CP ES Full Disk Encryption EW 7.4 InstallGuide

7/28/2019 CP ES Full Disk Encryption EW 7.4 InstallGuide

1/28

Endpoint SecurityFull Disk Encryption EW 7.4

Installation Guide

November 27, 2009


2/28


3/28

2003-2009 Check Point Software Technologies Ltd.

All rights reserved. This product and related documentation are protected by copyright and distributed under licensing restricting their use, copying,distribution, and decompilation. No part of this product or related documentation may be reproduced in any form or by any means without prior writtenauthorization of Check Point. While every precaution has been taken in the preparation of this book, Check Point assumes no responsibility for errors oromissions. This publication and features described herein are subject to change without notice.

RESTRICTED RIGHTS LEGEND:

Use, duplication, or disclosure by the government is subject to restrictions as set forth in subparagraph (c)(1)(ii) of the Rights in Technical Data andComputer Software clause at DFARS 252.227-7013 and FAR 52.227-19.

TRADEMARKS:

Please refer to http://www.checkpoint.com/copyright.html for a list of our trademarks.

For third party notices, see: http://www.checkpoint.com/3rd_party_copyright.html.
http://www.checkpoint.com/copyright.htmlhttp://www.checkpoint.com/3rd_party_copyright.htmlhttp://www.checkpoint.com/3rd_party_copyright.htmlhttp://www.checkpoint.com/copyright.html


4/28


5/28

Table of Contents i

Contents

Preface Introduction ...................................................................................................... 1Who Should Read This Guide? ............................................................................ 2

About This Guide............................................................................................... 2

Other Documentation ......................................................................................... 2

Contact Information ........................................................................................... 3

Feedback .......................................................................................................... 3

Chapter 1 Before You InstallIntroduction to This Chapter ............................................................................... 5

Overview of Installation and Deployment .............................................................. 5

About Full Disk Encryption Administrators............................................................ 6

Installing on Portable Computers......................................................................... 7

About Passwords................................................................................................ 7

Do Not Modify Pointsec for PC.msi Package ......................................................... 8

Before Installing ................................................................................................ 8

Read the Release Notes................................................................................. 8

Considerations for Other Programs.................................................................. 8

Changing Information Displayed in Preboot during Installation .......................... 9

Chapter 2 Installing for AdministratorsIntroduction to Installing .................................................................................. 11

Installing Full Disk Encryption on Windows Vista or Windows 7 ............................ 12

Registering Full Disk Encryption........................................................................ 13

Creating Administrator Accounts ....................................................................... 15

Administrator Accounts Using Fixed Passwords.............................................. 15

Protecting Volumes .......................................................................................... 16

Log File Created during Installation .............................................................. 17

Logging On for the First Time............................................................................ 17

Accessing Full Disk Encryption Management Console .......................................... 18

Installing Full Disk Encryption in an IBM RRU Environment ................................ 19

Running InstallRRU.msi after Installation ..................................................... 19

Log File Created during Installation .............................................................. 20Booting the System into IBM RRU................................................................ 20


6/28

ii


7/28

1

PrefacePPreface

In This Chapter

IntroductionFull Disk Encryption (FDE) is a policy-based, enterprise security software solution.

Full Disk Encryption combines boot protection, preboot authentication and strong

encryption to ensure only authorized users are granted access to information stored

in desktop and laptop PCs.

Full Disk Encryption is deployed and administered across the network. As

encryption is both automatic and transparent, security is enforced without requiring

special efforts from users.

Introduction page 1

Who Should Read This Guide? page 2

About This Guide page 2

Other Documentation page 2

Contact Information page 3

Note - Full Disk Encryption is designed to be first installed and

configured in a test environment comprised of an administrators

workstation and networked computers. Once the Full Disk Encryption

system has been thoroughly tested, it can be deployed to a production

environment.


8/28

Who Should Read This Guide?

2

Who Should Read This Guide?This guide is for IT staff who will work as Full Disk Encryption administrators. As a

Full Disk Encryption administrator, you should be well acquainted with yourorganizations network and operating procedure.

About This Guide

This guide is designed to help you install Full Disk Encryption for the first time asa preparatory installation. Once you have completed this preparatory installation,

you will need to create an installation profile and deploy it on all computers you

wish to protect with Full Disk Encryption, including the one where you installed this

preparatory installation.

This guide is organized as follows:

Chapter 1, Before You Installon page 5, which covers information that will help

you install Full Disk Encryption quickly and without problems

Chapter 2, Installing for Administratorson page 11, which takes you through

the process of installing Full Disk Encryption for use on an administrators

workstation.

Information on creating profiles, deploying them, administering

Full Disk Encryption protected computers and updating Full Disk Encryption

software can be found in the Full Disk Encryption Administrators Guide.

Other DocumentationApart from this installation guide, the following documentation is available:

Full Disk Encryption Release Notescontain the latest information on the current

Full Disk Encryption release.

Full Disk Encryption Administrators Guidedescribes how to perform administrative

tasks, for example, how to install and update Full Disk Encryption on client

computers using profiles and how to remove Full Disk Encryption.


9/28

Contact Information

Preface 3

Contact InformationIf you require information on Check Points other security products or services, or if

you should encounter any problems with Full Disk Encryption, please visit our website or call us.

FeedbackWe are engaged in a continuous effort to improve our documentation. Please help

us by sending your comments to:

[email protected]

TABLE P-1 Contact information

Area Technical Support Sales

Telephone: The Americas 972-444-6600 1-800-429-4391

International +972-3-6115100Web site: www.checkpoint.com
mailto:[email protected]?subject=Check%20Point%20User%20Guide%20feedbackhttp://www.checkpoint.com/mailto:[email protected]?subject=Check%20Point%20User%20Guide%20feedbackhttp://www.checkpoint.com/


10/28

Feedback

4


11/28

5

Chapter 1

Before You InstallIn This Chapter

Introduction to This ChapterThis chapter discusses some preparation items you should be aware of before you

install Full Disk Encryption.

Overview of Installation and DeploymentThe initial installation which is described in this document serves as a preparatory

installation which is used to create the installation profile that will later be used to

perform the real installation on the clients within your organization.

Introduction to This Chapter page 5

Overview of Installation and Deployment page 5

About Full Disk Encryption Administrators page 6

Installing on Portable Computers page 7

About Passwords page 7

Do Not Modify Pointsec for PC.msi Package page 8

Before Installing page 8

Do Not Modify Pointsec for PC.msi Package page 8


12/28

About Full Disk Encryption Administrators

6

The installation and deployment process can be summarized as described in this

table:

About Full Disk Encryption AdministratorsFull Disk Encryption administrators control the profiles that are used to install

Full Disk Encryption on client computers. When installing Full Disk Encryption, you

will create two administrator accounts. For more information on

Full Disk Encryption administrators, see the Full Disk Encryption Administrators

Guide.

Table 1-1 Summary of Full Disk Encryption installation and deployment

Step Description Read more about this in...

1 Create a preparatory installation on an

administrators PC. No encryption will be

carried out in this step.

This guide

2 Use the preparatory installation to create

an installation profile. Save the

installation profile in a secure location.

The Administrators Guide

3 Remove the preparatory installation from

the administrators PC.

The Administrators Guide,

the Windows Add/Remove

Programs section

4 Deploy the installation profile you have

created on the administrators computer

and on other client machines.

When the installation profile has been

successfully deployed, the specified disks

of the clients are encrypted.

The Administrators Guide


13/28

Installing on Portable Computers

Chapter 1 Before You Install 7

Installing on Portable ComputersIf you are installing Full Disk Encryption on a portable computer, we recommend

you connect the computer to the AC power supply. The time required to encrypt canvary depending on the size of the disk, what programs are running, and the speed

of the processor.

If the portable computers battery fails, Full Disk Encryption may not have

completed the encryption process. If this is the case, Full Disk Encryption will

continue the encryption process when the computer reboots.

About PasswordsBefore you start installing Full Disk Encryption, you should know something about

the types of passwords you will be asked to specify during the installation.

You can use the following types of passwords when installing Full Disk Encryption:

Fixed Passwords

Fixed passwords are set by users and can be changed by users. The system

administrators password policy controls the fixed password that users can use.

In Full Disk Encryption, a fixed password must contain at least four characters

but no more than 31.

For more information, see Administrator Accounts Using Fixed Passwords on

page 15 and the Full Disk Encryption Administrators Guide.

Dynamic Tokens

Dynamic tokens, also known as one-time passwords, change constantly. Usersuse a small device, usually called a dynamic token, to generate a new password

every time they start their workstations. Dynamic tokens are intended for

environments requiring better security than fixed passwords can provide where

password standards are not rigorous enough.

For more information, see the Full Disk Encryption Administrators Guide.

Smart Cards

Note - In a Common Criteria-validated environment, passwords with atleast eight characters should be used.


14/28

Do Not Modify Pointsec for PC.msi Package

8

Smart cards provide secure storage of user credentials and digital certificates.

Full Disk Encryption supports both smart cards with readers, and readerless

USB tokens.

For more information, see the Full Disk Encryption Administrators Guide.

Do Not Modify Pointsec for PC.msi PackageDo not modify the Pointsec for PC.msipackage in any way. For instance, do not

attempt to modify the Pointsec for PC.msipackage by using transforms. Modificationof the Pointsec for PC.msipackage invalidates the supportability of the product.

Before Installing

The following sections discuss information you need to know and things you needto check before you start to install Full Disk Encryption.

Read the Release Notes

The release notes contain the latest information on Full Disk Encryption. Read

them to find out what is new, fixed or changed. You can find the release notes on

your Full Disk Encryption CD or on the Check Point web site:http://www.checkpoint.com/.

Considerations for Other Programs

Consider the following:

Pointsec Media EncryptionIf Pointsec Media Encryption is already installed on the workstation on which

you want to install Full Disk Encryption, Single Sign On (SSO) will not work

properly.

To fix this, manually insert the following string value in Windows registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Pointsec Mobile Tech\Pointsec for

PC\CompatibleGinas=pme.dll


15/28

Changing Information Displayed in Preboot during Installation

Chapter 1 Before You Install 9

This action does not have to be taken if Pointsec Media Encryption is installed

after Full Disk Encryption.

Full Disk Encryption and Entrust

For information on Full Disk Encryption and Entrust installation and integration,

see the Full Disk Encryption Administrators Guide.

Changing Information Displayed in Preboot during

Installation

Full Disk Encryption enables you to change the Full Disk Encryption graphic images

displayed during preboot authentication to, for example, images containing your

companys logo. You can also change the license text displayed during installation.

To change images displayed in preboot authentication and/or the license text

displayed during installation:

1. Create a folder named oemvar in the product package folder called 1_Pointsec

for PC (the folder that contains the Pointsec for PC.msi file).2. Add the relevant files, described in Table 1-2 on page 10, to the oemvar folder.

During installation, the files that have been added to the oemvar folder will beregistered as the files to be displayed during preboot.


16/28

Changing Information Displayed in Preboot during Installation

10

Table 1-2 oemvar files

Filename Description Specifications

Banner.bmp Banner displayed duringinstallation, except for the

InstallShield progress dialog.

499w * 59h

256 colors

Banner.jpg Banner displayed in preboot.Note: The Jpeg images must be

created without EXIF file

information. Some pictureeditors, for example, Photoshop

3.0, automatically add EXIF

information to Jpeg images,

and these Jpeg files cannot be

used.

447w * 98h

Desktop.jpg Background image displayed in

preboot. Note: The Jpeg imagesmust be created without EXIF

file information. Some picture

editors, for example, Photoshop



and these Jpeg files cannot be

used.

800w * 600h

Scrsvr.jpg Preboot screen saver image.Note: The Jpeg images must be

created without EXIF file

information. Some picture

editors, for example, Photoshop



and these Jpeg files cannot beused.

260 * 128 (width * height)

Ssbg.bmp Windows screen saverbackground image.

1280 * 1024 (width * height)

256 colors

Lic_oem.rtf License text displayed ininstallation.

This is a rich text file.


17/28

11

Chapter 2

Installing for Administrators

Introduction to InstallingThis chapter documents how to install Full Disk Encryption for use by

Full Disk Encryption administrators, a so called preparatory installation.

The installation process can be divided into four phases:

Registering Full Disk Encryption on page 13

Creating Administrator Accounts on page 15

Protecting Volumes on page 16

Introduction to Installing page 11

Installing Full Disk Encryption on Windows Vista or Windows 7 page 12

Registering Full Disk Encryption page 13

Creating Administrator Accounts page 15

Protecting Volumes page 16

Logging On for the First Time page 17

Accessing Full Disk Encryption Management Console page 18

Installing Full Disk Encryption in an IBM RRU Environment page 19


18/28

Installing Full Disk Encryption on Windows Vista or Windows 7

12

Installing Full Disk Encryption on WindowsVista or Windows 7

The installation of Full Disk Encryption on Windows Vista or on Windows 7 follows

the same steps as the installations on Windows XP with one important difference.

The Full Disk Encryption installation on Vista or Windows 7 must be run with

administrators rights in order to install a special driver.

To start the Full Disk Encryption installation on Vista or Windows 7:1. Log on to Windows Vista or Windows 7 with an account that has administrator

privileges.

2. Insert the Full Disk Encryption CD into your disk drive and browse to the

autorun.exe file.

3. Right-click on the autorun.exe file and choose Run as administrator. An UserAccount Control window opens and asks for your permission to install the

program.

4. Click Continue to allow the installation to be run with administrator rights. The

License Information dialog box opens and you can continue with the

instructions in the following section, Registering Full Disk Encryption, from

step 3 on page 13 and onward.

Note - The relevant version of Microsoft .NET Framework is required to

be able to use the Pointsec PC Management Console (PCMC) on a

machine. See the Release Notesfor the relevant version or versions. If,however, the PCMC will not be used on a machine, it is not required to

install .NET on that machine.

R i t i F ll Di k E ti


19/28

Registering Full Disk Encryption

Chapter 2 Installing for Administrators 13


Registering Full Disk Encryption involves accepting the software license, confirming

that you have backed-up the workstation, and registering your license number.

To register Full Disk Encryption:1. Insert the Full Disk Encryption CD into your disk drive, or run Autorun.exe

located in the Full Disk Encryption folder in the product package. The following

dialog box opens:

Figure 2-1

2. Click Install. The InstallShield wizard prepares the installation.

The License Information dialog box opens.

3. Click Accept. (If you do not accept the license agreement, you cannot proceed.)

The ReadMe dialog box opens.

Note - In Windows Vista and Windows 7, you cannot run the msi

package directly from Full Disk Encryption CD-rom, you need tobrowse to the autorun.exe file on the CD, right-click on the file andchoose Run as administrator, see section Installing

Full Disk Encryption on Windows Vista or Windows 7 on page 12.

Note - If you run Windows Vista or Windows 7 on your workstation,

see the instructions in the previous section, Installing

Full Disk Encryption on Windows Vista or Windows 7, before

continuing the installation.



20/28


14

4. Select Yes, I want to read ReadMe.txt to read the latest information on

Full Disk Encryption before continuing with the installation. When you have

read the latest information on Full Disk Encryption, close the file to continue

with the installation process.5. Only when you are certain that the information on the workstation you are

installing on has been backed-up, click Next in the Welcome dialog box.

The following dialog box opens:Figure 2-2

6. Enter your details and license information. You can either enter your licence

number manually in the Serial number field or click the Insert button to import a

Check Point licence (.lic) file.

7. Click Next. The Add an administrator dialog box opens. You are now ready to

start the second phase of the installation and create the Full Disk Encryption

administrator accounts.

Note - As a safety precaution, always back up any computer before

installing Full Disk Encryption.

Creating Administrator Accounts


21/28

Creating Administrator Accounts


Creating Administrator AccountsIn this phase of the installation, you create Full Disk Encryption administrator

accounts and specify the types of passwords they use.

The accounts you create here are used for this preparatory installation only, and will

not be included in your final profile which will be deployed on the client machines

in your organization. You will specify the system administrator accounts for your

actual deployment later. For more information, see the Full Disk Encryption

Administrators Guide.

Administrator Accounts Using Fixed Passwords

Because the accounts that you specify during this step will not be included in your

final profile, you can use fixed passwords for your users at this point.

To create an administrator account that uses a fixed password:

1. In the Add an administrator dialog box, select the Fixed password option:

Figure 2-3

2. Enter the following information:

Table 2-1

Field Explanation

User account name Enter a name for the user account.

Password Enter a password for user account.

Verify Password Re-enter the password to confirm it.

ProtectingVolumes


22/28

Protecting Volumes

16

3. Click Next. The Add User dialog box opens again. Repeat the instructions above,

click Nextand then see Protecting Volumes on page 16.

Protecting Volumes

In this final phase of the installation, it is possible to specify the type of

Full Disk Encryption protection you wish to use and where to store recovery

information in the event of a disk crash.

However, these settings will be used for this preparatory installation only. They will

not affect the profile which you create from scratch later and will be used to deploy

Full Disk Encryption on the client machines in your organization. For this reason,

we recommend that you simply click Next through the wizard without specifying anyvolumes to protect or a recovery file path.

To protect volumes:

1. When prompted by the wizard, click Finish.

2. Click Yes to restart your workstation. Once restarted, the installation program

installs the Full Disk Encryption system code necessary and verifies the

volumes available. For example:Figure 2-4

During every start-up, Full Disk Encryption runs a suite of self tests to verifythat its integrity has not been compromised.

Note - When selecting volume protection, ensure that your settings are

compliant with your organizations internal security policy.

Log File Created during Installation


23/28

g g


Once Full Disk Encryption is completely installed, you will have to authenticate

yourself to access the PC.


While installing Full Disk Encryption, a log file containing the status of the

installation is written. It is located here (depending on where the Documents and

Settings folder is located):

For a Windows XP installation:

C:\Documents and Settings\All Users\Application Data\Pointsec\Pointsec forPC\Pointsec_PC_install_[COMPUTERNAME].log

For a Windows Vista and Windows 7 installation:

C:\Users\All Users\Pointsec\Pointsec for

PC\Pointsec_PC_install_[COMPUTERNAME].log

[COMPUTERNAME] is the name of the computer where Full Disk Encryption is

installed.

Logging On for the First TimeOnce Full Disk Encryption is installed, you must authenticate yourself before you

can access the workstation.

After restarting and installing the system code, Full Disk Encryption opens the User

Identification dialog box:

Accessing Full Disk Encryption Management Console


24/28

18

Figure 2-5

1. Enter the name and password of one of the administrator accounts you

specified during the installation, see Creating Administrator Accounts on

page 15.

2. Press the Tab key to move from one field to another. Click OK when you have

entered the correct account information.Once Full Disk Encryption has authenticated you, the operating system starts as

usual and you can log in to Windows.

Accessing Full Disk EncryptionManagement Console

To access Full Disk Encryption Management Console:

1. Click Start and browse to Programs Check Point. Select Endpoint Security

ManagementConsole.

2. When prompted, authenticate yourself. Full Disk Encryption Management

Console opens.

For more information on working in the Management Console, see the

Full Disk Encryption Administrators Guide.

Installing Full Disk Encryption in an IBM RRU Environment


25/28


Installing Full Disk Encryption in an IBMRRU Environment

To install Full Disk Encryption in an IBM Rapid Restore Ultra (RRU) environment,

you must run the installation package, InstallRRU.msi.

You can runInstallRRU.msi

by specifying it inprecheck.txt

before installation or

by manually running it after installing Full Disk Encryption as normal.

Running Using precheck.txt

To run InstallRRU.msi using precheck.txt:

1. Open precheck.txt and locate the RunAfter setting. Set RunAfter= to the pathto

InstallRRU.msi.We recommend that you use a path of max 8 characters,

without spaces or special characters, for example C:\P4PCINST\. Save thechanges to precheck.txt and close the file.

2. Install Full Disk Encryption as normal, reboot the computer and authenticate.

Once the computer has been rebooted, InstallRRU.msi is executed.

3. Press OK DONE. Full Disk Encryption is now installed with IBM RRU.

Running InstallRRU.msi after Installation

To run InstallRRU.msi after installation:

1. Install Full Disk Encryption as normal.

Note - RRU support is available up to version 3.0 of IBM RRU Versions

later than 3.0 may not work.

Note - If you want to do a silent installation, msiexec.exe can beused. The full search path must then be supplied. The normal

location for msiexec.exe is in the system32 directory, for example:

C:\Windows\System32\msiexec.exe /i C:Ppointsec\InstallRRU.msi

/q

Note - If there is an anti-virus application installed, ensure that

InstallRRU.msi is not stopped from running. If InstallRRU.msi isstopped by mistake, you should be able to run it manually

afterwards.



26/28

20

2. Run InstallRRU.msi when the installation is complete and the computer is upand running with Full Disk Encryption installed.


While installing Full Disk Encryption in an IBM RRU environment, a log file

containing the status of the installation is written. It is located here:X:\Program Files\Pointsec\P4PC_RRU.log

Booting the System into IBM RRU

To boot into IBM RRU:

1. Reboot the system, an IBM text is displayed prior to Full Disk Encryptionpreboot authentication (PBA), for example:

To interrupt normal startup press the blue Access IBM button

or

To boot to the IBM Rescue Recovery Environment, press F11

2. Full Disk Encryption PBA will be displayed. Authenticate to

Full Disk Encryption, the following information is displayed:

Pointsec loading operating system... To boot to the IBM Rescue

Recovery Environment, Press F113. Press F11. The system will now boot into IBM RRU.

Here you will have the option to restore from backup, etc. For more information,

see your IBM RRU documentation.

Note - If there is an anti-virus application installed, ensure that

InstallRRU.msi is not stopped from running. If InstallRRU.msi isstopped by mistake, you should be able to run it manually afterwards.

Note - Leave the system alone at this point. In order for the any of the

boot options to work, you first need to be authenticated byFull Disk Encryption. IBM RRU will start even if you have not been

authenticated but you will not be able to access the disk.


27/28


28/28

Worldwide Headquarters

Check Point Software Technologies, Ltd.

5 HaSolelim Street

Tel Aviv 67897, Israel

Tel: 972-3-753-4555Fax: 972-3-624-1100

email: [email protected]

U.S. Headquarters

Check Point Software Technologies, Inc.

800 Bridge Parkway

Redwood City, CA 94065

Tel: 800-429-4391; 650-628-2000Fax: 650-654-4233

www.checkpoint.com