to authenticate to Symantec Endpoint
Encryption. From the navigation pane, click Token . The Token panel appears.
Token Change
If your administrator has provided you with a new token, you can use the Token panel to associate it with your new account.
User Client Console
Account Settings, Token Panel
29
Figure 3-10
User Client Console, Account Settings, Token Panel with Existing Token
The top section of the panel will display the token information currently associated with your Symantec
Endpoint Encryption account.
To change this token, insert the new token. Type the PIN. Click OK.
Token Addition
If you have the option of authenticating with either a password or a token and do not yet have a token associated with your account, the Token panel will provide you with the opportunity of adding one.
Figure 3-11 User Client Console, Account Settings, Token Panel without Existing Token
To add a token, insert it. Type the PIN. Click OK.
30 User Client Console
Account Settings, Authenti-Check Panel
Account Settings, Authenti-Check Panel
Use the Authenti-Check panel to modify the question-answer pairs that will allow you to gain access to the
User Client Console if you are missing your token, PIN, or password. From the navigation pane, click
Authenti-Check . The Authenti-Check panel appears.
Figure 3-12
User Client Console, Account Settings, Authenti-Check
Your Authenti-Check answers will not be displayed, once they have been stored, for security reasons.
Try to choose answers that other people cannot guess easily. Follow similar guidelines for your questions and answers as you would for your password. Create pairs that:
■
Do not contain commonly known information,
■
■
Are longer rather than shorter, and
You can remember without writing down.
The following table provides examples of secure and less secure questions.
Table 3-3 Authenti-Check Sample Questions
Secure
Who was your favorite teacher?
Who was your childhood hero?
What is the street name where your favorite relative lived?
Less Secure
What is your social security number?
Where were you born?
What is your mother’s maiden name?
When entering questions and answers, consider the following:
■
■
Answers are visible when typed, so be sure no one is watching you type them. These answers are as important as your password.
Remember your answers. The answers are not case-sensitive.
User Client Console
Removable Storage Panel
31
Questions and answers marked required must be completed. Minimum and maximum character lengths are indicated in parentheses beside Questions and Answers. Even if a question or answer is marked optional, consider filling it in as it will increase the security of your data.
When you have entered all questions and answers, click OK to submit your information.
If your questions and answers are accepted, your information is updated. The Home panel (
“Home Panel” on page 21) appears, replacing the Authenti-Check panel.
If your questions and answers are not accepted, the field that needs correcting turns red. Make your corrections. Click OK again.
If you click Cancel, your information is cleared and not submitted.
Removable Storage Panel
The Removable Storage panel will inform you of the policies in place on your machine. From the navigation pane click Removable Storage .
Figure 3-13
User Client Console, Removable Storage
Removable Storage is protecting your data in one of the following ways:
■
■
By allowing no access to removable storage devices,
By allowing only read access to removable storage devices,
■
■
By automatically encrypting all files written to or accessed on removable storage devices,
By automatically encrypting all files written to removable storage devices,
■
■
By automatically encrypting data written to CD/DVD media,
By automatically encrypting files per Symantec Data Loss Prevention for Endpoint, and/or
■
By encrypting files written to a removable storage device on demand.
The Removable Storage panel will inform you which of these policies is in place on your machine.
Table 3-4 Removable Storage Panel Messages and Policies in Effect
Message Meaning Policy in Effect
The Symantec Endpoint Encryption policy on this computer does not allow access to removable storage devices.
You cannot read from or write to removable storage devices from this computer.
Access Policy:
No Access
32 User Client Console
Removable Storage Panel
Table 3-4
Removable Storage Panel Messages and Policies in Effect
(Continued)
Message
The Symantec Endpoint Encryption policy on this computer allows readonly access to removable storage devices.
All files written to or accessed on these devices are automatically encrypted.
Meaning
Once you have registered, you can read from but cannot write to removable storage devices.
The Symantec Endpoint Encryption policy on this computer allows read and write access to removable storage devices.
Once you have registered, you can read from and write to removable storage devices.
Policy in Effect
Access Policy:
Read Only
Access Policy:
Read and Write
Unencrypted files stored on removable storage devices will be encrypted by Removable Storage as soon as they are accessed. You will be warned of this and given an option to view only, thereby preventing the encryption of unencrypted files (see
“Pre-Existing Unencrypted Files” on page 37).
Encryption Policy:
Encrypt All
Any file that you write to a removable storage device will be encrypted by Removable Storage.
New files written to these devices are automatically encrypted.
Any file that you write to a removable storage device will be encrypted by Removable Storage. You may be able to change this in the User Choice panel (see
“User Choice Panel” on page 35).
Encryption Policy:
Encrypt New
New files written to these devices are not encrypted.
Removable storage device files will not be encrypted by Removable Storage.
You may be able to change this in the User Choice panel (see
Encryption Policy: Do
Not Encrypt
Files written to removable storage devices will not be encrypted, but files written to CD/DVDs will be encrypted.
New files written to CD/DVD using the Symantec
Endpoint Encryption CD/DVD Burner application will be encrypted.
Files are encrypted as per Symantec
Data Loss Prevention for Endpoint.
Files stored on removable storage devices (except for
CD/DVD) are encrypted per policy set through the
Symantec Data Loss Prevention for Endpoint product.
Encryption Policy:
CD/DVD only
Encryption Policy:
Encrypt per Symantec
DLP for Endpoint
The Policy allows users to decide about the default encryption about the files written to the devices.
You can select whether the default action is to encrypt new files, or not to encrypt new files written to a removable storage device.
Encryption Policy: User
Choice
The following groups of file types are exempt from encryption: Audio | Video
| Image
Removable Storage will not encrypt files belonging to the itemized group(s) when enforcing an encrypt all, encrypt new, or CD/DVD only encryption policy.
See Appendix A “Multimedia File Types Excluded” on page 75 for the file types that belong to each
group.
—
The Symantec Endpoint Encryption policy on this computer allows
Removable Storage users to set a device session default password for each inserted removable storage device while it is connected. The password is automatically deleted when the removable device is removed or when the user logs off of Windows.
If you are prompted for a password during file encryption on a removable device, you can choose to have Removable Storage remember that password as a default password for that device only, as long as the device is inserted and you are logged on to
Windows.
Default Passwords
Policy: Allow device session default passwords
User Client Console
Removable Storage, Default Passwords Panel
33
Removable Storage, Default Passwords Panel
If your computer has been configured to encrypt files automatically, you may want to set a Default
Password and/or up to two Session Default Passwords. Click Default Passwords from the navigation pane.
Figure 3-14
User Client Console, Removable Storage, Default Passwords
To set and/or activate a Default Password, select the Set a default password check box. To set a new Default
Password or change an existing Default Password, type the Default Password in the Password box and again in the Confirm password box. To deactivate a Default Password, deselect the Set a default password check box. The optional Memo field lets you provide a reminder of the password value you have chosen.
To set and/or activate a Session Default Password, select a Set a session default password check box. To set a new Session Default Password or change an existing Session Default Password, type the Default Password in the Password box and again in the Confirm password box. To deactivate a Session Default Password, deselect the Set a session default password check box. The optional Memo field lets you provide a reminder of the password value you have chosen. Depending on your organization’s policy, you may find that your Session Default Passwords get deactivated or deleted at the end of a Windows session. Refer to the Home panel to discover if such a policy is in effect.
Your files will be encrypted using the Default Password and/or Session Default Password(s). In addition, if an active Default Password and/or Session Default Password matches one of the passwords that a file was encrypted under, it will be decrypted automatically.
When setting a password, try to pick something that you can remember without having to write it down.
Avoid words that can be easily guessed by people who know you, such as the name of your dog, or your mother's maiden name. If possible, avoid words that can be found in the dictionary.
34 User Client Console
Removable Storage, Certificates Panel
Keep your Default Password and/or Session Default Passwords secure so that you will not have to change it unnecessarily. Here are the reasons you may have to change your Default Password or Session Default
Password:
■
You believe that it has been compromised.
■
Your administrator has required you to do so at a designated interval.
Keep in mind that when you change a Default or Session Default Password, the new password will be used to encrypt files from that point forward. In order to open files that were encrypted under the previous password, you will need to remember the previous password. For this reason, you may want to copy all files off of your removable storage device after changing a Default Password or Session Default Password. Then copy them back on to the device. That way they will be encrypted with the new Default or Session Default
Password.
If you cannot remember a password associated with a file, contact your Client Administrator.
Once you have entered and confirmed your Default or Session Default Password, click OK. A confirmation message will be displayed. If password aging is enabled, you will see the aging requirement in the success confirmation.
Removable Storage, Certificates Panel
The Certificates panel allows you to view and manage your Default Certificates. To open the panel, click
Certificates from the navigation pane.
Figure 3-15 User Client Console, Removable Storage, Certificates
To add a certificate, click Add New Certificate. The Select Default Certificates window appears.
Figure 3-16
User Client Console, Removable Storage, Select Default Certificates
User Client Console
User Choice Panel
35
The window is populated with the valid certificates that Removable Storage has found in the local certificate store. You can filter the list by using the Show Certificates Belonging To option buttons. The
View Details button provides additional information about a highlighted certificate.
Once you have selected the check box of the certificate you want to add, click OK. The certificate appears on the Certificates panel. You can add up to ten Default Certificates.
To remove a certificate, on the Certificates panel select the check box next to one or more certificates. The
Remove Selected Certificates button becomes enabled. Click the button.
Removable Storage will no longer have the removed Default Certificate(s) available when it attempts to decrypt files. As a result, you may be prompted to provide the removed Default Certificate(s).
If the Default Certificate(s) that you have removed have been replaced with one or more new Default
Certificates, you should copy all of the files off of your removable storage device and then copy them back to the removable storage device. This will ensure that they are encrypted under the new Default
Certificate(s).
User Choice Panel
The User Choice panel allows you to change your default automatic encryption setting. If your organization’s policy does not allow you to choose your automatic encryption default, the User Choice panel will be unavailable. To open the panel, click User Choice from the navigation pane.
Figure 3-17 User Client Console, Removable Storage, User Choice Panel
36 User Client Console
About Panel
The initial selection is set by your organization’s administrator. Select Encrypt new files written to
removable media to ensure that new files, by default, will be encrypted when written to removable media.
Select Do not encrypt new files written to removable media to ensure that by default, files will not be encrypted when written to removable media. You can change the default at any time, and you can override the default for an individual file using a right-click menu command, if your organization’s policy allows that option.
If multimedia files have been exempted from encryption, they are not encrypted even if you choose
Encrypt new files written to removable media as your default choice. Refer to the Removable Storage panel to discover if multimedia files have been exempted.
If devices have been exempted from encryption, files written to the exempted devices will not be encrypted even if you choose Encrypt new files written to removable media as your default choice. Refer to the Home panel to discover if such a policy is in place.
About Panel
Use the User Client Console to find out which version of Framework and Removable Storage you are running.
From the navigation pane, click About . On the About panel, the build number associated with a given version number is accessible as a Tooltip. Hover your mouse over the version number. The build number displays. The build number can be used to see if patches have been applied.
Note: From time to time, a service pack number (SPn) is appended to the build string, indicating that this is not a major release but an update that fixes existing problems and in some cases delivers product enhancements.
Click Show legal notice to see the legal notices associated with each product.
Chapter
4
File Encryption/Decryption
■
■
■
■
■
■
This chapter includes the following topics:
Pre-Existing Unencrypted Files
Overview
If files written to removable storage devices are being encrypted automatically, your administrator has configured your computer to use a password, a certificate, or both.
Each time Removable Storage encrypts a file, it will need to know which password(s) and/or certificate(s) to use. Once the file is encrypted under the specified password(s)/certificate(s), the specified password(s)/ certificate(s) will need to be provided before the file can be decrypted.
This chapter discusses the following:
■
Pre-existing unencrypted files under an encrypt all policy (
“Pre-Existing Unencrypted Files” on page 37),
■
■
■
Defining passwords and/or certificates on a per file basis (
“Encryption Prompts” on page 39,
“Decryption Prompts” on page 42),
Encrypting and decrypting files using right-click menu options (
“On Demand Encryption” on page 43),
and
Renaming of duplicate files (
“Two Files With Same Name” on page 45).
Pre-Existing Unencrypted Files
Your administrator may have configured your computer so that all previously unencrypted files on removable devices are encrypted when they are accessed. If this setting is enabled, a message displays when you insert removable media for the first time in your Windows session, whether or not the media contains any pre-existing unencrypted files. You will not see the message, however, if your device is blank, if it is a CD or DVD, or if it is a device that has been excluded from encryption by your administrator.
38 File Encryption/Decryption
Pre-Existing Unencrypted Files
Figure 4-1
Plaintext File Message
If you click Continue, it is very likely that any unencrypted files stored on removable media (except for CDs and DVDs) will be encrypted. Accessing the file includes moving your mouse pointer over a file, selecting a file, opening a file, setting the folder view to Details, having AutoPlay enabled, or having an anti-virus program installed.
If your administrator has exempted multimedia file types, and/or certain devices from automatic encryption, files of those multimedia type(s), or on the exempted device(s) will not be encrypted when accessed. The Removable Storage panel in the Client Console lists any multimedia file types and/or removable storage devices that are excluded from encryption (
“Removable Storage Panel” on page 31).
If you do not want existing files on the removable media to be encrypted, click Limited Access or remove the device. If you select Limited Access, you will be able to view the list of files stored on the removable device, but will not be able to open any files.
To modify your selection, remove and reinsert the removable media. The message will display again and you can select Continue or Limited Access, as desired.
If your administrator has exempted devices from encryption, a message is displayed when you insert removable media of that type for the first time in your Windows session.
Figure 4-2 Exempted Devices Message
File Encryption/Decryption
Encryption Prompts
39
Encryption Prompts
Basics
If your computer is configured to encrypt files automatically and you haven’t set a Default Password,
Session Default Passwords, and/or Default Certificate(s), you will be prompted each time you attempt to write a file to removable media. The prompt will vary according to the encryption method set by your administrator.
Password
If your administrator has configured your computer to use passwords to encrypt files, a prompt similar to the following will be displayed.
Figure 4-3 Encryption Password Prompt
It will be necessary to remember the password that you enter at the prompt in order to decrypt the file later on. When setting a password, try to pick something that you can remember without having to write it down.
Avoid words that can be guessed easily by people who know you, such as the name of your dog, or your mother’s maiden name. If possible, avoid words that can be found in the dictionary.
Depending on how your administrator has configured your computer, the password that you enter will need to meet certain requirements.
■
■
If your administrator has set certain password requirements, they will be noted in any error message that displays. The requirements are also listed in the User Client Console Password panels (
on page 26 and “Removable Storage, Default Passwords Panel” on page 33).
If your administrator did not configure any password requirements, you must enter a minimum of eight characters.
The Remember this password while this device is connected check box will be displayed if you are allowed to set this password as a default password for this device. Select the Remember this password while this
device is connected check box if you would like Removable Storage to use this password to encrypt all files written to this device as long as it remains connected or until you log off of Windows.
Note: Reformatting the device also clears the password.
Type the password to be used to encrypt and decrypt the file in the Enter Password field. Confirm your entry by entering the password again in the Confirm Password field. Click OK.
Certificate(s)
If your administrator has configured your computer to use certificates to encrypt files, a prompt similar to the following will be displayed.
40 File Encryption/Decryption
Encryption Prompts
Figure 4-4
Encryption Certificate Prompt
You can select up to ten certificates to be used to encrypt the file. You, or your fellow Removable Storage users, will need to provide at least one of the specified certificates before the file can be decrypted.
By default, the Myself option will be selected, ensuring that only certificates that reside within the
Personal certificate store are listed in the Select certificates box. This includes certificates that reside on a token that you have inserted. If you don’t see the certificate(s) from your token in the box, click Refresh.
Click Other People to display only certificates that reside in the Other People certificate store. This would only be useful to you if you wanted to encrypt a file using a certificate containing someone else’s public key.
Then only that person would be able to decrypt the file, because they would be the only one with the private key.
To show both certificates that reside in the Personal and in the Other People certificate store, click All.
The View Details button can be used to find out more about the certificate highlighted in the Select
certificates box.
Once you have selected the certificate(s) to be used to encrypt the file, click OK.
Password/Certificate(s)
If your administrator has configured your computer to use passwords and/or certificates to encrypt files, a prompt similar to the following will be displayed.
Figure 4-5
Encryption Password/Certificate Prompt
File Encryption/Decryption
Encryption Prompts
41
You can enter a password, select one or more certificates, or do both. In Figure 4.5, a password has been specified and two certificates have been selected. Any one of these can be used to decrypt the file.
Depending on how your administrator has configured your computer, the password that you enter will need to meet certain requirements.
■
If your administrator has set certain password requirements, they will be noted in any error message
on page 26 and “Removable Storage, Default Passwords Panel” on page 33).
■
If your administrator did not configure any password requirements, you must enter a minimum of eight characters.
The Remember this password while this device is connected check box will be displayed if you are allowed to set a Device Session Default Password. Select the Remember this password while this device is
connected check box if you would like Removable Storage to use this password to encrypt all files written to this device as long as it remains connected or until you log off of Windows. If you are encrypting with one or more certificates as well as with a password—and you have selected the Remember this password
while this device is connected check box—the file that triggered this prompt will be encrypted with both the password and the certificate(s). You will no longer receive a prompt for subsequent file encryption on this device, and all further encryption will be to the default password only. If you would like to encrypt more files using certificates, remove the device then reinsert it; you will be prompted each time for a password and/or certificates.
Type the password to be used to encrypt and decrypt the file in the Enter Password field. Confirm your entry by entering the password again in the Confirm Password field.
The certificates located in your local certificate store will be listed in the Select certificates box. If you want to use a certificate that is stored on a token, insert your token. Once it is recognized by your token reader and token software, the certificates on the token will be available from within your local certificate store and will be listed in the dialog. If they do not appear, click Refresh.
The list will be filtered to include only those certificates issued to yourself, as the Myself option button will be selected by default. To expand the range of displayed certificates, you can select either the Other People or the All option buttons.
The View Details button can be used to find out more about a certificate highlighted in the Select
certificates box.
42 File Encryption/Decryption
Decryption Prompts
Once you are satisfied with your selections and/or entries, click OK.
Decryption Prompts
Basics
Removable Storage will try to decrypt files using your Default Password, Default Certificate, Device Session
Default Password, as well as any credentials you’ve already provided during the Windows session. If none of these credentials match the credentials the file was encrypted under, you will be prompted either to enter the password it was encrypted under or to provide the certificate that was used to encrypt it.
Password
If the file was encrypted under a password, you will be prompted to enter the password it was encrypted under. This prompt will occur at the time that Windows attempts to open the file.
Figure 4-6 Decryption Password Prompt
Enter the password that the file was encrypted under and click OK. If you provide the wrong password too many times, you may be forced to wait one minute before trying again. The number of attempts you have before the one-minute delay is effected is shown beside Attempts remaining.
If you click Cancel, you will not be able to open the file later during the device session. To open such a file later, remove and reinsert the removable storage device. This time, when Removable Storage requests a password, enter the necessary password.
Certificate(s)
If the file was encrypted under one or more certificates and the certificates it was encrypted under cannot be found in your local certificate store, you will be prompted to insert a token that contains the necessary certificate. This prompt will occur at the time that Windows attempts to open the file.
Figure 4-7 Decryption Certificate Prompt
If the necessary certificate resides on a token, insert the token and click Retry.
File Encryption/Decryption
On Demand Encryption
43
Depending on your token software, after the software reads your token, you may be prompted to enter your
PIN.
Figure 4-8 Sample PIN Prompt, Axalto
If you are prompted to enter your PIN, do so and click OK. Your local certificate store will be populated with the certificates that reside on the token and as long as Removable Storage locates the necessary certificate in your local certificate store, decryption will succeed without further messages.
Password/Certificate(s)
If the file was encrypted under both a password and one or more certificates, and none of the certificates that the file was encrypted under can be found in your local certificate store, you will be prompted to enter either the password or select one of the certificates it was encrypted under.
Figure 4-9 Decryption Password/Certificate Prompt
To enter a password, accept the default Enter Password option button selection and type the password into the text field and click OK. If you provide the wrong password too many times, you may be forced to wait one minute before trying again. The number of password attempts you have before the one-minute delay is instantiated is shown beside Attempts remaining.
To use a certificate, select the Have certificate on a smart card option button, insert the token that contains the appropriate certificate, then click OK. The token software will read the token and prompt you for your PIN. Once you authenticate to the token, the decryption will proceed.
If you click Cancel, you will not be able to open the file during the device session. To open such a file later, remove and reinsert the removable storage device. This time, when Removable Storage requests a password or certificate, enter or select the necessary password or certificate.
On Demand Encryption
Basics
Your administrator may have configured your computer to allow you to selectively encrypt or decrypt individual files, groups of files, folders, or groups of folders saved on removable storage devices. An administrator can configure the encrypt and decrypt features separately—for example you may be able to encrypt files on demand but not decrypt them, or vice versa.
44 File Encryption/Decryption
On Demand Encryption
Right-Click File Encryption
On the removable storage device, browse to the location of the file(s) you want to encrypt. You can select multiple individual files, or you can select one or more folders. Right-click the selected file(s), point to
Symantec, and select Encrypt.
If you have an active Default Password, Session Default Passwords, and/or Default Certificate(s), all of them are used to encrypt the file(s). Any one of them can be used to decrypt the resulting encrypted files. If no Default Passwords or Certificates have been set, you will be prompted to enter a password or provide a
certificate ( “Encryption Prompts” on page 39).
The right-click file encryption option has several restrictions:
■
If the file you select is already encrypted, the Encrypt menu option is not available.
■
■
The Encrypt menu option cannot be used with files or folders burned to CD/DVD.
The Encrypt menu option cannot be used if the removable storage device is an exempted device.
■
The Encrypt menu option can be used to select and encrypt multimedia files even though those file types may be excluded from automatic encryption.
When selecting a group of files, a folder, or a group of folders to be encrypted, the following conditions apply:
■
■
If you select a group of files or a folder, and some of the files in the group or folder are already encrypted, you can use the Encrypt menu option. The files that are already encrypted are skipped, while the remaining files are encrypted.
If you select a group of folders, and all the files within a selected folder are encrypted, that folder is skipped. The unencrypted files in the remaining folders are encrypted.
Right-Click File Decryption
On the removable storage device, browse to the location of the file(s) you want to decrypt. You can select multiple individual files, or you can select one or more folders. Right click the selected file(s), point to
Symantec, and select Decrypt.
If any one of the Default Passwords or certificates used to encrypt the file are available to Removable
Storage, the file is decrypted without a further prompt. If none of the passwords or certificates are
The right-click file encryption option has several restrictions:
■
■
If the file you select is already decrypted, the Decrypt menu option is not available.
The Decrypt menu option cannot be used with files or folders burned to CD/DVD.
When selecting a group of files, a folder, or a group of folders to be encrypted, the following conditions apply:
■
If you select a group of files or a folder, and some of the files in the group or folder are already decrypted, you can use the Decrypt menu option. The files that are already decrypted are skipped, while the remaining files are decrypted.
■
If you select a group of folders, and all the files within a selected folder are decrypted, that folder is skipped. The encrypted files in the remaining folders are decrypted.
File Encryption/Decryption
Two Files With Same Name
45
Two Files With Same Name
If your computer is configured to encrypt files automatically, certain sequences of events could cause you to end up with two files of the same name on your device: one encrypted and the other unencrypted. These files will be named as follows:
■
■
file name.file extension file name.file extension.xml
For example, My Spreadsheet.xls and My Spreadsheet.xls.xml. The file bearing the XML extension is the encrypted file. You will be able to observe these duplicate files only while working at a computer not protected by Removable Storage.
This could occur through circumstances such as the following:
■
■
While at a computer not protected by Removable Storage, you used the Removable Storage Access
Utility to encrypt a file. You saved the encrypted file to your device with same name as a file already on the device and selected the Preserve original unencrypted file check box. The operating system did not catch this because the Removable Storage Access Utility appended an XML to the end of the file name to signify that the file is encrypted.
You transported your removable storage device from a computer protected by Removable Storage to a computer not protected by Removable Storage. While at the computer not protected by Removable
Storage, you saved a file to the device bearing the same name as a file already on the device. The operating system did not catch this because the file already on the device bore an XML extension, because it was encrypted.
Should this situation occur, Removable Storage will resolve the issue by renaming the unencrypted file.
The renamed file will have the exact same number of characters in its file name, according to the convention below:
■
file na~n.file extension
■
file name.file extension
Most commonly, the n character will be a zero. However, if a file with the same name is already on the device, the n will increment.
For example, the files My Spreadsheet.xls and My Spreadsheet.xls.xml will become My Spreadshe~0.xls and
My Spreadsheet.xls.
The renaming will occur as soon as the operating system attempts to access the file. Most often, this will occur as soon as you insert your device.
46 File Encryption/Decryption
Two Files With Same Name
Chapter
5
Self-Extracting Executables
■
■
This chapter includes the following topics:
■
Self-Extracting Archive Encryption
Self-Extracting Archive Decryption
Overview
Your administrator may have configured your computer to allow you to create encrypted self-extracting executables for secure transport. Such files can be decrypted from computers not protected by Removable
Storage and by recipients not in possession of the Removable Storage Access Utility.
Note: Do not attempt to create a self-extracting executable larger than 4 GB.
Self-Extracting Archive Encryption
Save Archive
Browse to the location of the file(s) that you want to encrypt. A single file or multiple files can be encrypted to a self-extracting archive. Right-click the selected file(s), point to Symantec, and select Encrypt to self-
extracting archive.
The Removable Storage Self-Extracting Archive dialog appears.
48 Self-Extracting Executables
Self-Extracting Archive Encryption
Figure 5-1
Self-Extracting Archive, Encryption
Table 5-1
Encryption Method
Password only
Certificates only
Passwords and/or
Certificates
Figure 5.1 shows an example of the dialog for a user whose Removable Storage administrator allows both passwords and certificates to be used for encryption.
The dialog contains the same fields regardless of your encryption method; however, not all check boxes may be available. Check box enablement is described in Table 5.1.
Removable Storage Self-Extracting Archive Dialog Information
Enabled Check Box
Use Removable Storage default
password (conditional)
Password
Certificates
Use Removable Storage default
password (conditional)
Password
Certificates
If You Select This Check Box
You apply your Default Password—that you have already set—to encrypt this archive.
This option will only use the Default Password— not
Session Default Password(s).
You manually define a password to encrypt this archive. The check box becomes disabled if you select the Use Removable
Storage default password check box.
The certificates in your local certificate store appear in the
Certificates box. You select one or more of those certificates to encrypt this archive.
You apply your Default Password—that you have already set—to encrypt this archive. Note that Session Default Passwords cannot be used here.
You manually define a password to encrypt this archive. The check box becomes disabled if you select the Use Removable
Storage default password check box.
The certificates in your local certificate store appear in the
Certificates box. You select one or more of those certificates to encrypt this archive.
Self-Extracting Executables
Self-Extracting Archive Encryption
49
File Name and Location Identification
Regardless of your encryption method, follow the general instructions below for naming and identifying a location for the archive:
■
In the Archive Name field, type a name for the self-extracting executable file. Alternatively, use the default Archive Name that is displayed, which consists of the system time and date, such as,
“115408192008.exe.”
■
Type the desired destination of the self-extracting executable in the Encrypt to field, or browse to the appropriate folder in the Folders/Drives box.
■
■
Create Folder dialog appears. In the New folder field, type the name of the new folder and click OK.
Your folder is created and you are returned to the Removable Storage Self-Extracting Archive dialog.
If you have already saved a self-extracting executable of the same name to this location and want to replace it with this one, select the Overwrite existing files check box.
Encryption
Follow the instructions below that are specific to your encryption method.
For the password-only encryption method:
■
If you have set a Default Password, the Use Removable Storage default password check box is enabled.
Select this check box to use your Default Password to encrypt this file.
■
■
If the Use Removable Storage default password is not enabled or selected, the Password check box will be enabled. Select this check box to encrypt the file under a password that you will specify manually.
Type and confirm a password in the Password and Confirm fields. If your administrator has set certain password requirements and your password does not meet them, an error message will be displayed that states the requirements. The requirements are also listed in the User Client Console password panels
( “Account Settings, Password Panel” on page 26 and
“Removable Storage, Default Passwords Panel” on page 33).
■
Click Encrypt.
For the certificates-only encryption method:
Select the Certificates check box to encrypt the file under one or more (up to 10) certificates. The certificates in your local certificate store appear in the Certificates box.
Note: If no certificates exist in your local certificate store, you will need to insert your token and authenticate with your PIN. The token software reads your certificates into your local certificate store.
■
Click each check box under the Select column for the certificate or certificates that you would like to use. Click Details for any selected certificate to see specifics.
■
Click Encrypt.
For the password and/or certificates encryption method, follow the instructions for both password and certificate encryption above in this section.
A message confirms that the archive has been encrypted and saved to the location you specified.
Attach Archive
Browse to the location of the file(s) that you want to encrypt and send by email. Right-click the selected file(s), point to Symantec, and select Encrypt, rename and email. The Encrypt, Rename, and email dialog appears.
50 Self-Extracting Executables
Self-Extracting Archive Encryption
Figure 5-2
Self-Extracting Archive, Encrypt, Rename, and Email
Figure 5.2 shows an example of the dialog for a user whose Removable Storage administrator allows both passwords and certificates to be used for encryption.
The dialog contains the same fields regardless of your encryption method; however, not all check boxes may be available. Check box enablement is described in Table 5.2.
Table 5-2 Encrypt, Rename, and Email Dialog Information
Encryption Method
Password only
Certificates only
Passwords and/or
Certificates
Enabled Check Box
Use Removable Storage default
password (conditional)
Password
Certificates
Use Removable Storage default
password (conditional)
Password
Certificates
If You Select This Check Box
You apply your Default Password—that you have already set—to encrypt this archive. This option will only use the Default Password—not Session
Default Password(s).
You manually define a password to encrypt this archive. The check box becomes disabled if you select the Use Removable Storage default
password check box.
The certificates in your local certificate store appear in the Certificates box. You select one or more of those certificates to encrypt this archive.
You apply your Default Password—that you have already set—to encrypt this archive.
You manually define a password to encrypt this archive. The check box becomes disabled if you select the Use Removable Storage default
password check box.
The certificates in your local certificate store appear in the Certificates box. You select one or more of those certificates to encrypt this archive.
Self-Extracting Executables
Self-Extracting Archive Encryption
51
File Name
The Archive Name field displays a default value of the system time and date with “.rse” appended as a file extension, such as “115408192008.rse.” You can change the archive name, but leave the extension unchanged. Most firewalls block files with an EXE extension. The RSE extension is designed to prevent the attached file from being stripped by the firewall.
Encryption
Follow the instructions below that are specific to your encryption method.
For the password-only encryption method:
■
If you have set a Default Password, the Use Removable Storage default password check box is enabled.
Select this check box to use your Default Password to encrypt this file.
■
■
If the Use Removable Storage default password is not enabled or selected, the Password check box will be enabled. Select this check box to encrypt the file under a password that you will specify manually.
Type and confirm a password in the Password and Confirm fields. If your administrator has set certain password requirements and your password does not meet them, an error message will be displayed that states the requirements. The requirements are also listed in the User Client Console password panels
( “Account Settings, Password Panel” on page 26 and
“Removable Storage, Default Passwords Panel” on page 33).
■
Click email.
For the certificates-only encryption method:
Select the Certificates check box to encrypt the file under one or more (up to 10) certificates. The certificates in your local certificate store appear in the Certificates box.
Note: If no certificates exist in your local certificate store, you will need to insert your token and authenticate with your PIN. The token software reads your certificates into your local certificate store.
■
Click each check box under the Select column for the certificate or certificates that you would like to use. Click Details for any selected certificate to see specifics.
■
Click email.
For the password and/or certificates encryption method, follow the instructions for both password and certificate encryption above in this section.
Continue to the next section.
Send
Your default email application opens and automatically creates an email with the encrypted self-extracting archive file attached.
Complete the email recipients and message text as needed and send the email. To ensure the security of the encrypted data, it is recommended that you communicate the password through another channel, such as in person or by phone.
Modify Archive
Basics
An archive can be modified by you or by a recipient if all of the following conditions are met:
■
The computer is protected by Removable Storage.
■
The person modifying the archive is a registered user.
52 Self-Extracting Executables
Self-Extracting Archive Encryption
■
Decryption credentials are available or provided. Only one of the credentials used to encrypt the archive is required to open the archive and to delete files; all of the credentials are required to add files.
File Launch
To modify the contents of a self-extracting executable, double-click the archive.
Decryption Prompt: Password
If the archive was encrypted with the Default Password that was set on this computer, no password prompt
appears. Proceed directly to “Package Modifier Open” on page 53.
If the archive was encrypted with another password, the Symantec Endpoint Encryption Self-Extractor
Password dialog appears.
Figure 5-3 Self-Extracting Archive, Decryption, Password Prompt
Type the password with which this archive was encrypted in the Password field, then click OK. If the
password is correct, proceed to “Package Modifier Open” on page 53.
If the password is not correct, type the correct password and click OK again. If you are prompted for a password but enter the wrong password too many times (that is, you exceed the number of password
attempts remaining displayed on the dialog), you may be forced to wait one minute before trying again.
Decryption Prompt: Certificates Only
For archives that were encrypted using certificates only, if the required certificate(s) is already available on the computer, no decryption prompt appears. Proceed to
“Package Modifier Open” on page 53.
If the required certificate is not available on the computer, this error message appears:
Figure 5-4 Self-Extracting Archive, Decryption, Certificate Not Available
If you insert the smart card then click Retry, the token software prompts you for your PIN. Once you authenticate, the certificates are read into the local certificate store, satisfying the decryption credential
requirement. Proceed to “Package Modifier Open” on page 53.
If you click Cancel instead of Retry, access to the archive is denied.
Password and Certificates: Certificates Available
If the archive was encrypted using a password and one or more certificates—and at least one of those
certificates is already available on the computer—no decryption prompt occurs. Proceed to “Package
Self-Extracting Executables
Self-Extracting Archive Encryption
53
Password and Certificates: Certificates Not Available
If the archive was encrypted using both a password and one or more certificates—and none of the certificates is available yet on the computer—the decryption prompt appears for either credential option.
Figure 5-5 Self-Extracting Archive, Decryption, Password/Certificate Prompt
■
■
You have the option of providing a password or a certificate. Do one of the following:
Select the Password option and type the password with which the archive was encrypted. Click OK.
Select the Have certificate on a smart card option. Insert your token then click OK. The system recognizes the card and prompts you for your PIN. Enter your PIN and click OK on the PIN prompt dialog.
Proceed to “Package Modifier Open” on page 53.
Package Modifier Open
Once credentials are verified, the Removable Storage Package Modifier dialog opens.
Figure 5-6
Self-Extracting Archive, Package Modifier
Once the archive is open, files or folders can be extracted (decrypted) or deleted. Files can also be added, once all credentials are available.
To navigate within the archive, select a folder then right click and select Open Folder. The contents of that folder are displayed. To go up one level, click the up arrow.
54 Self-Extracting Executables
Self-Extracting Archive Encryption
Add Files
To add one or more files to the existing archive, from the Removable Storage Package Modifier dialog, click the Add Files button, or from the File menu click right and select the Add Files option.
If certificates were used to encrypt the archive, those certificates must be available on the computer in the local certificate store or the add function is denied. If the certificates are not available, insert your token and authenticate with the PIN if prompted. The certificates are now available to the local certificate store; try again.
The Add Files and Folders dialog appears.
Figure 5-7 Self-Extracting Archive, Add Files
Select the file(s) to add and click Add.
A message confirms that the file(s) is encrypted immediately and added to the archive. The Removable
Storage Package Modifier dialog reappears; the new file(s) is included in the file list.
Extract Files
To extract one or more files, from the Removable Storage Package Modifier dialog (Figure 5.6), select one or more files. The file(s) can be extracted in one of three ways:
■
■
Click the Extract To button, or
From the File menu, right click and select the Extract To option, or
■
Right click and select Extract To.
The Removable Storage Extractor dialog appears.
Figure 5-8
Self-Extracting Archive, Extractor
Self-Extracting Executables
Self-Extracting Archive Decryption
55
Type the location where you want to save the decrypted file(s) in the Extract To field. Alternatively, browse to the location in the Folders/Drives pane.
To create a new folder or subfolder, select an existing folder then click the New Folder button . At the
Create Folder dialog, type the name for the new folder and click OK. The new folder is created in the location specified.
If the file has already been extracted to this location and you want to replace the previously decrypted file(s) with a more recent version, select the Overwrite existing files check box. The files will be overwritten without warning. If you do not select the Overwrite existing files check box and the files already exist in the specified location, you will be warned that the files exist and given a chance to confirm or deny that you would like to continue with the action.
If an error occurs during extraction, a message appears for each affected file.
If the action is successful, a message confirms the extraction. The file(s) are saved to the specified location.
Clicking Close or clicking the close button dismisses the extractor.
Delete Files
To delete one or more files from the archive, from the Removable Storage Package Modifier dialog select one or more files, then:
■
■
From the File menu select the Delete From List option, or
Right click and select Delete Selected Items, or
■
Click the Delete button.
You are prompted to confirm that you really want to delete the file(s).
Self-Extracting Archive Decryption
Renaming Emailed Files
Once the self-extracting executable has been transported to a computer not protected by Removable
Storage, the recipient must first ensure that the executable bears the correct EXE extension. If the file was emailed, it may need to be renamed. On a computer that is not protected by Removable Storage, decryption always happens.
56 Self-Extracting Executables
Self-Extracting Archive Decryption
File Launch
Once the file bears the necessary EXE extension, the recipient double-clicks or otherwise attempts to launch the file.
Decryption Prompts
Password
If the archive was encrypted using a password only, the Removable Storage Extractor dialog appears, with a password prompt.
Figure 5-9 Self-Extracting Archive, Decryption, Password Prompt
The recipient types the location where they want to save the decrypted file(s) in the Extract to field.
Alternatively, they can browse to the location in the Folders/Drives pane.
To create a new folder or subfolder, the recipient selects an existing folder then clicks the New Folder button . At the Create Folder dialog, the recipient types the name for the new folder and click OK. The new folder is created in the specified location.
If the recipient has already decrypted the file in this location and wants to replace the previously decrypted file(s) with a more recent version, they select the Overwrite existing files check box. The files will be overwritten without warning. If the recipient does not select the Overwrite existing files check box and the files already exist in the specified location, the recipient will be warned that the files exist and given a chance to confirm or deny that they would like to continue with the action.
The recipient types the password in the Password field, then clicks Extract. If the wrong password is provided too many times, the recipient may be forced to wait one minute before trying again.
If an error occurs during extraction, a message appears for each file affected.
If extraction is successful, a message confirms the extraction. The decrypted file(s) is saved to the specified location.
Self-Extracting Executables
Self-Extracting Archive Decryption
57
Certificates Only
For archives that were encrypted using certificates only, if the required certificate is not available on the computer, this error message appears:
Figure 5-10 Self-Extracting Archive, Decryption, Certificate Not Available
The recipient inserts their smart card then clicks Retry. The token software prompts them for their PIN.
Once they authenticate, the certificates are read into the local certificate store, satisfying the decryption credential requirement.
If the required certificate(s) is available on the computer already, no decryption prompt appears.
The Removable Storage Extractor dialog (Figure 5.11) launches.
Figure 5-11 Self-Extracting Archive, Decryption, Certificate(s) Prompt
To extract the archive:
■
■
The recipient types the location where they want to save the decrypted file(s) in the Extract to field.
Alternatively, they can browse to the location in the Folders/Drives pane.
To create a new folder or subfolder, the recipient selects an existing folder then clicks the New Folder button . At the Create Folder dialog, the recipient types the name for the new folder and click OK.
The new folder is created in the specified location.
■
If the recipient has already decrypted the file in this location and wants to replace the previously decrypted file(s) with a more recent version, they select the Overwrite existing files check box. The files will be overwritten without warning. If the recipient does not select the Overwrite existing files check box and the files already exist in the specified location, the recipient will be warned that the files exist and given a chance to confirm or deny that they would like to continue with the action.
If an error occurs during extraction, a message appears for each file affected.
58 Self-Extracting Executables
Self-Extracting Archive Decryption
If extraction is successful, a message confirms the extraction. The decrypted file(s) is saved to the specified location.
Password and Certificates: Certificates Available
If the archive was encrypted using a password and one or more certificates—and at least one of those certificates is already available on the computer—no decryption prompt occurs. The Removable Storage
follow the instructions for extracting the archive.
Password and Certificates: Certificates Not Available
If the archive was encrypted using a password and one or more certificates—and none of the required certificates are available on the computer yet—the Removable Storage Extractor dialog appears with a choice of decryption methods: password or certificate(s).
Figure 5-12 Self-Extracting Archive, Decryption, Password/Certificate Prompt
From the Removable Storage Extractor dialog, the recipient types the location where they want to save the decrypted file(s) in the Extract to field. Alternatively, they can browse to the location in the Folders/Drives pane.
To create a new folder or subfolder, the recipient selects an existing folder then clicks the New Folder button . At the Create Folder dialog, the recipient types the name for the new folder and click OK. The new folder is created in the specified location.
If the recipient has already decrypted the file in this location and wants to replace the previously decrypted file(s) with a more recent version, they select the Overwrite existing files check box. The files will be overwritten without warning. If the recipient does not select the Overwrite existing files check box and the files already exist in the specified location, the recipient will be warned that the files exist and given a chance to confirm or deny that they would like to continue with the action.
If the recipient selects the Password option, they enter the password under which this archive was encrypted, then clicks Extract.
If the recipient selects the Have certificate on a smart card option, the recipient then:
1
Inserts the smart card.
Self-Extracting Executables
Self-Extracting Archive Decryption
59
2
Clicks Extract. The token software prompts them for their PIN. Once the recipient authenticates, the certificates are read into the local certificate store, making them available for decryption.
Extraction begins. If an error occurs during extraction, a message appears for each file affected. If extraction is successful, the message, “The files/folders have been successfully extracted” appears. The recipient clicks OK; the message and the Removable Storage Extractor dialog exit.
60 Self-Extracting Executables
Self-Extracting Archive Decryption
Chapter
6
Removable Storage Access Utility
■
■
■
■
■
■
This chapter includes the following topics:
Overview
Basics
The Removable Storage Access Utility allows you to encrypt and decrypt files on computers not protected by Removable Storage—except when launched from CD/DVD. Only decryption can be performed from CD/
DVD media.
If your administrator has chosen to provide the Removable Storage Access Utility to you, it will be written automatically to removable media each time you connect your removable storage device to your Removable
Storage–protected computer. The Removable Storage Access Utility will not be encrypted when it is written to removable media.
Two versions of the Removable Storage Access Utility exist: one for the Windows operating system and one for the Mac OS X operating system. Your administrator could have chosen to have Removable Storage copy both versions, only one version or the other, or neither version.
When a Removable Storage Access Utility is written to a device, a message is displayed, notifying you that this has occurred.
The Removable Storage Access Utility can be used only on computers not protected by Removable Storage.
Only Windows, Mac OS X v10.5, Mac OS X v10.6, and Mac OS X v10.7 operating systems are supported.
Note: The Removable Storage Access Utility is designed to serve as your primary means of browsing and accessing the files on your removable storage device. Though the navigation tools provided by your operating system (Windows Explorer, Mac OS X Finder) allow you to browse the contents on your removable storage device, they won’t decrypt encrypted files or encrypt files for secure transport, as the two versions of the Removable Storage Access Utility do. They also will not remind you to encrypt unencrypted files before removing your device, as the Removable Storage Access Utility for Windows does.
62 Removable Storage Access Utility
Device Default Password
Launching the Utility
Using AutoPlay
If the Windows AutoPlay feature is enabled, you will be prompted to launch the Removable Storage Access
Utility each time you insert your removable device into a PC not protected by Removable Storage.
To open the Removable Storage Access Utility:
■
Click Launch SEE-RS Access Utility.
Other than the option to launch the Removable Storage Access Utility, the contents of the AutoPlay dialog will vary depending on your computer’s configuration.
Manual
To launch the Removable Storage Access Utility manually, browse to the device.
■
From a PC, double-click or otherwise launch the Symantec Endpoint
EncryptionRemovableStorageAccess.exe file.
■
From a Mac, click or otherwise launch RSMacAccessUtility.dmg. Then double-click the
RSMacAccessUtility.
Device Default Password
Basics
If you are using passwords to encrypt and want to use the same password to encrypt all of your files during this session, consider setting a Device Default Password.
To set a Device Default Password:
■
Eliminates the need for the Removable Storage Access Utility to prompt you for a password each time it attempts to encrypt a file.
■
Reduces or eliminates decryption prompts, as the Removable Storage Access Utility will try to use the
Device Default Password to decrypt before prompting you.
The Device Default Password:
■
■
Is used as long as the Removable Storage Access Utility remains open.
It is cleared when the Removable Storage Access Utility is closed. To stop using the Device Default
Password temporarily, you can suspend it.
Must adhere to any password requirements set by your administrator.
These requirements are displayed at the time that you set the password.
Note: If you launched the Removable Storage Access Utility from CD/DVD, this feature is not available.
Set or Modify from File Menu
To set or modify a Device Default Password for this Removable Storage Access Utility session:
1 From the File menu, select Set/Modify Device Default Password.
Removable Storage Access Utility
Device Default Password
63
Note: If your administrator has enabled only the use of certificates for encryption, the Set/Modify
Device Default Password menu option is disabled. You may, however, set a Device Default Password any time you attempt to decrypt a file that was encrypted with a password. Skip to
Password Decryption Prompt” on page 63.
The Symantec Endpoint Encryption Access Utility Device Default Password Setup dialog appears.
2
In the Password field, type a password.
The password must conform to the password requirements listed on the screen, if any.
3
In the Confirm field, type the password again.
4 Click OK.
5 If the password is invalid, you receive an error message that restates the requirements.
■
To dismiss the message, click OK. Then correct the password and click OK again.
If the password is valid, a success message displays.
To change the password:
■
Set it again.
Set or Modify from Password Decryption Prompt
You may set or modify a Device Default Password, whenever you are prompted for a password to decrypt a file that was encrypted with a password.
To set or modify a Device Default Password:
1 From the Enter Password dialog prompt, type the password into the Password field.
2
Select the check box for Make this password as device default password.
3 Click OK.
Suspend
To suspend the Device Default Password:
■
From the File menu, select Suspend Device Default Password.
A dialog confirms the action.
To reinstate the Device Default Password during this session:
■
Continue to the next section.
To change the Device Default Password:
■
Refer to “Set or Modify from File Menu” on page 62.
Reinstate
To reinstate the current suspended Device Default Password:
■
From the File menu, select Reinstate Device Default Password.
64 Removable Storage Access Utility
Decryption
Decryption
Basics
The Removable Storage Access Utility provides two methods of decrypting encrypted files. You can either work with the encrypted file(s) from the device itself (
“Open” on page 64), or you can decrypt the file(s) to
another location (
“Decrypt to Location” on page 64).
Note: The Removable Storage Access Utility for Windows allows you to select multiple files and/or folders to decrypt to another location; the Removable Storage Access Utility for Mac OS X allows you to select a single file or folder.
Before an encrypted file can be decrypted, the credentials used to encrypt it will be necessary. These credentials may already be available, if one or more of the following is true:
■
■
You set a Device Default Password that is the same as the password used to encrypt the file.
You have already provided the password that was used to encrypt the file for a previous decryption.
■
■
The certificate used to encrypt the file resides on a token which you have already inserted.
The certificate used to encrypt the file exists in your local certificate store.
If none of the previous statements is true, you will be prompted to provide the credentials that were used to encrypt the file(s) (
“Decryption Prompts” on page 65).
Open
To work with the file from the device itself:
■
Either double-click or right-click the file and select Open.
■
If you are prompted for credentials, refer to
“Decryption Prompts” on page 65.
Note: The file will be opened as a read-only file. After opening the file you may make modifications that you want to save. To do this, select Save As. Using Save As, you can save your file back to the device or another location. If you save the file to another location, it won’t be encrypted. To achieve encryption of the file, you should save the file back to the device.
Decrypt to Location
From a PC
To work with files or folders in a location other than on the removable device, do the following:
1 Select the files and/or folders.
■
To select individual files and folders, hold down CTRL as you left-click each file and/or folder.
■
To select a group of concatenated files and/or folders, hold down SHIFT as you left-click the first file or folder in the group, then left-click the last.
The selected files and/or folders become highlighted.
2 Right-click the selected items and select Decrypt to location....
3 The operating system will prompt you to select or create a location.
The files and/or folders are decrypted and written to the specified location.
Removable Storage Access Utility
Decryption
65
From a Mac
To work with a file or folder in a location other than on the removable device:
1 Select a file or folder.
2 Right-click the selected item, then point to Decrypt To and select Location.
3
The operating system will prompt you to select or create a location.
The file or folder is decrypted and written to the specified location.
Decryption Prompts
Basics
If the Removable Storage Access Utility cannot locate the credentials needed to decrypt a file, a decryption prompt is displayed.
Note: If you are working on a PC and you select multiple files that were encrypted under multiple credentials, multiple prompts will appear, one for each unique credential. If the multiple files share a common credential, you will be prompted once for all the files.
The decryption prompt will vary according to the policy in place on the machine that copied the Removable
Storage Access Utility automatically.
■
If the encryption method is passwords, refer to “Password Decryption Prompt” on page 65.
■
■
If the encryption method is certificates, refer to
“Certificates Only” on page 65.
Password Decryption Prompt
If your encryption method is passwords only, and your Device Default Password (if any) does not match the password that the file was encrypted under, the password decryption prompt appears.
To enter a decryption password:
1 From the Enter Password decryption dialog, in the Password field type the password that the file was encrypted under.
If you enter the wrong password more than the specified number of password attempts remaining, you will be forced to wait one minute before trying again.
2 To set your Device Default Password to the password typed in the Password field, select the Make this
password as device default password check box.
Note: If you launched the Removable Storage Access Utility from CD/DVD, the Make this password as device default password check box is not available.
3 Click OK.
Certificates Only
If your encryption method is certificates and the certificate(s) that the file was encrypted under cannot be found in the local certificate store, you will be prompted to provide at least one of the certificates by inserting the appropriate smart card.
66 Removable Storage Access Utility
Encryption
To provide the appropriate decryption certificate when prompted:
1 Insert the token that contains the certificate, then click OK.
Your token software will read the token, then prompt you for your PIN.
2 Authenticate to the token.
The certificate is read into your local certificate store and provides the credentials that the Removable
Storage Access Utility requires.
If you do not have the token:
■
To dismiss the message, from the certificate decryption prompt click OK.
You will see a message that the operation failed.
Password and Certificates
If your encryption method is passwords and/or certificate(s) and the credentials that were used to encrypt the file or files cannot be found, you will be prompted to provide a password or one of the certificates.
To provide the decryption password:
1 Select the Password option, then type the password.
If you enter the wrong password more than the specified number of password attempts remaining, you will be forced to wait one minute before trying again.
2 To set your Device Default Password to the password typed in the Password field, select the Make this
password as device default password check box.
Note: If you launched the Removable Storage Access Utility from CD/DVD, the Make this password as device default password check box is not available.
To provide a decryption certificate:
1
Select the Have certificate on a smart card option.
2 Insert the token that contains the correct certificate.
3
Click OK.
Your token software will read it, then prompt you for your PIN.
4
Authenticate to the token.
The certificate is read into your local certificate store and provides the credentials that the Removable
Storage Access Utility requires.
Encryption
Adding Files/Folders
To add new files and folders to your device, do any of the following:
■
From a PC, drag the file(s) or folder(s) to the right pane of the Removable Storage Access Utility.
■
■
From a PC, cut or copy the file to the Windows Clipboard, then select Paste from the Edit menu of the
Removable Storage Access Utility.
Open the File menu, point to Add, then right-click Files or Folders. An Add Files or Browse For Folder dialog box appears.
Before the files and/or folders are added to the Removable Storage Access Utility, an Options dialog appears, prompting you to select an option: Encrypt or Don’t Encrypt.
Removable Storage Access Utility
Encryption
67
To encrypt the file or folder:
1 From the dialog, select Encrypt.
2 Click OK.
You may be prompted to specify the credentials that you want to use to encrypt the file(s) (
Encryption Prompt” on page 68 or
“Mac Encryption Prompt” on page 69, as appropriate to your
operating system).
If you don’t want to encrypt the file or folder right away:
1 From the dialog, select Don’t Encrypt.
2
Click OK.
Note: If you launched the Removable Storage Access Utility from CD/DVD, this feature is not available.
Manual Initiation
You can manually initiate encryption at any time.
From a PC
To encrypt manually:
1
Select the file(s) and/or folder(s).
■
To select individual files and folders, hold down CTRL as you left-click each file and/or folder.
■
To select a group of concatenated files and/or folders, hold down SHIFT as you left-click the first file or folder in the group, then left-click the last.
The selected items become highlighted.
2
Right-click the selected items and select Encrypt.
3 Unless you are using passwords to encrypt and have set a Device Default Password, you will be
prompted to specify the credentials that you want to encrypt the files and/or folders under ( “PC
Encryption Prompt” on page 68).
From a Mac
To encrypt manually:
1
Select a file or folder.
2 Right-click the selected item and select Encrypt File/Folder.
3
Unless you have set a Device Default Password, you will be prompted to specify the password that you want to encrypt the file or folder under (
“Mac Encryption Prompt” on page 69).
Encryption Reminder
Should you choose not to encrypt the files/folders at the time that you add them and neglect to manually initiate encryption during the session, you will be prompted when you select Exit from the File menu or when you click the close button. The Encrypt On Close dialog appears, listing all Non Encrypted File(s)/
Folder(s).
To select files and/or folders for encryption:
1 From the dialog, take the appropriate action based on whether you want to encrypt some or all of the files and/or folders:
68 Removable Storage Access Utility
Encryption
■
To encrypt some files and/or folders, select the check box that precedes each file or folder you would like to encrypt.
To encrypt all files and/or folders, select the Select All Files check box.
■
2
Click Yes.
If you click Yes without selecting any files, you will receive this message: “You have not selected any file(s) to encrypt. Please select file(s) and try again.” Click OK to dismiss the message. Select one or more files, then click Yes again.
3
Unless you are using passwords to encrypt and have set a Device Default Password, you will be prompted to specify the credentials that you want to encrypt the file/folder(s) under (
“Mac Encryption Prompt” on page 69, as appropriate to your operating system).
PC Encryption Prompt
Basics
The Options dialog appears on a PC when you attempt to encrypt a file, but don’t have a Device Default
Password set or are encrypting under certificates only.
Figure 6-1 Removable Storage Access Utility, Encryption Prompt, PC
Its appearance will vary, depending on the policy in place on the machine that copied the Removable
Storage Access Utility automatically.
The policy in effect is displayed at the top of the dialog.
Table 6-1 Policy Statement and Effect on Options Dialog
Policy Statement Effect on Options Dialog
You may encrypt your files using a password.
You may encrypt your files using a certificate only.
Certificate area will be unavailable.
Password area will not be displayed.
You may encrypt your files using a password, certificate, or both. Both Password area and Certificate area will be displayed and available.
Removable Storage Access Utility
Encryption
69
The name of the file that the Removable Storage Access Utility is attempting to encrypt is displayed just below the policy statement.
Selected File Area
If you have selected multiple files for encryption and would like to use the same credentials to encrypt all of them:
■
Select the check box in the Selected File area.
Password Area
The Password area is available only if the policy allows you to encrypt using passwords.
To encrypt using a password:
1
Type and confirm a password in the Password and Confirm fields.
If your administrator established password requirements for your Removable Storage account, those requirements apply to this encryption password as well.
2
The password that you enter in the Password field will become your Device Default Password—as if you
Certificate Area
The Certificate area is available only if the policy allows you to encrypt using certificates.
To encrypt using certificates:
1
The Certificate area displays the certificates found in the local certificate store of your computer.
Note: If no certificates exist in your local certificate store, insert your token and authenticate with your PIN. The token software reads the certificates into your local certificate store.
2
For each certificate that you would like to use, click the check box under the Select column.
3 To see specifics about any certificate, click on the row, then click View Details.
You can encrypt the file(s) under one or more (up to 10) certificates.
Conclusion
If you change your mind, you can cancel out of the process, as follows.
■
■
If more than one file was selected in the Removable Storage Access Utility for encryption, and you have decided not to encrypt any of the files at this time, click Cancel All.
If more than one file was selected for encryption and you have changed your mind about only the file displayed just above the Selected File area, click Cancel.
If you have not changed your mind and want to proceed with encryption:
■
Click OK.
You receive a success message when encryption completes. If one file was encrypted, the file name appears in the message; if multiple files were encrypted, the number of files appears.
If you were encrypting files from the Encrypt On Close dialog, the application closes.
Mac Encryption Prompt
The password encryption prompt appears on a Mac when you attempt to encrypt a file, but don’t have a
Device Default Password set.
70 Removable Storage Access Utility
File or Folder Delete
To enter an encryption password:
1 In the Password and Confirm Password fields, type and confirm a password.
If your administrator established password requirements for your Removable Storage account, those requirements apply to this encryption password as well.
2 If you have selected multiple files for encryption and would like to use the same credentials to encrypt all of them, select the Use the same password for all the files check box.
3 To cause the password that you entered in the Password field to become your Device Default
Password—as if you had selected Set/Modify Device Default Password from the File menu (
Modify from File Menu” on page 62)—select the Make this password as device default password check
box.
4
Click OK.
File or Folder Delete
To remove a file or folder from the removable device:
1 Select the file or folder, right-click it and select Delete.
You will be asked to confirm that you really want to delete that item. If you selected multiple files and/ or folders, you will be asked if you are sure you want to delete that number of items.
2 Click Yes. The item or items are deleted.
Note: If you launched the Removable Storage Access Utility from CD/DVD, this feature is not available.
Clean-Up-Temp-Files Prompt
When used on a PC, the Removable Storage Access Utility makes use of a temporary directory as it encrypts and decrypts files. Normally, the utility cleans up these temp files. However, if you select Exit from the File menu or click the close button while the utility is still working, you may see the following message: “The
Access Utility attempted to remove sensitive, unencrypted files in your default temporary directory, but some files are open or are in use. To continue, close these files that were opened using the Access Utility, then click Retry.”
To keep your data secure, make sure to go to the temp directory and remove all files.
Chapter
7
CD-DVD Burner
■
■
This chapter includes the following topics:
Overview
The CD-DVD Burner application included with Removable Storage allows you to burn files to CD or DVD. If your workstation is protected by a policy of encrypting all files written to removable media or of encrypting new files written to CD/DVD media, the files that you burn will be encrypted.
Burning a Disc
Prerequisite
If you are using an external CD/DVD drive, make sure that the device is connected and has been recognized by Windows.
Navigation
To launch the CD-DVD Burner, click Start, point to All Programs, point to Symantec Endpoint Encryption
Client, and select Removable Storage CD-DVD Burner. Alternatively, right-click the Symantec Endpoint
Encryption icon in the Windows notification area and select Launch Removable Storage CD-DVD
Burner.
72 CD-DVD Burner
Burning a Disc
Figure 7-1
CD-DVD Burner Interface
Eject
Disc
Refresh
Disc
Information
Add
Folder
Clear
Files
Add
File
Burn/
Stop Burn
The Destination Drive drop-down list displays all of the available CD/DVD drives. Select the appropriate destination.
The Policies box indicates whether or not files burned to disc will be encrypted and if the Removable
Storage Access Utility for Windows and/or the Removable Storage Access Utility for Mac OS X will be copied to the disc.
Locate the files and/or folders that you want to burn in Windows Explorer or on your desktop. Drag them to the Files and/or folders to be burned list. Once the mouse arrow changes to an add symbol, drop the files and/or folders.
Alternatively, click the Add Files or Add Folder button. Browse to the location of the files or folders that you want to burn in the dialog.
Double-click any folder to view its contents. The files appear in the Files and/or folders to be burned list.
To sort the Files and/or folders to be burned list by file/folder name or size in ascending or descending order, click on t
he
File/Folder
or
Size
column heading, as desired.
An arrow appears in the column heading indicating the sort sequence.
To remove files or folders from the list, highlight them, and click the Clear Data button
To name the CD or DVD, type a label in the Disc Volume Label field. A label is not required. If you do not label the disc, the default label with an encryption policy in place is RS-Encrypted Disc yyyy-mm-dd; without an encryption policy, the default label is yyyy-mm-dd.
To start the burn and/or encryption process, click the Burn button. The Progress and Activity Details indicate the status of the process. The Burn button changes to a Stop Burn button. To cancel the process, click the Stop Burn button.
If you have set Default Passwords, Default Certificate(s) or both, they will be used automatically to encrypt the file(s) on the CD or DVD. If you have not set any Default Passwords and/or Default Certificates, you will be prompted to specify a password and/or certificates. Each file in this session is encrypted with the password and/or certificate(s) you select. When all of the files you selected are encrypted and written to the disc, a success message displays and the disc is automatically ejected.
CD-DVD Burner
Burning a Disc
73
After a disc has been burned, you will be asked if you want to burn the same data again. If you insert a new disc and click Yes, the same data will be burned to the new disc.
The Symantec Endpoint Encryption CD-DVD Burner does not support multiple sessions on a single CD or
DVD; however, the application does support writing to rewritable CDs and DVDs. If data exists, you will be asked whether you would like to erase the existing data before the burn process begins.
If you encounter errors or warnings, refer to
“Error Messages & Prompts” on page 83.
74 CD-DVD Burner
Burning a Disc
Appendix
A
Multimedia File Types Excluded
■
■
■
■
This chapter includes the following topics:
Overview
Your administrator may have excluded one or more multimedia groups from mandatory encryption. The
Removable Storage panel of the User Client Console (Chapter 3
“Removable Storage Panel” on page 31)
provides the name of the multimedia group(s) that are excluded. This Appendix details the file types that belong to each multimedia group:
■
■
■
Video (
Audio
Table A-1
File Extension
AAC
AIF
AIFF
APE
ASF
AU
FLAC
M4A
MID
The following table identifies the file formats that belong to the audio group.
Audio File Types
File Format Description
Advanced Audio Coding
Audio Interchange File (Apple)
Audio Interchange File Format (Apple)
Compressed using Monkey’s Audio lossless compression algorithm
Advanced Systems Format (Microsoft)
Simple audio file format (Sun Microsystems)
AAC Audio file (MPEG ADIF/ADTS AAC, iTunes AAC-LC)
AIFF audio & AIFF-C compressed audio
AIFF audio & AIFF-C compressed audio
Monkey’s Audio APE File
Microsoft ASF,WMA,WMV
Audio
Free Lossless Audio Codec (open source) FLAC Audio
Compressed with the Apple Lossless Encoder (ALE); uses the Apple Lossless Audio Codec (ALAC), saved in the MPEG-4 container format.
ISO Media MPEG v4 system, iTunes AAC-LC (M4V)
Musical Instrument Digital Interface Standard MIDI data, RIFF (little/big-endian) data MIDI
76 Multimedia File Types Excluded
Video
MP3
OGG
RA
RAM
SPX
TTA
VOC
VOX
Table A-1
File Extension
MIDI
MP1
MP2
RIFF
RIFF
RM
SDS
WAV
WAVE
WMA
WMV
Audio File Types
(Continued)
File Format Description
Musical Instrument Digital Interface
MPEG-1 Audio Layer I compression
MPEG-1 Audio Layer II (ISO/IEC 11172-3) compression
Standard MIDI data, RIFF (little/big-endian) data MIDI
MPEG ADTS, layer I, v2
MPEG ADTS, layer II, v1 v2
MPEG-1 Audio Layer 3 compression
Uses Ogg Vorbis compression
MP3 file(ID3 or MPEG ADTS, layer III, v1 v2 v2.5)
OGG Audio
Created with RealPlayer, uses the Real compression algorithm
RealAudio sound file
Created with RealPlayer, uses the Real compression algorithm
RealAudio sound file
Resource Interchange File Format
Resource Interchange File Format
RealPlayer media
MIDI Sample DUMP Standard File, contains standardized System Exclusive (SysEx) messages
Ogg Vorbis Speex File
True Audio, free, real-time, lossless codec
RIFF (little/big-endian) data WAVE audio
Standard MIDI data, RIFF (little/big-endian) data MIDI
RealMedia file
SDS Audio
OGG Audio
MP3 file(ID3 or MPEG ADTS, layer III, v1 v2 v2.5) used by Creative Labs hardware (Soundblaster) VOC Audio
MetaVoice encoded audio file that uses a mathematical algorithm to simulate human speech; based on Dialogic Adaptive Differential Pulse Code
Modulation (ADPCM)
VOX Audio
Waveform audio format/Audio for Windows
Waveform audio format/Audio for Windows uses Windows Media compression (Microsoft) based on the Microsoft Advanced Systems Format
(ASF) container format and compressed with
Windows Media compression
RIFF (little/big-endian) data WAVE audio
RIFF (little/big-endian) data WAVE audio
Microsoft ASF,WMA,WMV
Microsoft ASF,WMA,WMV
Video
Table A-2
File Extension
3GP
The following table identifies the file formats that belong to the video group.
Video File Types
File Format
3rd Generation Partnership Project 3G container file for MPEG-4 Part 14 (ISO/IEC 14496-14:2003) video
Description
RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data
Multimedia File Types Excluded
Video
77
F4V
FLC
FLI
FLV
M2V
Table A-2
File Extension
3GPP
3GPP2
ASF
M4P
M4V
MOV
MP2
MP4
MPEG
Video File Types
(Continued)
File Format Description
3rd Generation Partnership Project 3G container file for MPEG-4 Part 14 (ISO/IEC 14496-14:2003) video
3rd Generation Partnership Project 3G container file for MPEG-4 Part 14 (ISO/IEC 14496-14:2003) video
RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data
RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data
Microsoft ASF,WMA,WMV Advanced Systems Format (Microsoft) container format primarily for streaming media
Adobe Flash container (ISO/IEC 14496-12)
Animation file created by Autodesk
Animation file created by Autodesk
Flash video container
Video data only, encoded using MPEG-2 compression RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data
Apple-protected video RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data
Apple video file based on MPEG-4 compressed with proprietary Apple algorithm
MPEG-2 compression
MPEG-4 compression
Macromedia Flash Data/Video
FLIC animation
FLIC animation
Macromedia Flash Data/Video
RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data multimedia movie, 4X Movie file
RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data
RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data
MPEG-1 or MPEG-2 compression RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data
78 Multimedia File Types Excluded
Image
Table A-2
File Extension
MPG
RIFF
RIFF
RIFF
RM
RMVB
SWF
VOB
WMA
WMV
Video File Types
(Continued)
File Format Description
MPEG-1 or MPEG-2 compression
Resource Interchange File Format
Resource Interchange File Format
Resource Interchange File Format
RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data multimedia movie, 4X Movie file
RIFF (little/big-endian) data AVI
RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data
RealPlayer media
RealMedia Variable Bitrate
RealMedia file
RealMedia file
Small Web Format, Flash animation Macromedia Flash Data/Video
Video Object, for video, audio, subtitles, and menus in
DVD videos
RIFF (little/big-endian) data wrapped MPEG-1 (CDXA), ISO Media
MPEG v4 system (part 12 revision, version 1&2, v7 XML, v7 binary
XML, 3GPP, 3GPP mobile, 3GPP JVT AVC, iTunes AVC-LC, bookmarked, AES encrypted), MPEG sequence, MPEG-4 LOAS/LO-
EP audio stream, transport stream data
Windows Media compression
Windows Media video compression
Microsoft ASF,WMA,WMV
Microsoft ASF,WMA,WMV
Image
Table A-3
File Extension
BMP
CUR
EMF
FH9
GIF
ICO
JNG
JPEG
The following table identifies the file formats that belong to the image group.
Image File Types
File Format Description uncompressed raster image made up of rectangular pixels
PC bitmap data
MS Windows Cursor cursor image or animation, used for Windows mouse pointer
Enhanced metafile, 32-bits, vector graphic
(Microsoft)
Windows Enhanced Metafile (EMF) image data
Macromedia FreeHand 9 Document image
GIF image data
Macromedia FreeHand 9 vector image
Graphics Interchange Format bitmap image, lossless compression, up to 256 colors
Microsoft Windows icon image, contains two bitmaps
JPEG Network Graphics, raster image, lossy compression
Joint Photographic Experts Group (ISO 10918-1), lossy compression, up to 24-bit color
MS Windows Icon file & resource
JNG (multiple-)image data Network Graphics
JPEG image (2000, standard, HSI proprietary)
Multimedia File Types Excluded
Image
79
Table A-3
File Extension
JPG
JP2
MDI
MNG
PGM
PNG
PPM
PSD
SGI
SVG
TIF
TIFF
WMF
Image File Types
(Continued)
File Format Description
Joint Photographic Experts Group (ISO 10918-1), lossy compression, up to 24-bit color
Joint Photographic Experts Group 2000, wavelet compression, lossy or lossless
JPEG image (2000, standard, HSI proprietary)
JPEG image (2000, standard, HSI proprietary)
Microsoft Document Imaging format, raster image Office document imaging file
Multiple-image Network Graphics, raster image JNG (multiple-)image data Network Graphics
Portable gray map, 8-bit raster image
Portable Network Graphics, raster image, indexed colors, lossless compression
Netpbm PGM/PPM text & rawbits data image
PNG image data
Netpbm PGM/PPM text & rawbits data image Portable pixmap, 24-bit raster image, uncompressed raster image containing Photoshop-specific elements image file native to Silicon Graphics workstation
Adobe photoshop images
SGI image data
Scalable Vector Graphics Scalable Vector Graphics, two-dimensional vector graphic
Tagged Image File Format, raster image (Adobe)
Tagged Image File Format, raster image (Adobe) proprietary Microsoft Windows meta file
TIFF image data, little/big-endian
TIFF image data, little/big-endian
MS Windows metafont
80 Multimedia File Types Excluded
Image
Appendix
B
Token Usage
■
■
This chapter includes the following topics:
■
Overview
This appendix describes correct token insertion, and token behavior when information is being read from your token.
Token Insertion
To insert your token, follow the instruction for the appropriate token type:
■
Smart card—hold the card so that the side containing the gold chip is on top and the card end containing the chip is closest to the reader.
■
USB-based—connect the USB-connector end of your token to a USB port or into a USB extension cable attached to your computer.
Token Recognition
■
■
Make sure that the token software recognizes your token before you remove it, by referring to the appropriate description below:
■
■
Aladdin eToken—the red light on the token itself blinks while the token is being read; the icon in your
Windows notification area does not change.
Common Access Card (CAC) and Personal Identity Verification (PIV)—the icon in your Windows notification area shows just a reader when the token is not inserted , then adds a blue token when the token has been inserted and read .
RSA token—the icon in your Windows notification area changes to include a plus sign .
SafeSign v2.1—no visual sign appears in the Windows notification area; simply wait a few moments after token insertion.
■
Smart card—the icon’s computer screen changes from black to blue while the icon’s golden token blinks, then returns to black when the blinking stops .
If your token or the reader has a light, it blinks when information from your token is being read. Wait until all blinking stops before taking the next action, such as clicking Next or Log On. Do not remove the token until token reading is complete.
82 Token Usage
Token Recognition
If you encounter token or certificate errors, refer to the appropriate section in Appendix C
& Prompts” on page 83 for possible causes and resolution, as follows:
■
■
During registration or re-registration, refer to “Token Registration” on page 83.
During User Client Console logon, refer to
“User Client Console” on page 93.
Appendix
C
Error Messages & Prompts
■
■
■
■
■
■
This chapter includes the following topics:
User Client Console Token Logon
Overview
This appendix provides detailed information about the error messages you may receive while performing the following operations:
■
Registering with Symantec Endpoint Encryption using a token (
“Token Registration” on page 83);
■
■
Logging on to the User Client Console with a token (
“User Client Console Token Logon” on page 84);
Using removable storage devices (
“Removable Storage Service” on page 85);
■
■
Using the CD-DVD Burner application (
“CD-DVD Burner” on page 71); and
Using the User Client Console ( “User Client Console” on page 93).
Token Registration
Table C-1
If you are using a token to register with Symantec Endpoint Encryption, you may encounter one or more of the following messages. This section will help you figure out what to do in the event of an error during token registration.
Registration Messages
Message
Incorrect PIN.
Meaning Action
You entered an incorrect PIN.
Carefully re-enter your PIN; if you enter an incorrect PIN too many times, your PIN could become blocked. Click Next.
The number of remaining attempts on your token is zero.
Follow the instructions for getting assistance. Your PIN is blocked and the token needs to be replaced or modified.
The PIN is blocked for this token. The token needs to be replaced or modified by an administrator.
Please call the help desk for assistance.
84 Error Messages & Prompts
User Client Console Token Logon
Table C-1
Registration Messages (Continued)
Message Meaning Action
The token has been removed.
Please reinsert the token.
You removed the token before the registration process completed.
Reinsert the token and leave it inserted until you click Finish on the final registration panel.
A certificate validation error has occurred. The token needs to be replaced or modified by an administrator.
Please call the help desk for assistance.
Your token does not contain any certificate, or your token contains an invalid certificate.
Follow the instructions for getting assistance. Your token does not contain a valid certificate.
The certificate selection failed.
The token may need to be replaced or modified by an administrator.
Please call the help desk for assistance.
The certificate could not be retrieved from the local certificate store. The certificate(s) on your token may be invalid or your token software is not configured add your certificate(s) to the local Windows certificate store each time you insert your token.
Follow the instructions for getting assistance.
A token error has occurred.
The registration process cannot continue.
Please call the help desk for assistance.
The program could not verify your credentials.
The token is unknown or the reader is not supported.
The verification process failed.
Check that you have inserted the token issued to you for
Symantec Endpoint Encryption use. If you used the incorrect token, insert the correct token, and try again. If you continue to receive this message, follow the instructions for getting assistance. The type of token you are using may not be the type of token selected by your Policy Administrator during product installation, or the token or the token reader may not be supported by Symantec Endpoint Encryption.
Contact the appropriate administrator. You cannot authenticate.
User Client Console Token Logon
Table C-2
Table C.2 lists the error messages that may occur when you are trying to log on to the User Client Console using a token.
User Client Console Logon Messages
Message
Incorrect PIN.
The PIN is blocked for this token. The token needs to be replaced or modified by an administrator.
Please call the help desk for assistance.
The program could not log you on. The token was removed.
Meaning
You entered an incorrect PIN.
The number of remaining attempts on your token is zero.
You removed the token immediately after clicking Log On.
Action
Check your PIN, then type your PIN again and click Log On. Take care as you type your PIN, since resubmitting the wrong PIN a number of times could result in a blocked PIN. If you are not sure of your PIN, contact the administrator who manages your token.
Follow the instructions in the error message for getting assistance. Your PIN is blocked and your token needs to be replaced or modified.
Reinsert the token and leave it inserted until you are logged on to the User Client Console.
Error Messages & Prompts
Removable Storage Service
85
Table C-2
User Client Console Logon Messages (Continued)
Message Meaning Action
A token error has occurred. The authentication process cannot continue.
Please call the help desk for assistance.
The token is unknown or the reader is not supported.
Follow the instructions in the error message for getting assistance. Your token type or reader is not supported.
A certificate validation error has occurred. The token needs to be replaced or modified by an administrator.
Your token does not contain any certificate, your token contains an invalid certificate, or your PIN has expired.
Please call the help desk for assistance.
Contact the appropriate administrator.
The certificate selection failed.
The token may need to be replaced or modified by an administrator.
Please call the help desk for assistance.
The certificate could not be retrieved from the local certificate store.
The program could not log you on. Your credentials could not be verified.
The authentication process failed.
Follow the instructions in the error message for getting assistance. The certificate(s) on your token may be invalid or your token software is not configured to add your certificate(s) to the local Windows certificate store each time you insert your token.
Make sure that the inserted token is the one that you registered for your Symantec Endpoint Encryption account. If it is not, remove the invalid token and insert the valid token. Try to log on again.
If you continue to receive this message, contact the administrator who manages your token.
Removable Storage Service
Table C-3
The Removable Storage service may generate error messages or prompts from time to time. The following table will help you figure out what to do in the event of an error.
Removable Storage Service Messages
Severity Message
Access denied.
Please enter a password.
Meaning Action
You clicked cancel on a password or certificate prompt and then attempted to open a file on a removable storage device. Without the correct password or certificate, the file cannot be decrypted and access is denied.
Removable Storage is attempting to encrypt or decrypt a file.
You can avoid this prompt by specifying a Default
Password.
Please enter a password to encrypt the file file name.
Removable Storage is attempting to encrypt a file.
You can avoid this prompt by specifying a Default
Password.
Please enter the decryption password for the file file
name.
Please select a certificate.
Removable Storage is attempting to decrypt a file.
Provide the password that was used to encrypt the file.
Removable Storage is attempting to encrypt or decrypt a file.
You can avoid this prompt by specifying one or more Default Certificate(s).
86 Error Messages & Prompts
Removable Storage Service
Table C-3
Removable Storage Service Messages (Continued)
Severity Message
Please enter a password or select a certificate, or both.
Meaning Action
Removable Storage is attempting to encrypt or decrypt a file.
You can avoid this prompt by specifying a Default
Password and/or Default Certificate(s).
Please select no more than 10 certificates.
You have tried to encrypt a file with more than ten certificates.
Ten certificates is the maximum number of certificates that can be used to encrypt a file.
Revise your selections accordingly.
A certificate is needed to decrypt the file file name. If you have a certificate on a smart card, please insert the card and then click Retry.
Removable Storage is attempting to decrypt a file that was encrypted with a certificate. The certificates installed on your machine do not match the certificate(s) that was used to encrypt the file.
If the certificate that was used to encrypt the file resides on a token, insert the token so that
Removable Storage can attempt to decrypt the file with the certificate(s) on your token.
Applications may respond ungracefully to the cancelled file creation. File replacement operations may result in the loss of the original file, if the application does not restore the original in the event of file creation failure. Do you still wish to cancel?
You clicked Cancel when prompted to enter a password to encrypt a file. You are being warned that your file may be deleted if you proceed with the cancellation.
Click Yes to continue with the cancellation. Click
No to return to the password prompt.
You have exceeded the maximum number of attempts allowed.
Removable Storage is attempting to decrypt a file and you supplied the wrong password the maximum number of times allowed. You must wait one minute before submitting a password again.
All of your default certs have expired, and will not be used for encryption. You will need to specify encryption options for each file until your default settings are updated using the client console.
Removable Storage is attempting to encrypt a file but all of the Default Certificates specified in the User Client Console are invalid or have expired.
You should update the Default Certificates listed in the User Client Console so that they are valid.
If you can’t do that right now, specify a valid certificate manually. Alternatively, you may be given the option to enter a password.
Number of your default certs have expired, and will not be used for encryption. Your remaining default certs and/ or password will be used for encryption. Please update your default settings using the client console.
Removable Storage is attempting to encrypt a file but some of the Default Certificates specified in the User Client Console are invalid or have expired. Removable Storage will encrypt the file using those Default Certificates that are still valid.
Locate the invalid Default Certificates in the User
Client Console and update them.
The Removable Storage
Service has been started manually. The service may not function properly in this state. Please log out and log back in to restore the service to normal operation.
The Removable Storage Service was started manually. You will be prevented from accessing your removable storage devices. This is true, regardless of the access policy enabled.
The password does not meet the minimum requirements.
It must contain the following:
local password requirements
Removable Storage is attempting to encrypt a file but the password you provided does not meet the minimum password requirements.
Log off of Windows and log back on to correct the problem.
Enter a password that meets the specified requirements
Error Messages & Prompts
Removable Storage Service
87
Table C-3
Removable Storage Service Messages (Continued)
Severity Message Meaning Action
Your default password will expire in n day(s). You can change the Default Password by going to the Symantec
Endpoint Encryption Client console and selecting the
Removable Storage Default
Password link.
Your Policy Administrator applied password aging requirements to your Default Password.
Your password will expire in the number of days shown. If it expires, you will not be able to use it to encrypt or decrypt files.
Change your Default Password as soon as possible using the User Client Console.
You are required to change your Removable Storage
Default Password because it has reached the maximum age defined by your administrator. Please go to the
Removable Storage Password link within the Symantec
Endpoint Encryption Client console and change your
Default Password by typing in a new password and selecting
'OK'. Your current Default
Password will no longer be able to be used effective with your next Windows session.
Please select QuickHelp if you have any questions about what this means.
Your Policy Administrator applied password aging requirements to your Default Password.
Your password expired during your Windows session. You can continue to use the password to encrypt and decrypt files for now, but once you log off Windows, the next time you log on your Default Password will be expired.
Go to the User Client Console and change your
Default Password now.
Your Removable Storage
Encryption Default Password has expired. Please go to the
Symantec Endpoint
Encryption Client console, select Removable Storage ->
Default Password in the navigation pane, and change your Default Password.
Your Policy Administrator applied password aging requirements to your Default Password.
Your password has reached the maximum allowed age. You must change the password or you cannot use it to encrypt or decrypt files.
Until you change it, you will be required to enter passwords manually.
Go to the User Client Console and change your
Default Password now.
Please enter a password.
You clicked OK on the encryption password prompt, but did not enter and confirm a password.
Enter and confirm a password. You can avoid this message by specifying a Default Password.
The passwords you entered do not match. Please re-enter the passwords.
The values you entered in the Enter Password and Confirm Password fields on the encryption password prompt do not agree.
Enter the same password in both fields. You can avoid this message by specifying a Default
Password.
The password does not meet the minimum requirements.
It must contain the following:
local password requirements
The password you entered could not be saved because it does not meet the password requirements.
Please choose a different password.
The password entered is invalid.
Removable Storage is attempting to decrypt a file and you supplied the wrong password.
Choose a different password that meets the password requirements. You can avoid this message by specifying a Default Password.
88 Error Messages & Prompts
CD-DVD Burner Application
CD-DVD Burner Application
Table C-4
The CD-DVD Burner application may generate error or success messages or prompts from time to time. The following table will help you figure out what to do in the event of an error.
CD-DVD Burner Application Messages
Severity Message Meaning
You must register with
Symantec Endpoint
Encryption before you can use this application for burning data to disc.
You must register before you can use the CD-DVD
Burner application to burn data to disc.
Action
Register with Symantec Endpoint Encryption.
Your access policy does not allow write access to removable media, so you cannot use this application for burning data to disc.
Removable Storage is enforcing a read-only access policy.
If you disagree with the policy that is in place, contact your administrator.
Disc burning engine could not be initialized successfully.
The CD/DVD Burner application was unable to initialize the disc burning engine.
Reboot your computer and try again. If you get the same message, contact your administrator.
The disc drive could not be used to burn the disc.
The application is unable to locate the disc burning drive which was selected earlier.
An incompatibility exists between your disc recorder’s burning capability and the inserted media.
Insert the type of media that the selected disc drive can write to or select a disc drive capable of burning to the desired type of media.
The CD/DVD Burner application could not find the disc recorder.
Verify that your computer has or is connected to a CD/DVD drive that is capable of burning discs.
Disc recordable drive could not be locked.
Another application or process has prevented the
CD/DVD Burner application from gaining exclusive access to the disc recorder.
Quit the other application or process and try the operation again.
A fixed hard disk drive is required for storage of temporary data. Application could not locate a fixed hard disk drive and therefore cannot continue.
Your temporary data location could not be found or does not reside on a fixed hard disk drive.
Application could not locate a fixed hard disk drive with enough free space for storage of temporary data, so application won’t burn the disc.
Your temporary data location does not have enough free space for storage of temporary data.
Check your drive connections and/or contact your administrator.
Free up some space and try the operation again.
Application found a fixed hard disk drive with enough free space for storage of temporary data, but you do not have write access on temporary folder
path to temporary folder, so application won’t burn the disc. Please get the write access on this folder and try again.
The CD/DVD Burner application has found that you do not have write privileges to your temporary data location. The burn process cannot be attempted.
Log in as a different user or contact your administrator to increase your privileges.
Alternatively, your administrator may choose to change your temporary data directory.
Error Messages & Prompts
CD-DVD Burner Application
89
Table C-4
CD-DVD Burner Application Messages (Continued)
Severity Message Meaning
Temporary folder temporary
folder path could not be created at your temporary data location. Please make sure that no file or folder is being used by any application in this temporary folder location and try again.
The CD/DVD Burner application was unable to complete the burning process because it was unable to write to your temporary data location.
Either another application was accessing the location at the same time or you do not have privileges to write to this location.
Disc could not be burned with selected data because your temporary data location is EFS enabled.
The CD/DVD Burner application cannot use an
EFS-encrypted temporary data directory.
Action
Ensure that no other applications are accessing the temporary data directory. Also verify or change your permissions. Then try again.
Either turn off EFS protection for the temporary data directory’s parent folder, or manually relocate the temporary data directory by editing the TMP or TEMP environment variables.
Verify that your account has sufficient access rights to perform this operation.
File [path/]name of file or
folder to be burned, could not be encrypted due to security reason.
Temporary file could not be deleted.
The CD/DVD Burner application was unable to encrypt the file specified, due to a lack of permissions.
The CD/DVD Burner application was unable to delete a temporary file.
Manually delete the temporary file.
The disc that you have inserted is not writable. Please insert a blank or rewritable disc of type
CD-R, CD-RW, DVD-R, DVD-
RW, DVD+R, or DVD+R DL into drive.
You attempted to burn data to a disc that is not writable.
The disc volume label can have only alphanumeric and underscore characters. The disc volume label’s length can not be more than 32 characters. Please type a valid disc volume label.
You have entered invalid characters or too many characters in the Disc Volume Label field.
You have selected one or more files with very long file name.
Application could not shorten file(s) name in temporary data location. If file encryption policy is set then file’s name length can exceed 102 characters, otherwise it can not exceed 106 characters.
Please rename the file(s) with long name and try again.
The file name exceeds the maximum number of characters allowed. Files that will be encrypted have a shorter file name length requirement (102 characters) because the CD-DVD Burner application adds a four-character extension of
.xml.
Remove the disc from the drive and insert a disc that is writable.
Type a valid disc volume label. Alternatively, a label is not required. If you do not label the disc, the default label with an encryption policy in place is RS-Encrypted Disc yyyy-mm-
dd; without an encryption policy, the default label is yyyy-mm-dd.
Shorten the long file name(s) and try again.
90 Error Messages & Prompts
CD-DVD Burner Application
Table C-4
CD-DVD Burner Application Messages (Continued)
Severity Message Meaning Action
Selected file or folder [path/
]name of file or folder could not be copied at your temporary data location because path length is exceeding the limit
(259 characters) imposed by
Windows system. Please shorten the name of selected file/folder or sub folder(s) and try again.
The folder, subfolder, and file names concatenated into a single path name together exceed the
Windows path-length limit of 259 characters.
Shorten one or more names in the path then try again.
File
“SEERemovableStorageAcc essUtility.exe” can not be selected to be burned on the root of the burnt disc.
This file is SEE-RS Access
Utility application, which will be burned automatically on the root of the burnt disc.
You have attempted to copy the Removable Storage
Access Utility to the disc, but the CD-DVD Burner application will burn the file for you automatically.
Do not manually select the Removable
Storage Access.exe file to be burned. If a policy is enabled to copy the Removable
Storage Access Utility to all removable devices, then the CD-DVD Burner application will copy and burn the file on the disc for you.
File “Autorun.inf” can not be selected to be burned on the root of the burnt disc.
File “Autorun.inf” will be burned automatically on the root of the burnt disc to run SEE-RS Access Utility application.
You have attempted to copy Autorun.inf to the disc, but the CD-DVD Burner application will burn the file for you automatically.
Do not manually select the Autorun.inf file to be burned. If a policy is enabled to copy the Removable Storage Access
Utility to all removable devices, then the
CD-DVD Burner application will copy and burn the file on the disc for you.
File “Platform.ico” can not be selected to be burned on the root of the burnt disc.
File “Platform.ico” will be burned automatically on the root of the burnt disc to run SEE-RS Access Utility application.
You have attempted to copy Platform.ico to the disc, but the
CD-DVD Burner application will burn the file for you automatically.
Do not manually select the Platform.ico file to be burned. If a policy is enabled to copy the Removable Storage Access
Utility to all removable devices, then the
CD-DVD Burner application will copy and burn the file on the disc for you.
The Removable Storage
Access Utility could not be copied to disc.
Your policy specifies that the Removable Storage
Access Utility should be automatically copied to removable media. The CD/DVD Burner application was unable to do so.
Reboot your computer and try again. If the problem persists, contact your administrator.
The estimated size of data which will be burned on disc exceeds disc capacity. The data will not be burned to disc.
Please remove some data from the list.
You have added files and/or folders to the Files
and/or folders to be burned list box in excess of the free space on the disc.
Reduce the number of files in the Files and/or
folders to be burned list box.
Name of file or folder could not be encrypted. Please free up some space on your temporary data drive and try again.
There is not enough free space on your temporary data drive for the file or folder that you want to burn to be encrypted prior to burning.
Free up some space on your temporary data drive.
Error Messages & Prompts
CD-DVD Burner Application
91
Table C-4
CD-DVD Burner Application Messages (Continued)
Severity Message Meaning Action
Selected file or folder [path/
]name of file or folder could not be copied at your temporary data location. Please check the file or folder and try again.
The burn operation failed because the CD-DVD
Burner application could not copy the data you selected to be burned to a temporary location in order to encrypt the data.
Selected file or folder [path/
]name of file or folder can not be copied at your temporary data location. Please check the file or folder and try again.
The burn operation cannot proceed because the
CD-DVD Burner application cannot copy the data you selected to be burned to a temporary location in order to encrypt the data.
Removable Storage does not have a password to encrypt this file. You must specify a password or a Default
Password before the data can be encrypted and burned to disc.
You have not set a Default Password for removable storage encryption and decryption, you were prompted to provide a password after clicking the
Burn button, and you clicked the Cancel button on the password prompt, so the data cannot be burned to disc.
Verify that you have sufficient free space on your hard disk. If the problem persists, contact the appropriate administrator.
Verify that you have sufficient free space on your hard disk. If the problem persists, contact the appropriate administrator.
Either specify the password when prompted, or set a Default Password using the User
Client Console.
Removable Storage does not have a certificate to encrypt this file. You must specify a certificate or a Default certificate before the data can be encrypted and burned to disc.
You have not set a Default Certificate for removable storage encryption and decryption, you were prompted to provide a certificate after clicking the
Burn button, and you clicked the Cancel button on the certificate prompt, so the data cannot be burned to disc.
Either specify the certificate when prompted, or set a Default Certificate using the User
Client Console.
Removable Storage does not have a Password and/or certificate to encrypt this file.
You must specify a Password and/or certificate or a Default password and/or certificate before the data can be encrypted and burned to disc.
You have not set either a Default Password or a
Default Certificate for removable storage encryption and decryption. You were prompted to provide a password and/or certificate after clicking the Burn button, and you clicked the Cancel button. The data cannot be burned to disc.
Either specify a password or certificate when prompted, or set a Default Password or
Default Certificate using the User Client
Console.
An error occurred during the encryption of the data.
The data that you want to burn could not be encrypted.
Click OK, then click the Burn button again. If the problem persists, reboot your computer and try again.
Drive can not be added to be burnt on disc.
You attempted to burn an entire drive, e.g., C: or D:. Modify your selection to the folder level.
Data could not be added in the list to be burned.
The file or folder that you attempted to add could not be added for an unknown reason.
Check your file or folder to see if there is a problem with the source data and/or try again.
Disc could not be erased.
Disc could not be ejected successfully.
An attempt to erase a rewritable disc was unsuccessful.
Insert a different rewritable or write-once disc and try the operation again.
A physical problem with your disk drive may exist that is preventing the CD/DVD Burner Application from ejecting your disk.
Try pressing the button to eject the disk.
Reboot your computer. If this fails, contact your administrator.
92 Error Messages & Prompts
CD-DVD Burner Application
Table C-4
CD-DVD Burner Application Messages (Continued)
Severity Message
Disc could not be burned due to an error.
Meaning
There was an unknown error with the disc recorder.
Action
Reboot your computer. If the problem persists, your disc recorder may be faulty.
A file or folder with name
[path/]file or folder name has already been selected to be burned to disk. Therefore, it was not added to the list.
You need to stop the burning process before closing the application.
You tried to add a file or folder to the Files and/or
folders to be burned list box that was already there. So the file or folder was not added again.
You may want to rename the file or folder and try again.
You tried to close the CD-DVD Burner application while a burn operation was in progress.
If you want to stop the burning process and close the application, click the Stop Burn button and then close the application.
Please place the disc in the drive and try again.
You clicked the Burn button when there was no disc in the drive.
Place a disc in the drive and click the Burn button again.
Disc could not be used for burning data. Please try again with another disc.
The disc that you inserted in the drive cannot be used for burning data for a reason that is not specified.
Please wait until application stops the disc burning process.
The disc burning process has been halted.
The application is unable to locate a drive capable of writing data to disc.
Please reduce the number of files selected and try again.
You tried to close the application before the disc burning process had stopped.
Remove the disc from the drive and insert another disc.
Wait for the message, “The disc burning process has been halted.” Then close the application.
You clicked the Stop Burn button after you started to burn data to a disc, and then you clicked Yes on the confirmation message. The application has now succeeded in stopping the disc burning process.
The CD-DVD Burner application could not find a drive that can be used to burn your data.
The CD-DVD Burner application didn’t find any disc recorders present. You may not have the necessary hardware to perform this operation, or else your operating system may be unaware of your hardware.
The number of files that you tried to add exceeds the maximum buffer size.
Remove some files from your queue.
The data has been burned to disc successfully. Do you want to burn another disc with the same data? If yes then remove the burned disc and insert a new disc and click Yes.
You have successfully burned one or more files and/or folders to disc.
Your disc contains data. This data needs to be overwritten to burn the disc. Would you like to erase disc data?
You tried to burn data to a disc that already contains data.
If you want to burn another disc with the same data, remove the burned disc, insert a new disc, and click Yes.
Click Yes if you have inserted a rewritable CD/
DVD and would like to proceed to erase the existing data and burn the new data. If the
CD/DVD is not rewritable or if you would like to preserve the existing data, click No.
Error Messages & Prompts
User Client Console
93
Table C-4
CD-DVD Burner Application Messages (Continued)
Severity Message Meaning Action
You have selected one or more files with names that exceed
102 characters or path length in temporary data location is exceeding the 259 character limit imposed by Windows system. The extra characters will be removed automatically before the files are burnt to disc. Do you choose to continue?
You have added some files to be burned that have file names of more than 102 characters.
Alternatively, the path to your temporary data drive combined with the file names exceeds the
259 character limit imposed by the Windows operating system.
Click Yes to allow the CD-DVD Burner application to shorten the names automatically so that they do not exceed the maximum. Click No to cancel the burning of these files. Shorten the long file name(s) yourself then try again.
You have selected one or more
EFS-encrypted files to be burned. EFS-encrypted file(s) will be decrypted by EFS before being burned. If SEE-RS is set to encrypt all files, the files will be encrypted by SEE-RS before being burned to disc. Do you choose to continue?
You have selected some Encrypting File System
(EFS)–encrypted files to be burned. These files will be decrypted by EFS before they are burned. The files will be encrypted again by Removable Storage before they are burned if an encrypt all or encrypt new policy is in effect.
Click Yes to continue with the decryption of the EFS-encrypted files and the possible
(depending on your encryption policy) re-encryption by Removable Storage. To keep the EFS-encrypted files encrypted by EFS, click No.
Do you really want to stop the disc burning process?
You clicked the Stop Burn button after you started to burn data to a disc.
Click Yes to stop the disc burning process; click No to continue the disc burning process.
User Client Console
Table C-5
The User Client Console may generate error messages or prompts from time to time. The following table will help you figure out what to do in the event of an error.
User Client Console Messages
Severity Message Meaning Action
Please correct the items highlighted in red.
Password and Confirm password do not match.
Please enter values again.
The password you entered in the Default Password panel could not be saved because the values you entered in the New password and Confirm new
password fields do not agree or the value you entered in the New password field does not meet the password requirements. Alternatively, the
Default Password you entered could not be saved because it does not meet the password requirements.
Look for items highlighted in red to see what requires correction.
The Default Password you entered could not be saved because the values you entered in the
Password and Confirm password fields do not agree.
Look for items highlighted in red to see what requires correction.
Incorrect password. Please try again.
You supplied the wrong password when attempting to log on to the User Client Console.
Look for items highlighted in red to see what requires correction.
Please enter a password.
You clicked OK on the encryption password prompt, but did not enter and confirm a password.
Enter and confirm a password. You can avoid this message by specifying a Default
Password.
94 Error Messages & Prompts
User Client Console
Table C-5
Severity
User Client Console Messages (Continued)
Message
The certificate with serial number serial number is no longer available on this computer. It has been removed from the default certificates list.
Meaning
One or more of your Default Certificates are no longer stored on your machine.
The certificate issued by
issuer with serial number
serial number is no longer available on this computer. It has been removed from the default certificates list.
One or more of your Default Certificates are no longer stored on your machine.
Please close the
Administrator Client before launching the User Client.
The Administrator Client Console and the User
Client Console cannot both be open at the same time. The User Client Console cannot be opened because the Administrator Client Console is already open.
The maximum number of
Symantec Endpoint
Encryption user accounts has been reached on this computer. If you need an account, please contact your
Symantec Endpoint
Encryption client administrator.
You have attempted to register with Symantec
Endpoint Encryption, but there are no available slots for new users.
The default password was saved successfully.
The Default Password you set was saved successfully.
Action
You may want to make a note of the serial number of the certificate that was removed.
Otherwise, no action is required. The defunct certificates have been removed automatically.
You may want to make a note of the issuer and serial number of the certificate that was removed. Otherwise, no action is required.
The defunct certificates have been removed automatically.
Close the Administrator Client Console and then open the User Client Console.
Contact your Client Administrator.
Glossary
Authentication Method
Specifies how registered users and Client Administrators authenticate to Symantec Endpoint Encryption. Methods include password, token, password and token, or automatic. If the Policy Administrator changes the authentication method, registered users may be forced to re-register.
Authenti-Check
Allows users on endpoints to recover from forgotten credentials without help desk assistance. The user authenticates with a set of up to three question-answer pairs. Authenti-Check is not available to Client
Administrators.
Autologon
Allows Policy Administrators to remotely deploy software to computers protected by Full Disk. Software installations typically require several restarts, and Autologon allows pre-boot authentication to be bypassed, so that the computer does not require any credentials before loading Windows.
Automatic Authentication
Allows any registered user to launch the User Client Console. The registration process will be automatic and occur without user intervention—unless a registration password is required.
Client Administrator Provides local support to Symantec Endpoint Encryption users. Their main functions include unregistering users and recovering Removable Storage–encrypted files. Client Administrators cannot change their own passwords or use any password-recovery methods. Client Administrators must register as a user to make use of removable storage devices at the Removable Storage–protected workstation.
Client Database
The client database consists of a series of volume files and is part of the Symantec Endpoint Encryption file system.
Once the location of the client database files has been specified during the creation of the Client Computer installation packages and the installation has completed, these files must never be moved or disturbed.
Default Password/
Certificate
Registered users and Client Administrators have the option of setting a Default Password and/or Default
Certificate(s) in the User Client Console. Removable Storage will use Default Passwords and/or Default Certificates for encrypting files. In addition, if the Default Password and/or Default Certificate(s) set in the User Client Console match the password or certificate(s) that a file was encrypted under, Removable Storage will decrypt the file without a prompt.
Device Default Password
A password that can be used to encrypt and decrypt files written to and extracted from a removable storage device when using the Removable Storage Access Utility. This password allows you to define a password once so that you do not have to enter a password for every file and folder encrypted and decrypted during the session. The password can be set, changed, suspended, and reinstated at any time during the application session.
Device Session Default
Password
Grace Restarts
Lockout
A password used to encrypt and decrypt files on a removable device, as long as the device is connected and the user is logged on to Windows. This password is intended for kiosk environments, where users share a Windows account yet require the convenience of a Default Password. Password aging does not apply. This password does not apply to
CDs or DVDs.
A grace restart allows Windows to load without requiring the first user to register.
One-Time Password (OTP)
Program
Policy Administrator
A lockout occurs if a computer fails to check in with the Symantec Endpoint Encryption Management Server within the prescribed interval. Users cannot gain access to Windows. Only a Client Administrator can log on. A user may be able to regain access to the computer by using the One-Time Password (OTP) feature with help desk assistance.
The One-Time Password (OTP) Program allows users on Windows endpoints to recover from a forgotten password,
PIN, or token with help desk assistance. Users can also use the OTP program to regain access to their Windows computer after it has been locked for a failure to communicate with the Symantec Endpoint Encryption
Management Server. To complete the OTP process the user must contact the help desk.
Performs centralized administration of Symantec Endpoint Encryption. The Policy Administrator updates and sets client policies, and also runs reports.
Pre-Windows Environment The Pre-Windows environment loads upon reboot, before the Windows operating system. This environment helps protect the Client Computer’s hard disk s by requiring authentication before a user gains access to Windows.
Registration
The process wherein users set their credentials so that they can gain access to their removable storage devices and the User Client Console. Registration may be configured to occur with or without the user’s intervention. The first user is required to register after the designated number of grace restarts has expired.
96 Glossary
Re-Registration
Symantec Endpoint Encryption users may be required to re-register if a Policy Administrator issues a computer policy or installs an upgrade package that requires them to change their authentication method.
Self-Extracting Executables A feature of Removable Storage that allows any user of a Symantec Endpoint Encryption Removable Storage– protected workstation to create encrypted self-extracting executables for secure transport. Self-extracting executables can be decrypted from any computer, without any need for Removable Storage or the Removable Storage
Access Utility. The ability to produce self-extracting executables is prescribed by installation setting or policy on a per computer basis.
Session Default Password Registered users and Client Administrators may have the option of setting up to two Session Default Passwords in the User Client Console. Unlike a Default Password, Session Default Passwords can by configured by policy to be inactivated or deleted at the end of your Windows session. Removable Storage will use Session Default Passwords for encrypting files, instead of or in addition to the Default Password and Default Certificates. If the Session Default
Password matches the password used to encrypt a file, Removable Storage will decrypt the file without a prompt.
Single Sign-On (SSO)
Symantec Endpoint
Encryption Framework
If SSO is enabled, a user can authenticate once to the User Client Console in a Windows session, then close and relaunch the User Client Console without further authentication.
Provides Symantec Endpoint Encryption–wide features, such as authentication methods and settings, as well as registered user and Client Administrator accounts and information.
Symantec Endpoint
Encryption Password
Used by Client Administrators or Users to authenticate to the Administrator Client Console or User Client Console.
Temporary Data Directory
The CD/DVD Burner application will first attempt to store its temporary data directory on the drive of the operating system. It checks the TMP, the TEMP, and then the USERPROFILE environment variables in succession. It will use the first environment variable it finds. If none of these environment variables has been set, the CD/DVD Burner
Application will use the Windows directory.
Unregistration
User
The removal of a Symantec Endpoint Encryption registered user account, either manually by a Client Administrator or automatically by policy.
At least one user must register with Symantec Endpoint Encryption on each Windows Client Computer. A wizard guides the user through the registration process, which involves a maximum of five screens. The registration process can also be configured to occur without user intervention. Users Cannot access their removable storage devices until they have registered.
A
access policy
Authenti-Check 3, 17, 20, 21, 22, 25, 30
automatic authentication 2, 18
C
CD/DVD Burner
CD/DVD Burner application
certificate
D
decryption prompt
password 42, 85, 87 password/certificate 43, 85
Default Password
default passwords policy
allow device session default passwords 32
Device Default Password 62 about 62
set from encryption Options 69, 70
set or modify from decryption prompt 63
set or modify from File menu 62
E
encryption
prompt
password 39, 86 password/certificate 40, 86
encryption policy
CD/DVD only 1, 31, 32, 71 do not encrypt 32
Index
encrypt new 1, 31, 32, 93 per DLP for Endpoint 32
F
G
J
L
lockout
Check-In panel settings 22, 48, 50
N
navigation
P
password
Default 2, 3, 14, 17, 33, 85, 86, 91, 93, 94
Device Default 62, 63, 65, 66, 69, 70
Symantec Endpoint Encryption 3, 7, 17, 19, 27
Q
R
registered user
notification, grace restarts available 5
Removable Storage Access Utility
98 Index
not for Removable Storage computers 61
self-extracting files instead 47
S
self-extracting files
Session Default Password
T
token
U
User Client Console
Account Settings
logging on
Removable Storage
W
pre-existing unencrypted files 38
X
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Easy-to-use interface
High level of security
Self-extracting archive creation
Password and certificate-based encryption
Support for various removable storage devices
Device registration and password setup
On-demand file encryption/decryption
Frequently asked questions
The registration process is outlined in Chapter 2 of the viewed document. You can also find details on re-registration and default password expiration.
Chapter 4 of the viewed document explains the process of file encryption and decryption. You can encrypt files on demand, or you can use the self-extracting archive feature.
Refer to Chapter 6 of the viewed document for a detailed explanation of the removable storage access utility.
Chapter 7 of the viewed document provides instructions on how to burn a disc, including prerequisites and navigation steps.
Chapter 2 of the viewed document discusses the default password expiration process and the resulting warning messages.