startup guide
11 Install encryption software and configuration package on endpoint computers
1. Prepare endpoint computer for encryption.
2. To get to know Sophos SafeGuard, install the encryption software on a trial computer first.
Use a different computer than the one SafeGuard Policy Editor is installed on.
3. Log on for the first time.
4. Use your own tools to create and distribute the installation and configuration packages to centrally set up the encryption software on endpoint computers.
11.1 Prepare endpoint computers for encryption
■
Check if a user account is set up and active. The user needs to have a password.
■ Create a full backup of the data.
■ Close all open applications.
■
Make sure that you have Windows administrator rights.
■
Make sure that there is enough free hard disk space.
■ Sophos provides a hardware configuration list to minimize the risk of conflicts between the
POA and your computer hardware. The list is contained within the encryption software installation package.
We recommend that you install an updated version of the hardware configuration list on the endpoint computer before any significant deployment of Sophos SafeGuard. The file is updated on a monthly basis and made available to download from:
ftp://POACFG:[email protected]
For further information, see the Administrator Help, chapter Supported hotkeys in the POA.
See also:
http://www.sophos.com/support/knowledgebase/article/65700.html
.
■
Check the hard disk(s) for errors with this command:
chkdsk %drive% /F /V /X
In some cases you might be prompted to restart the computer and run chkdsk again. For further information, see:
http://www.sophos.com/support/knowledgebase/article/107081html
.
You can check the results (log file) in the Windows Event Viewer:
Windows XP: Select Application, Winlogon.
Windows 7, Windos Vista: Select Windows Logs, Application, Wininit.
■ Use the Windows built-in defrag tool to locate and consolidate fragmented boot files, data files, and folders on local volumes.
15
Sophos SafeGuard Disk Encryption, Sophos SafeGuard Easy
16
defrag %drive%
For further information, see:
http://www.sophos.com/support/knowledgebase/article/109226.html
■
Uninstall third party boot managers, such as PROnetworks Boot Pro and Boot-US.
■
We recommend that you clean the master boot record (MBR). To install Sophos SafeGuard you need a clean, unique MBR. If you have used an imaging/cloning tool on the endpoint computer, it might no longer be clean.
Start the computer from a Windows DVD and use the command FIXMBR within the Windows
Recovery Console. For further information, see:
http://www.sophos.com/support/knowledgebase/article/108088.html
■ If the boot partition on the endpoint computer has been converted from FAT to NTFS and the computer has not been restarted since, restart the computer once before Sophos SafeGuard is installed. Otherwise the installation might not be completed because the file system was still
FAT at the time of installation while NTFS was found when it was activated.
11.2 Carry out a trial installation
Carry out the trial installation of the encryption software on a different computer than the one
SafeGuard Policy Editor is installed on.
1. Prepare for installation on the endpoint computers,
see Prepare endpoint computers for encryption
(page 15).
2. Log on to the endpoint computer as an administrator.
3. Install the pre-installation package SGxClientPreinstall.msi that provides the endpoint computer with the necessary requirements for a successful installation of the encryption software.
4. Install the encryption software on the endpoint computer: Double-click one of the following packages (MSI) to start the encryption software installation wizard. It guides you through the necessary steps.
Sophos SafeGuard Disk Encryption
SDEClient.msi for the 32 bit variant or
SDEClient_x64.msi for the 64 bit variant.
Sophos SafeGuard Easy
SGNClient.msi for the 32 bit variant.
SGNClient_x64.msi for the 64 bit variant.
5. Accept the defaults on the subsequent dialogs.
6. If prompted, select the install type Complete.
Sophos SafeGuard Easy: SafeGuard Device Encryption and additionally SafeGuard Data
Exchange are installed. For information on further available "Client" installation packages, see the Administrator Help, chapter Installation.
Sophos SafeGuard Disk Encryption: SafeGuard Device Encryption is installed. SafeGuard
Data Exchange is not available.
startup guide
7. Accept the defaults on all subsequent dialogs to complete the installation wizard.
8. Go to the location where you have saved the previously created configuration package (MSI).
9. Install this configuration package on the endpoint computer. Make sure that you delete all outdated configuration packages on the endpoint computer.
Sophos SafeGuard is installed and configured according to the previously created policies on the endpoint computer. Next log on to the computer for the first time after installation, either for post-installation tasks (using a service account) or to take ownership of the computer (as a normal user).
Additional configuration may be required to ensure that the POA functions correctly on each hardware platform. Most hardware conflict issues can be resolved using the Hotkeys feature built into the POA. Hotkeys can be configured after installation in the POA or using an additional configuration setting passed to the msiexec deployment tool. For further information, see the
Administrator Help, section Supported hotkeys in the POA. Also see:
http://www.sophos.com/support/knowledgebase/article/107781.html
http://www.sophos.com/support/knowledgebase/article/107785.html
11.3 Log on for the first time using a service account
Log on with a service account if you want to carry out post-installation tasks on the computer.
1. Restart the endpoint computer after installation. The Windows logon is displayed.
On Windows Vista and Windows 7 you first have to press CTRL+ALT+DEL to start logon.
The administrator can deactivate this setting in the MMC console in the group policy object editor under Windows Settings > Security Settings > Local Policies > Deactivate Security
Options (for interactive logon, CTRL+ ALT+ DEL is not required).
2. Log on to Windows using the service account: Enter the domain and credentials as previously defined in the service account list in SafeGuard Policy Editor.
You are logged on to Windows as a guest user. The Power-on Authentication is not activated and you are not assigned as owner to this computer. You can carry out post-installation tasks as required.
11.4 Log on for the first time without a service account
1. Restart the computer. The Sophos SafeGuard Autologon is displayed, then the Windows logon is displayed.
On Windows Vista and Windows 7 you first have to press CTRL+ALT+DEL to start autologon and logon. The administrator can deactivate this setting in the MMC console in the group policy object editor under Windows Settings > Security Settings > Local Policies > Deactivate
Security Options
(for interactive logon, CTRL+ ALT+ DEL is not required).
17
Sophos SafeGuard Disk Encryption, Sophos SafeGuard Easy
2. Enter your Windows user name and password.
3. Restart the computer for a second time. The Sophos SafeGuard Power-on Authentication is activated.
4. Enter your Windows user name and password. You are automatically logged on to Windows.
The Power-on Authentication is now activated. You are registered as a Sophos SafeGuard user.
A balloon tool tip confirming this is displayed. Next time you log on you only need to enter your Windows credentials at the Power-on Authentication.
Initial encryption starts automatically. You may continue working and do not need to restart the computer after encryption is completed. Encryption and decryption work transparently without any user interaction. For further information, see the User Help (chapters First logon after Sophos
SafeGuard installation, and Data Encryption).
11.5 Install the encryption software and configuration packages with a script
1. Prepare for installation on the endpoint computers,
see Prepare endpoint computers for encryption
(page 15).
2. Log on to the administrator computer as an administrator.
3. Create a folder called Software to use as a central store for all applications.
18
startup guide
4. Use a software deployment tool such as Microsoft System Center Configuration Manager, IBM
Tivoli, or Enteo Netinstall to carry out central installation on the endpoint computers. The following must be included in the order mentioned:
Option
Package
Pre-installation package
SGxClientPreinstall.msi
Description
Description
The package provides the endpoint computers with the necessary requirements for a successful installation of the encryption software.
Note:
If this package is not installed, installation of the encryption software is aborted.
Encryption software installation package <Client>*.msi
Depending on your product and operating system, different installation packages are available. For Windows 7 and
Windows Vista, for example you may install the *_x64.msi
package variant. You will find all available <Client> installation packages in your product delivery.
Note:
For information on all available <Client> installation packages, see the Administrator Help, chapter Installation.
Configuration package for endpoint computers
Script with commands for pre-configured installation
Use the configuration package created before in SafeGuard
Policy Editor. Make sure that you delete all outdated configuration packages.
We recommend that you use the Windows Installer command-line tool msiexec to create the script. For further information, see the Administrator Help, chapter Command
for central installation or see:
http://msdn.microsoft.com/en-us/library/aa367988(VS.85).aspx
5. To create the script, open a command prompt, and then type the scripting commands. For further information,
see Scripting command sample
(page 20).
6. Distribute the pre-install, "Client" package and configuration package and the script to the endpoint computers using company software distribution mechanisms.
The packages are executed on the endpoint computers.
Sophos SafeGuard is installed and configured according to the previously created policy configuration on the endpoint computers. A key recovery file needed for recovery is created for each endpoint computer in the location defined during SafeGuard Policy Editor first-time configuration.
19
Sophos SafeGuard Disk Encryption, Sophos SafeGuard Easy
Additional configuration may be required to ensure that the Power-on Authentication (POA) functions correctly on each hardware platform. Most hardware conflict issues can be resolved using the Hotkeys built into the POA. Hotkeys can be configured after installation in the POA or by an additional configuration setting passed to the Windows Installer command msiexec. For further information, see the Administrator Help, section Supported hotkeys in the POA. Also see:
http://www.sophos.com/support/knowledgebase/article/107781.html
http://www.sophos.com/support/knowledgebase/article/107785.html
11.6 Scripting command sample
msiexec /i F:\Software\Sophos\SafeGuard\SGxClientPreinstall.msi
/qn msiexec /i F:\Software\Sophos\SafeGuard\SDEClient.msi /qn
/L*VX G:\Temp\Sophos\SafeGuard\%computername%_SDEClient_inst.log
Installdir=C:\Program Files\Sophos\Sophos SafeGuard msiexec /i F:\Software\Sophos\SafeGuard\SDEClientConfig.msi /qn
20
startup guide
The command has the following effect:
■
msiexec /i F:\Software\Sophos\SafeGuard\SGxClientPreinstall.msi
■
Installs the Sophos SafeGuard pre-installation package from the specified storage location to the default installation directory C:\Program Files\Sophos\Sophos SafeGuard. The endpoint computers are provided with the necessary requirements for successful installation of the encryption software.
msiexec /i F:\Software\Sophos\SafeGuard\SDEClient.msi
Installdir=C:\Program Files\Sophos\Sophos SafeGuard
Installs encryption software, in this case SafeGuard Device Encryption with Power-on
Authentication from the specified storage location to the default installation directory
C:\Program Files\Sophos\Sophos SafeGuard.
■
msiexec /i F:\Software\Sophos\SafeGuard\SDEClientConfig.msi
■
Installs the configuration package from the specified storage location to the default installation directory.
/L*VX
G:\Temp\Sophos\SafeGuard\%computername%__SDEClient_inst.log
■
Logs all warnings and error messages in the specified log file on the network and creates a log file to review the encryption process from a central location that can be analyzed using the
Windows Installer tool wilogutl.exe.
/qn
Installs without user interaction and does not display a user interface.
21
