Yale Software Library

Transcription

1 e/ Yale Software Library For assistance contact the ITS Help Desk or Installation PGP Desktop for Windows Operating Systems Preparing your computer: Export current PGP Keys If you have encrypted files on your local device and are upgrading to newer version of PGP or migrating to a new machine you will need to export your current keys in order to access encrypted files that maybe transferred to the new device Install all Windows Security Patches. Make sure you have installed all Windows updates prior to installing PGP Desktop, including the Service Packs. Check Power Settings Ensure that the computer is not configured to sleep or hibernate Close all running applications and turn off all applications that run at start up. Backup your data Before you encrypt your disk, be sure to back it up so that you will not lose any data if your laptop or computer is lost, stolen, or you are unable to decrypt the disk. You can do so by using the ITS backup service, saving files to flash drive, CD, networked drive or removable disk. Defragment your drive To do so, on the Start menu, click Programs > Accessories >System Tools, and Disk Defragmenter. Click the Analyze button; a report will appear telling you whether or not defragmentation is recommended. If it is, click the Defragment button to begin; if not, close Disk Defragmenter and any other application to begin. On Windows 7 devices, disable the scheduled disk defragmenter task To do so, on the Start menu, click All Programs > Accessories > System Tools > Disk Defragmenter. Choose Configure Schedule, and then uncheck Run on a schedule (recommended). Leave this unchecked, once the device is encrypted Symantec (PGP) recommends against defragmenting the disk. Check Power and network connections Because encryption is a CPU intensive process, encryption cannot begin on a laptop computer that is running on battery power. It is also required that the device has an active (wired is preferred) network connection during the installation Changes in this version User name and domain in PGP BootGuard. Now requires that you authenticate at PGP BootGuard with your user name and domain (on Windows systems). The PGP BootGuard screen displays fields for you to enter your user name, domain, and passphrase. System requirements: Windows XP Professional 32 bit (Service Pack 3) Windows XP Professional 64 bit (Service Pack 3) Microsoft Windows XP Tablet PC Edition 2005 (requires attached keyboard) Windows Vista (all 32 and 64 bit editions,including Service Pack 1 and 2) Windows 7 SP1 (all 32 and 64 bit editions) Windows Server 2003 SP 2 (32 and 64 bit editions Windows Server bit SP 1 and 2 Windows Server 2008 R2 64 bit Minimum of 2GB of RAM 128 MB hard disk space Administrative privileges on the machine Page 1 of 11

2 Incompatibilities: Certain programs and hardware are incompatible with this version of PGP Desktop. Do not install these products on a system with PGP Desktop, and do not install PGP Desktop on a system with these products installed. Acronis Disk Director for external disks Aladdin etoken PRO Java 72K token with PGP WDE and single sign on. Any third party software that could bypass, modify or write to Master Boot Record (MBR) AVG Antivirus 9.0 BitDefender Internet Security CommVault System Data Migrator Computer Associates etrust EZ Antivirus 7.x Computer Associates Internet Security Suite 2007 CyberArmor Personal Firewall Encryption Anywhere Hard Disk Encryption Plus Hard Disk products Faronics Deep Freeze (any edition) F Secure AntiVirus F Secure Internet Security GemXpresso Smartcards Google Desktop, if index mail option is enabled Hard disk encryption products from GuardianEdge Technologies Lenovo Ideapad S10 2 systems running Microsoft Windows XP PC Guardian products Safeboot Solo co exists on the system but blocks PGP WDE SecureStar SCPP co exists on the system but blocks PGP WDE Securewave Sanctuary Device Control Sony VAIO laptops running Windows XP T Systems TCOS smart card USB 3.0 host controller ports for the use of ETokens Utimaco Safeguard Easy 3.x Wave Systems' Dell Embassy Trust Suite Webroot Desktop Firewall Zone Alarm Personal Firewall Hard drives with a sector size other than 512 bytes Other Known Issues (for full list please refer to PGP Desktop 10.2 release notes) Operating system updates during encryption. While your disk is encrypting, do not accept any operating system updates if they are offered. If the update occurs automatically, do not restart your computer until the encryption process has completed. Upgrading. The PGP BootGuard screen is not updated immediately after you upgrade to PGP Desktop To display the updated PGP BootGuard screen (containing new login and keyboard options), reboot your system a second time Using numeric keypads. Numeric keypads are not supported when creating and/or entering PGP BootGuard passphrases. Do not hibernate during encryption or decryption. If you receive a "Windows Resume Warning" that "your system's firmware did not preserve the system memory map across the hibernation transition," you can choose to resume the system. Note that this is a warning and is not a blue screen. This issue does not occur on Windows XP systems. Page 2 of 11

3 PGP WDE and SSO: If you encounter problems with synchronizing a Windows password change on a Windows XP system, follow the steps to correct the issue a) On your Windows Desktop, right click My Network Places and select Properties from the shortcut menu. b) Select Advanced > Advanced Settings. c) Select the Provider Order tab. d) Rearrange the order of the providers so PGPpwflt is listed above the Intel card. e) Click OK. You can also modify the.msi installation file. Use the PGP_SET_HWORDER=1 command to place PGPpwflt in the first of the list. For example, run the.msi installation file using the following command: msiexec /i pgpdesktop.msi PGP_SET_HWORDER=1 Using CHKDSK. CHKDSK may report errors in a file called PGPWDE01 when checking a disk that has been encrypted with PGP Whole Disk Encryption. This file is protected by PGP Whole Disk Encryption and such errors can be ignored. Hibernating on Windows 7 and Windows Vista systems. You might run into problems with hibernation after you encrypt your disk. When that happens, simply delete the hibernation file on resume and continue to boot into Windows. This problem will only occur once after encryption. To avoid the problem, do a reboot after disk encryption is done. Backwards compatibility. Disks encrypted with this version of PGP WDE can only be accessed with this same version of PGP WDE for Mac OS X or versions and up of PGP WDE for Windows Passphrase Recovery Passphrase recovery is only available for encrypted boot disks. Passphrase Recovery. If you use the Forgot Passphrase option at the PGP BootGuard screen and enter an incorrect user name, you will need to click Cancel to return to the PGP BootGuard screen and then select Forgot Passphrase again. PGP WDE and Smart Card Readers. Pre boot authentication using a smart card reader is not currently supported on Panasonic Toughbook and Sony Vaio P Series Mini systems PGP WDE and SSO. When you add an SSO user to PGP WDE, be sure that there are no leading spaces in the user's name (for example, " acameron"). If the SSO user's name has a leading space, you will receive an error message that there was a login failure PGP WDE and USB Two Factor Authentication. If you have created a passphrase user with a USB flash drive and encrypted your boot disk, when you reboot you may find that the USB device is not recognized at the PGP BootGuard screen. You can still authenticate at the PGP BootGuard screen using just the passphrase, however. If you want to use two factor authentication, you will need to decrypt your disk, then create another passphrase user using another USB flash device, and then re encrypt your boot disk. Using PGP WDE Protected Removable Disks with PGP Desktop 9.x and Disks encrypted with PGP Desktop 9.0, 9.5, or 9.6 can be used on a PGP Desktop 9.7 or later system, and work as expected. However, if you make any changes to the disk using PGP Desktop 9.5 or 9.6 software (such as changing the passphrase, adding or removing users, and so on), the disk will no longer function on the PGP Desktop 9.0 system. Disk Recovery Best Practice. If you need to perform any disk recovery activities on a disk rotected with PGP Whole Disk Encryption (WDE), Symantec Corporation recommends that you first decrypt the disk (by using the PGP Desktop Disk > Decrypt option, your prepared PGP WDE Recovery Disk, or by connecting the hard disk via a USB cable to a second system and decrypting from that system's PGP Desktop software). Once the disk is decrypted, proceed with your recovery activities. Using PGP WDE with Norton Ghost 9 or 10. Ghost is compatible with fully encrypted disks. Ghost sometimes exhibits errors when used to make backups within the Windows OS of partially encrypted disks. To recover from an error like this, reboot the system and perform a Windows chkdsk when the system restarts. Ghost should be functional again. Compatibility of older version PGP WDE recovery disks. PGP WDE recovery disks are compatible only with the version of PGP Desktop that created the recovery CD. For example, if you attempt to use a 9.0 recovery disk to decrypt a disk protected with PGP WDE version 9.5 or later, it will render the PGP WDE disk inoperable Page 3 of 11

4 Using PGP WDE on Dell XT2 Tablet PCs EISA recovery partitions existing on the Dell Latitude XT2 Tablet PCs are displayed as an Unknown partition when viewed in PGP Universal Server. Use of the CTRL, Rotate Screen, and Tool/Settings buttons on the Dell Latitude XT2 Tablet PC while the PGP BootGuard screen is displayed results in a PGP BootGuard halting unexpectedly. Use of the PGP WDE Recovery CD with a virtual keyboard is not supported in this release. A physical keyboard is supported PGP WDE and Dell systems boot diagnostics: (Dell systems only) Advanced boot diagnostics that are normally accessible by pressing F12 during the boot process are not available on disks encrypted with PGP WDE. To run advanced boot diagnostics using F12, first decrypt the disk, and then run diagnostics Installation Process 1. Go to the Yale Software Library, located at 2. Locate the PGP software (Data Encryption) and click to begin downloading, save the.msi file to your desktop. 3. Close all other programs you are currently running. 4. Double click on the PGP.msi file to begin the installation. 5. Read the licensing agreement, select I accept the licensing agreement, and click Next. 6. The release notes screen will appear, select Do not display the Release Notes, and click Next The installer will start copying files into place. Click Yes to reboot. Once the computer has rebooted, the PGP Setup Assistant should automatically appear: Enter your Yale NetID and password. Page 4 of 11

5 The enrollment process will verify your credentials Select I am a new user, click Next. Click Next. Page 5 of 11

6 Select New Key, Click Next Enter your Yale NetID password in both windows and Click Next. You will be prompted to answer 5 security questions. This will enable you to regenerate your key at a future date. These questions are selectable and can be personalized. Page 6 of 11

7 Continue answering the questions and clicking Next until you have answered them all. The Key Generation Progress window will appear and show your progress, upon completion you will see: Click Next Your PGP public key has been created and stored on the Universal Server and your private key has been saved on your machine. Click Next The PGP Whole Disk Encryption Assistant will now begin. Page 7 of 11

8 Click Next. You will be prompted to create credentials for Single Sign on (SSO). These fields should be populated with the correct information. If the device is bound to the domain: User name is your Yale NetID: Domain name is YALE, Password is your netid password If this device is not bound to the domain: User name is your local account name: Domain name is machine name, Password is the local account password Click OK Page 8 of 11

9 Click Next Click Finish A pop up message will appear indicating that encryption has started. Along with a padlock in your task menu bar indicating that Whole Disk Encryption is in progress Page 9 of 11

10 The program will automatically begin to encrypt the disk. Encryption will run in the background and you can continue to use your machine but applications will run a bit slower than you are used to when encryption is taking place. Note: Encryption time is dependent upon the size of your drive and the speed of your machine. If necessary, you can shut down the computer (Start > Shutdown > Turn off computer) but DO NOT abruptly power off the system. Checking Encryption Status If you want to check the encryption status of the drive, Open PGP Desktop, right clicking on the PGP Icon in your task Menu and Select Open PGP Desktop Choose Encrypt Disk or Partition Page 10 of 11

11 This will display the estimated time to completion or if the drive is fully encrypted. Page 11 of 11