Eeff 410 Product Guide en Us PDF

Product Guide
McAfee Endpoint Encryption for Files and Folders 4.1

For use with ePolicy Orchestrator 4.6 Software
COPYRIGHT
Copyright 2012 McAfee, Inc. Do not copy without permission.
TRADEMARK ATTRIBUTIONS
McAfee, the McAfee logo, McAfee Active Protection, McAfee AppPrism, McAfee Artemis, McAfee CleanBoot, McAfee DeepSAFE, ePolicy Orchestrator, McAfee ePO, McAfee EMM, McAfee Enterprise Mobility Management, Foundscore, Foundstone, McAfee NetPrism, McAfee Policy Enforcer, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, SmartFilter, McAfee Stinger, McAfee Total Protection, TrustedSource, VirusScan, WaveSecure, WormTraq are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others.
LICENSE INFORMATION License Agreement

NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
Product Guide
Contents
Preface
About this guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Find product documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5
5 5 5 6
Introduction
Purpose of EEFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 How EEFF works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Installing the EEFF client

System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Check in the EEFF software package . . . . . . . . . . . . . . . . . . . . . . . . . . Install the EEFF extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Install the Help extension . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Register Windows Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . Deploy EEFF to managed systems . . . . . . . . . . . . . . . . . . . . . . . . . . .
9
9 10 11 11 11 12
Configuring EEFF policies

EEFF policy settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Create a policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Edit the EEFF policy settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Assigning policies to a system or a system group . . . . . . . . . . . . . . . . . . . . . Assign a policy to a managed system . . . . . . . . . . . . . . . . . . . . . . . Assign a policy to a system group . . . . . . . . . . . . . . . . . . . . . . . . Enforce EEFF policies on a system . . . . . . . . . . . . . . . . . . . . . . . . . . . Enforce EEFF policies on a system group . . . . . . . . . . . . . . . . . . . . . . . . How policy assignment rules work . . . . . . . . . . . . . . . . . . . . . . . . . . . Policy assignment rule priority . . . . . . . . . . . . . . . . . . . . . . . . . Working with policy assignment rules . . . . . . . . . . . . . . . . . . . . . . How multi-slot policies work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Assign multiple instances of Grant Key policy through the System Tree . . . . . . . . . Assigning Grant Key policy through policy assignment rules . . . . . . . . . . . . . . View the policies assigned to systems . . . . . . . . . . . . . . . . . . . . . . View the policies assigned to users . . . . . . . . . . . . . . . . . . . . . . .
15
16 21 22 22 22 23 23 23 24 24 25 26 26 26 27 28
Managing EEFF keys

Encryption keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Create an encryption key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Activate or deactivate the encryption keys . . . . . . . . . . . . . . . . . . . . . . . . Assign the encryption keys to a policy . . . . . . . . . . . . . . . . . . . . . . . . . Edit an encryption key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Delete an encryption key . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Export the encryption keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
29
29 30 30 30 31 31 31
Product Guide
Contents
Import the encryption keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 How user personal keys work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Working with user personal keys . . . . . . . . . . . . . . . . . . . . . . . . 33
Managing EEFF reports

EEFF queries and query results . Create EEFF custom queries . . View standard EEFF queries . . EEFF client events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
35
35 36 37 37
Defining EEFF permission sets for McAfee ePO users
39
Create permission sets for user accounts . . . . . . . . . . . . . . . . . . . . . . . . 39 Edit the EEFF policy permissions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 Edit the EEFF key server permissions . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Additional Information
Uninstalling EEFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Uninstall EEFF from managed systems using McAfee ePO . . . . . . . . . . . . . . . Remove the EEFF extension . . . . . . . . . . . . . . . . . . . . . . . . . . Remove the EEFF software package . . . . . . . . . . . . . . . . . . . . . . . Uninstalling EEFF from managed systems . . . . . . . . . . . . . . . . . . . . . Removable media registry controls . . . . . . . . . . . . . . . . . . . . . . . . . . . Broaden the removable media definition . . . . . . . . . . . . . . . . . . . . . Exempt local drives and network shares from encryption . . . . . . . . . . . . . . . Best practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Key caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Tune encryption intensity for network . . . . . . . . . . . . . . . . . . . . . . Explicitly encrypt large shares in advance . . . . . . . . . . . . . . . . . . . . . Exclude EEFF client program directory . . . . . . . . . . . . . . . . . . . . . .
41
41 41 42 42 43 43 43 44 44 45 45 45 45
Index
47
Product Guide
Preface
This guide provides the information you need to configure, use, and maintain your McAfee product. Contents About this guide Find product documentation
About this guide

This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized.
Audience
McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Users People who use the computer where the software is running and can access some or all of its features.
Conventions
This guide uses these typographical conventions and icons. Book title, term, emphasis Bold User input, code, message Interface text Hypertext blue Title of a book, chapter, or topic; a new term; emphasis. Text that is strongly emphasized. Commands and other text that the user types; a code sample; a displayed message. Words from the product interface like options, menus, buttons, and dialog boxes. A link to a topic or to an external website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product.
Product Guide
Preface Find product documentation
Find product documentation

McAfee provides the information you need during each phase of product implementation, from installation to daily use and troubleshooting. After a product is released, information about the product is entered into the McAfee online KnowledgeBase. Task 1 2 Go to the McAfee Technical Support ServicePortal at http://mysupport.mcafee.com. Under Self Service, access the type of information you need: To access... User documentation Do this... 1 Click Product Documentation. 2 Select a product, then select a version. 3 Select a product document. KnowledgeBase Click Search the KnowledgeBase for answers to your product questions. Click Browse the KnowledgeBase for articles listed by product and version.
Product Guide
Introduction
McAfee Endpoint Encryption for Files and Folders (EEFF) 4.1 offers data protection in the form of powerful encryption technology, so only authorized users can access information. Contents Purpose of EEFF How EEFF works Features
Purpose of EEFF
EEFF enables you to define and protect your data so that only certain users can access it. This data is stored, managed, archived, and distributed, and can be viewed only by authorized users. This protection depends on Microsoft Windows user accounts and works in realtime to authenticate the user, to access the encryption keys, and to retrieve the correct policy in EEFF. A smart card implementation based on Windows logon provides for enhanced security.
How EEFF works

EEFF encrypts files and folders as per the policies assigned to users. These policies are enforced by the McAfee ePO server. EEFF acts as a Persistent Encryption engine. When a file is encrypted and is moved or copied to another location, it remains encrypted. If it is moved out of an encrypted directory, it still remains encrypted. Integrated with McAfee ePolicy Orchestrator (McAfee ePO), EEFF provides a single point of control over the data on all systems, and supports both user and systembased policies. EEFF depends on Microsoft Windows credentials, thus both registered domain users and local system users can be assigned encryption policies and associated keys. Assigning these policies to users encrypts the data on the client. Userbased policy assignments can be assigned only to registered domain users. The EEFF client is installed on the managed system, then the system synchronizes with the McAfee ePO server and acquires the user data. EEFF then assigns encryption policies and keys to the user. EEFF client acts like a filter between the application creating or editing the files and the storage media. When a file is saved, the EEFF filter executes the assigned encryption policies and encrypts the data, if applicable.
Product Guide
Introduction Features
When a user attempts to deviate from the assigned encryption policy by stopping the main EEFF process (MfeffCore.exe) on the client system, the process is automatically regenerated. The automatic restart cannot be disabled. If the user manages to stop the main EEFF process on the client system, EEFF encrypts folders and files according to the policies assigned to the user. These policies are enforced by the McAfee ePO server. When a file that is encrypted with key A is moved to a folder where the files encrypted with key B are available, the file that is encrypted with key A is instantly reencrypted with key B. This process is known as followtargetencryption; it requires that the user or process transferring the file have access to both key A and key B.
Features
These are the key features of EEFF. Centralized management Provides support for deploying and managing EEFF using McAfee ePO software 4.6 (minimum Patch 2). Windows authenticationbased policy enforcement Assigns encryption policies and keys to Windows user accounts. Integration with the McAfee tray icon Consolidates the tray icons into one common McAfee icon. User Personal Key Allows users to have individual encryption keys that are generated from the McAfee ePO server, which the administrator can assign to policies to enable encryption. Protect data on removable media Removable media encryption, including the ability to access encrypted content in systems where EEFF is not installed. Network encryption Enables secure sharing and collaboration on Network Shares. User initiated encryption of files and email attachments Allows users to create and attach passwordencrypted executable files that can be decrypted on systems where EEFF is not installed. Migration from EEFF v3.x to EEFF 4.1.0 Migrating encryption keys from the previous version of the product to the current version, by importing them into the McAfee ePO server.
Product Guide
Installing the EEFF client
The McAfee ePO server provides a scalable platform for centralized policy management and enforcement of EEFF on the managed nodes. It also provides comprehensive reporting and product deployment capabilities, all through a single point of control. The EEFF software packages and extensions need to be checked into the McAfee ePO server before you can deploy the software and configure the policies.
This guide does not provide detailed information about installing or using McAfee ePO. For more details, refer to the ePolicy Orchestrator product documentation.
Contents System requirements Check in the EEFF software package Install the EEFF extension Install the Help extension Register Windows Active Directory Deploy EEFF to managed systems
System requirements
Make sure that your client and server systems meet these requirements. Table 2-1 System requirements Systems McAfee ePOserver systems Client systems Requirements See the McAfee ePO product documentation. CPU: 1 GHz or faster RAM: 1 gigabyte (GB) RAM (32bit) or 2 GB RAM (64bit) Hard disk: 50 MB minimum free disk space TCP/IP network connection
Product Guide
Installing the EEFF client Check in the EEFF software package
Table 2-2 Software requirements Software (or package name) McAfee management software Requirements McAfee ePolicy Orchestrator 4.6 (minimum Patch 2) McAfee Agent for Windows 4.6 (minimum Patch 2) Endpoint Encryption for Files and Folders EEFF extension EEFFextension4.1.0_xxx.ZIP help_eeff_410.ZIP MfeEEFF_Client_4.1.0.x.ZIP Microsoft Windows Installer 3.0 Redistributable package (for ePO) Microsoft .NET Framework 2.0 Redistributable package (for ePO) Microsoft MSXML 6 (for ePO) Table 2-3 Operating system requirements Systems McAfee ePO server systems Client systems Software See the McAfee ePO product documentation. Microsoft Windows Vista (Business, Ultimate, or Enterprise) SP 2 (32bit only) Microsoft Windows XP Professional, SP 3 (32bit only) Microsoft Windows 7 (Professional, Ultimate, or Enterprise), SP 1 (32bit and 64bit) See the McAfee ePO product documentation. See the McAfee ePO product documentation. See the McAfee ePO product documentation.
Check in the EEFF software package

The software package needs to be checked in to the master repository on the McAfee ePO server so that you can deploy the software to the client system. Task 1 2 3 4 5 Copy the MfeEEFF_Client_4.1.0.x archive to a temporary location. Log on to the McAfee ePO server as an administrator. Click Menu | Software | Master Repository | Actions | Check In Package. The Check In Package wizard appears. On the Package page, select the Package type as Product or Update (.ZIP), browse to locate the product archive that you saved in a temporary folder, then click Next. On the Package Options page, click Save.
10
Product Guide
Installing the EEFF client Install the EEFF extension
Install the EEFF extension

You need to install the EEFF extension into the repository on the McAfee ePO server before you can define and enforce product policies. Task 1 2 3 4 5 Copy the EEFFextension4.1.0_xxx archive to a temporary location. Log on to the McAfee ePO server as an administrator. Click Menu | Software | Extensions | Install Extension. Click Browse to locate the extension file EEFFextension4.1.0_xxx, then click OK. The Install Extension page appears with the extension name and version details. Click OK.
Install the Help extension

You can install the Help extension separately on the McAfee ePO server using the Software tab. The Help extension is a .ZIP file. Task 1 2 3 4 Log on to the McAfee ePO server as an administrator. Click Menu | Software | Extensions | Install Extension. Click Browse to locate the extension file help_eeff_410.ZIP, then click OK. Click OK.
Register Windows Active Directory

You must register Windows Active Directory with your ePolicy Orchestrator to permit dynamically assigned permission sets for Windows users. Dynamically assigned permission sets are assigned to users based on their Active Directory group memberships. You must have a registered LDAP server to use Policy Assignment Rules and to enable dynamically assigned permission sets. Task 1 2 3 4 Log on to the McAfee ePO server as an administrator. Click Menu | Configuration | Registered Servers | New Server. On the Description page, from the Server type dropdown list, select LDAP Server, specify a unique name (a userfriendly name) and any details, then click Next to open the Details page. Select Active Directory from LDAP server type, then enter the Domain name or the Server name.
Use a DNSstyle domain name. Make sure that the McAfee ePO system is configured with appropriate DNS setting and can resolve the DNSstyle domain name of the Active Directory. The server name is the name or IP address of the system where the Windows Active Directory is present.
Product Guide
11
Installing the EEFF client Deploy EEFF to managed systems
Enter the User name.

The user name should be in the format: domain\Username for Active Directory accounts.
6 7
Enter the Password and confirm it. Click Test Connection to verify that the connection to the server works, then click Save.
Deploy EEFF to managed systems

You can use McAfee ePO 4.6 (minimum Patch 2) to create tasks to deploy EEFF to a single system, or to groups in the System Tree. Task 1 2 Click Menu | Policy | Client Task Catalog | Client Task Types | McAfee Agent | Product Deployment | Actions | New Task. Set these options for the new task: a b c d e f g 3 4 5 Make sure that Product Deployment is selected, then click OK. In the Name field, enter the name for the task. From the Target Platforms dropdown list, select Windows. From the Products and components dropdown list, select McAfee Endpoint Encryption for Files and Folders. As the Action, select Install. Select an appropriate Language. Next to Options, specify if you want to run this task for every policy enforcement process (Windows only).
Click Save. Click Menu | Systems | System Tree | Assigned Client Tasks, then select the required group in the System Tree. Select the Preset filter as Product Deployment (McAfee Agent). Each assigned client task per selected category appears in the details pane.
6 7
Click Actions | New Client Task Assignment. The Client Task Assignment Builder wizard appears. Set these options: a b On the Select Task page, select as McAfee Agent as Productand Product Deployment as Task Type, then select the task you created for deploying the product. Next to Tags, select the appropriate option, then click Next: c Send this task to all computers Send this task to only computers that have the following criteria Use one of the edit links to configure the criteria.
On the Schedule page, select whether the schedule is enabled, specify the schedule details, then click Next.
Review the summary, then click Save.
12
Product Guide
At the next agentserver communication, the task runs and EEFF is deployed on the managed systems.
Product Guide
13
14
Product Guide
Configuring EEFF policies
A policy is a collection of settings that you create, configure, and enforce. Policies make sure that the managed security software products are configured and perform correctly. The McAfee ePO console enables you to configure policy settings for all products and systems from a central location. For each managed product or component, you can choose whether the agent enforces all or none of its policy selections. You can view policy assignments, where they are applied, and if they are enforced. You can also lock policy enforcement to prevent changes to enforcement. Refer to the McAfee ePolicy Orchestrator product documentation for details on policy creation and management. Contents EEFF policy settings Create a policy Edit the EEFF policy settings Assigning policies to a system or a system group Enforce EEFF policies on a system Enforce EEFF policies on a system group How policy assignment rules work How multi-slot policies work
Product Guide
15
Configuring EEFF policies EEFF policy settings
EEFF policy settings

Policy settings for EEFF are grouped under different categories. Each policy category refers to a specific subset of policy settings. Policies are created and displayed by product and category.
Policy categories
Category General Description Explorer Integration Specifies the context menu options available to a user on the client system. Allow Explicit Encrypt Enables the Encrypt option for client system users. Default value is disabled. Allow Explicit Decrypt Enables the Decrypt option for client system users. Default value is disabled. Enable padlock icon visibility Displays a padlock icon on encrypted objects. Default value is enabled. Enable search encrypted Enables Search encrypted option for client system users. Default value is disabled. Allow creation of SelfExtractors Enables users to manually create encrypted SelfExtractors for files and folders. SelfExtractors are passwordprotected executable files that can be decrypted on any Windows system. Default value is enabled. This policy also enables sending SelfExtractors as CAB file attachments from the context menu. Email Integration Specifies the context menu options available to a user on the client system. Enable sending of encrypted email attachments Enables managed node users to send encrypted email attachments to internal recipients in the form of SBA files. Default value is disabled. Folder Encryption Click Add to specify folders to be encrypted. Path Specifies the path of the folder to be encrypted. Specify the path of the folder by selecting from the list or typing it in the text box. Key Specifies the encryption key to be assigned to the policy. Browse to select the key. File Encryption Click Add to specify the process and the file extensions to be encrypted. Process name Specifies the process name of the application that creates the files to be encrypted. Extensions Specifies the file extensions to be encrypted that are supported by the process. Multiple file extensions can be specified using a space, semicolon, or colon as separators. Key Specifies the encryption key to be assigned to the policy. Browse to select the key.
16
Product Guide
Category Removable Media
Description Encryption Method Specifies methods used to encrypt a removable media. Use no removable media encryption Does not encrypt files on removable media. Default value is disabled. When selected, context menu options are enabled on the client system. Use regular encryption Encrypts files and folders on removable media with the specified key. Browse to select the key. Default value is disabled. Ignore existing content Does not encrypt existing files on removable media. Use McAfee Endpoint Encryption for Removable Media (EERM) Specifies options to encrypt removable media. Protected area Specifies options to configure encrypted area on a removable media. Entire device Encrypts the entire removable media. This option can be restricted based on device size by selecting Except when device is greater than, setting the maximum device size (in GB; default value is 64 GB), then specifying the required action: Select Do not encrypt to exclude devices greater than the specified size from encryption. Select User Managed to allow the user to decide the percentage of the removable media to encrypt. User Managed Prompts the user to decide the percentage of the removable media to encrypt. Recovery Methods Specifies methods used to recover the EERM encrypted removable media. Use recovery key Specifies the Regular or User Personal key that can be used to recover the encrypted removable media. Allow recovery password Enables the user to specify a password during initialization that can be used to recover the encrypted removable media. Select Mandatory to require the user to specify a recovery password during initialization. Allow user certificate Enables the user to attach a Windows certificate during initialization that can be used to recover the encrypted removable media. Select Mandatory to require the user to attach a certificate during initialization. Options Specifies general encryption options for the removable media. Make unprotected files and folders readonly (on a client machine with EEFF installed) Does not allow the user to modify unprotected files and folders on the device when used on a system where the EEFF client is installed. Customize UI Text displayed on Inserting Media The message to be displayed to an end user upon inserting a removable media into an EEFF client with EERM enabled. This text is
Product Guide
17
Category
Description customizable, and limited to 300 characters. If left blank, the default message is shown. Floppy Disk Drives Specifies encryption options for floppy disks. Make floppy disk drives readonly Does not allow the user to modify files and folders on floppy disk drives. Exempt device IDs Does not update the specified devices with the changes in encryption policies. Add Adds the ID of the device that will not be updated with the changes in encryption policies. Remove Removes the device ID from the exemption list. Edit Edits the ID of the device that will not be updated with the changes in encryption policies.
CD/DVD Encryption
None Selected Does not encrypt while burning files and folders to a CD or DVD. Users can encrypt or decrypt files or folders using the context menu on the client system, if required. Enforce encryption on CD/DVD write operations Encrypts files and folders while burning them to a CD or DVD with the selected key. Encrypt and Decrypt options in the context menu are disabled on the client system. Disable CD/DVD Write Operations Does not allow the user to write any files or folders on CD or DVD.
18
Product Guide
Category Encryption Options
Description Encryption Options Preserve file times Does not change the file modified and accessed time on encryption or decryption. Require authentication for listing of encrypted folders Blocks unauthorized users from browsing encrypted folders. In an EEFF installed system, if the key used to encrypt a folder is not assigned to the user, then the user cannot view the content of that folder. If the key is assigned to the user, then the user can view the content of folders that is encrypted with that key. Use wiping when encrypting and deleting files Uses a secure delete algorithm when encrypting files to ensure that no trace of the plaintext data remains on the client system.
File wiping might slow down encrypted file operations due to the additional disk operations required.
Enable limiting of the file size that will be encrypted Encrypts only if the file size is less than the specified limit. Default value is 20 MB.
This is applicable only if the folder is encrypted using Folder Encryption policy.
I/O Utilization Maximum I/O utilization Specifies the percentage of I/O usage that EEFF processes can utilize during encryption. Blocked Processes Blocks the specified processes from opening or editing encrypted files. EEFF blocks a process by withholding the keys required to decrypt the files. Add Adds the process to the block list to prevent the user running it to open or edit encrypted files. Remove Removes the process from the block list to allow the user accessing edit encrypted files. Edit Edits the process in the block list that is already an added process. Key Request Exclusion Enables the process (such as antivirus) to exclude encrypted files if it does not have access to the required encryption key.
All the keys assigned to the user through policy are unloaded every time the user logs off.
Add Adds the process that is to be excluded. Remove Removes the process from the exclusion list. Edit Edits the process that is to be excluded. File Extension Exclusion Excludes the specified file extension from encryption. Add Adds the file extension that is to be excluded. Remove Removes the file extension from the exclusion list. Edit Edits file extension that is to be excluded. Grant Keys (Multislot policy) Available Keys Lists all active keys, which includes regular and user personal keys. Selected Keys Specifies the keys that the policy grants when assigned to users.
Product Guide
19
Category Network
Description Enable network encryption Enables encryption of files on network locations. Enable network bandwidth limit Limits the network bandwidth used by EEFF when encrypting files on network locations. Default value is 50 KB/sec. Disable encryption on slow connections Does not encrypt files on network locations if the network latency is above the specified limit. Default value is 500 milliseconds.
This option is applicable only if the file is being encrypted through policy enforcement.
Maximum clients allowed to encrypt folders Specifies the maximum number of users who can simultaneously encrypt folders on a network.
This option is applicable only if the file is being encrypted through policy enforcement.
20
Product Guide
Configuring EEFF policies Create a policy
Category User Local Keys Options
Description Allow user local keys Allows users to create local keys on a client system using EEFF client. These user local keys can be shared among users using the Export and Import options in EEFF client. Recovery Key Specifies a Regular or a User Personal Key which can be used to recover user local keys. Allow user local key generation Allows users to create local keys on a client system using EEFF client. Allow export of user local keys Allows users to export local keys from a client system using EEFF client. Allow import of user local keys Allows users to import local keys to a client system using EEFF client. Allow deletion of user local keys Allows users to delete local keys from a client system using EEFF client. Automatically create a user local key Creates a default user local key when a new user logs on to the client system.
Password Rules
Password Complexity Configuration for Removable Encryption, Selfextractors & User Local Keys Defines the password policy rules for SelfExtractors, User Local Keys, and EERM in the EEFF client. If the password does not conform to a policy, an error message is displayed in the EEFF client detailing the reason and prompting the user to try again. In addition to the password complexity checks, when a password is changed for EERM and User Local Keys, the new password is checked against the user's last password to prevent duplication. Minimum Password Length Specifies the minimum number of characters that must be included in a password (from 440). Default value is 7. Minimum Lowercase Characters Specifies the minimum number of lowercase letters that must be included in a password (from 015). Default value is 0. Minimum Uppercase Characters Specifies the minimum number of uppercase (capital) letters that must be included in a password (from 015). Default value is 0. Minimum Alphabetical Characters Specifies the minimum number of letters that must be included in a password (from 015). Default value is 5. Minimum Numeric Characters Specifies the minimum number of numeric characters (digits) that must be included in a password (from 015). Default value is 1. Minimum Special Characters Specifies the minimum number of special characters that must be included in a password (from 015). Default value is 1.
All password policies are systembased. In addition to the above complexity checks, internal checks are performed on all passwords to verify that they do not contain more than two consecutive characters of the user name, do not match the full account name, and do not contain any spaces.
Create a policy
You can create a new policy from the Policy Catalog. By default, policies that are created using the Policy Catalog are not assigned to any groups or systems. You can create policies before or after the EEFF software is deployed.
Product Guide
21
Configuring EEFF policies Edit the EEFF policy settings
Task 1 Click Menu | Policy | Policy Catalog, select Endpoint Encryption for Files and Folders 4.1.0.x as Product, then select a policy Category from the dropdown list. All created policies for the selected category appear in the details pane. Click Actions | New Policy. Select the policy you want to duplicate from the Create a policy based on this existing policy dropdown list. Enter a name for the new policy and click OK. The Policy Settings wizard opens. Edit the policy settings on each tab as needed. Click Save.
2 3 4 5 6
Edit the EEFF policy settings

You can modify the EEFF policy settings from the Policy Catalog. Before you begin Your user account must have appropriate permissions to edit McAfee EEFF policy settings. Task 1 2 3 4 Click Menu | Policy | Policy Catalog, then select Endpoint Encryption for Files and Folders from the Product dropdown list. Select the category from the dropdown list. All created policies for the selected category appear in the details pane. Locate the policy, then click Edit Settings next to it. Edit the settings as needed, then click Save.
The policy settings are updated.
Assigning policies to a system or a system group

You can assign a policy to a specific managed system or to multiple managed systems within a group.
Assign a policy to a managed system

You can assign a policy to a specific managed system before or after deploying the EEFF software. Task 1 2 3 4 Click Menu | Systems | System Tree | Systems, then select the group under the System Tree. All the systems within this group (but not its subgroups) appear in the details pane. Select the system, then click Actions | Agent | Modify Policies on a Single System. The Policy Assignment page for that system appears. From the Product dropdown list, select Endpoint Encryption for Files and Folders. The policy categories under Endpoint Encryption for Files and Folders are listed with the systems assigned policy. Locate the required policy category, then click Edit Assignments.
22
Product Guide
Configuring EEFF policies Enforce EEFF policies on a system
5 6
If the policy is inherited, select Break inheritance and assign the policy and settings below next to Inherit from. From the Assigned policy dropdown list, select the policy. From this location, you can edit the selected policy or create a new policy.
Select whether to lock policy inheritance. Locking policy inheritance prevents any systems that inherit this policy from having another one assigned in its place.
Assign a policy to a system group

You can assign a policy to multiple managed systems within a group. You can assign policies before or after EEFF is deployed. Task 1 2 3 4 Click Menu | Systems | System Tree | Systems, then select the system group in the System Tree. All the systems within this group (but not its subgroups) appear in the details pane. Select the relevant systems, then click Actions | Agent | Set Policy & Inheritance. The Assign Policies page appears. From the Product dropdown list, select Endpoint Encryption for Files and Folders. Select the category and policy from the respective dropdown lists, then click Save.
The policy is assigned to the selected managed systems.
Enforce EEFF policies on a system

You can enable or disable policy enforcement for EEFF on a system. Policy enforcement is enabled by default, and is inherited in the System Tree. Task 1 2 3 4 5 6 Click Menu | Systems | System Tree | Systems, then select the group under System Tree where the system belongs. The list of systems belonging to this group appears in the details pane. Select the system, then click Actions | Agent | Modify Policies on a Single System. The Policy Assignment page appears. Select Endpoint Encryption for Files and Folders, then click Enforcing next to Enforcement status. To change the enforcement status, select Break inheritance and assign the policy and settings below. Set the enforcement status to Enforcing or Not enforcing as required. Click Save.
The enforcement status is applied to the selected managed systems.
Enforce EEFF policies on a system group

You can enable or disable policy enforcement for a product on a System Tree group. Policy enforcement is enabled by default, and is inherited in the System Tree.
Product Guide
23
Configuring EEFF policies How policy assignment rules work
Task 1 2 3 4 5 Click Menu | Systems | System Tree | Assigned Policies, then select the group in the System Tree. From the Product dropdown list, select Endpoint Encryption for Files and Folders, then click Enforcing next to Enforcement Status. To change the enforcement status, select Break inheritance and assign the policy and settings below. Select Enforcing or Not enforcing accordingly as Enforcement status. Select whether to lock policy inheritance. Locking inheritance for policy enforcement prevents breaking enforcement for groups and systems that inherit this policy. 6 Click Save.
The selected enforcement status is applied to the product.
How policy assignment rules work

Policy assignment rules enable you to create systemspecific and userspecific policy assignments. These assignments are enforced on the target system when a user logs on. The agent on the managed system keeps a record of the users who log on to the network. The policy assignments you create for each user are pushed down to the system they log on to, and are cached during each agentserver communication. The agent applies the policies that you have assigned to each user.
When a user logs on to a managed system for the first time, there can be a slight delay while the agent contacts its assigned server for the policy assignments specific to this user. During this time, the user has access only to that functionality allowed by the default machine policy, which typically is your most secure policy.
Policy assignment rules reduce the overhead of managing numerous policies for individual users, while maintaining generic policies across your System Tree. For example, you can create a policy assignment rule that is enforced for all users in your engineering group. You can then create another policy assignment rule for members of your IT department so they can log on to any computer in the engineering network with the access rights they need to troubleshoot problems on a specific system in that network. This level of granularity in policy assignment limits the instances of broken inheritance in the System Tree.
Policy assignment rule priority

Policy assignment rules can be prioritized to simplify policy assignment management. When you assign priority to a rule, it is enforced before assignments with a lower priority. In some cases, the outcome can be that some rule settings are overridden. For example, consider a user who is included in two policy assignment rules, rules A and B. Rule A has priority level 1, and allows included users unrestricted access to Internet content. Rule B has priority level 2, and heavily restricts the same user's access to Internet content. In this scenario, rule A is enforced because it has higher priority. As a result, the user has unrestricted access to Internet content.
How multislot policies work with policy assignment rule priority
Multislot policies are used when a policy setting needs to be shared among users or system groups. Rule priority is not considered for multislot policies. A Grant Key policy is a multislot policy.
24
Product Guide
Configuring EEFF policies How policy assignment rules work
If a single rule containing multislot policies of the same product category is applied to a user, all settings of the multislot policies are combined. Similarly, if multiple rules applied to a user contain multislot policy settings, all settings from each multislot policy are combined.
As a result, the user gets a policy that combines the settings of each individual rule. For example, consider the example where a user is included in two policy assignment rules with different assigned priorities. When these rules consist of multislot policy assignments, the settings for both policies are applied without regard to priority. You can prevent application of combined settings from multislot policies across multiple policy assignment rules by excluding a user (or other Active Directory objects such as a group or organizational unit) when creating the policy assignment rule.
Working with policy assignment rules

You can set up, create, and manage policy assignment rules in your network.
Create policy assignment rules

Policy assignment rules enable you to enforce permissions and criteriabased policies for individual users accessing your network.
Policy assignment rules for an EEFF userbased policy override the policy assigned to a system through the System Tree.
Task 1 2 3 4 Click Menu | Policy | Policy Assignment Rules | Actions | New Assignment Rule. The Details page of the Policy Assignment Builder wizard appears. Enter the name and description in the designated fields, then click Next. In the Selection Criteria page, select the users by selecting the relevant criteria, then click Next. In the Assigned Policies page, click Add. The Choose a policy to assign dialog box appears.
You can add more than one Grant Key policy.
Set these options: a b c From the Product dropdown list, select Endpoint Encryption for Files for Folders. From the Category dropdown list, select Grant Keys. From the Policy dropdown list, select the policy.
6 7
Click OK. In the Summary page, click Save.
Manage policy assignment rules

You can perform common management tasks when working with policy assignment rules in the McAfee ePO server. For details, see the McAfee ePO product documentation.
Product Guide
25
Configuring EEFF policies How multi-slot policies work
How multi-slot policies work

The McAfee ePO administrator can add multiple Grant Key policies to users or system groups restricting the assignment of keys to authorized users only. The policy instances are automatically combined into an effective policy. Multislot policies obey the ePolicy Orchestrator laws of inheritance within a System Tree (see ePolicy Orchestrator Product Guide for details).
Assign multiple instances of Grant Key policy through the System Tree
You can use the System Tree to assign multiple instances of a Grant Key policy to a system. Task 1 2 3 4 5 Click Menu | Systems | System Tree | Assigned Policies | Product | Endpoint Encryption for Files and Folders. Each assigned policy per category appears in the details pane. Locate the Grant Key policy category, then click Edit Assignment. The Policy Assignment page appears. Click New Policy Instance. The new policy instance is added in the Policy Assignment page. If the policy is inherited, select Break inheritance and assign the policy and settings below next to Inherited from. From the Assigned policy dropdown list, select the Grant Key policy.
From this location, you can also edit the selected policys settings, or create a new policy.
Select whether to lock policy inheritance. . Locking policy inheritance prevents any systems that inherit this policy from having another one assigned in its place.
Click Save.
Assigning Grant Key policy through policy assignment rules

You can assign multiple instances of Grant Key policy to a user or a system through Policy Assignment Rules.
Assign multiple instances of Grant Key policy to systems

You can assign systembased policies to the tags you applied using McAfee ePO 4.6. You can assign multiple instances of a Grant Key policy to systems based on the tags applied to them.
When assigning a Grant Key policy using McAfee ePO 4.6, the policy assigned to a system (based on the tags applied) does not merge with Grant Key policy assigned through the System Tree.
Task 1 2 3 4 Click Menu | Policy | Policy Assignment Rules | Actions | New Assignment Rule. The Details page of the Policy Assignment Builder wizard appears. Enter the name and description in the designated fields. Select System Based as the Rule Type, then click Next. The Assigned Policies page appears. Click Add Policy to select the policies that you want to enforce using this policy assignment rule.
26
Product Guide
Set these options: a b c From the Product dropdown list, select Endpoint Encryption for Files for Folders. From the Category dropdown list, select Grant Keys. From the Policy dropdown list, select the policy, then click OK.
6 7 8
Click Next. In the Selection Criteria page, select the users by selecting the relevant criteria, then click Next. In the Summary page, click Save.
Assign multiple instances of Grant Key policy to users

You can assign multiple instances of Grant Key policy to users based on the tags applied to them using McAfee ePO 4.6.
The Grant Key policy assigned to a user through a policy assignment rule is merged with the grant key policy assigned to the system through the System Tree.
Task 1 2 3 4 5 Click Menu | Policy | Policy Assignment Rules | Actions | New Assignment Rule. The Details page of the Policy Assignment Builder wizard appears. Enter the name and description in the designated fields. Select the Rule Type as User Based, then click Next. The Assigned Policies page appears. Click Add Policy to select the policies that you want to be enforced by this policy assignment rule. Set these options: a b c 6 7 8 From the Product dropdown list, select Endpoint Encryption for Files for Folders. From the Category dropdown list, select Grant Keys. From the Policy dropdown list, select the policy, then click OK.
Click Next. In the Selection Criteria page, select the users by selecting the relevant criteria, then click Next. In the Summary page, click Save.
View the policies assigned to systems

You can view the policies assigned to systems, including the available keys. Task 1 2 Click Menu | Systems | System Tree | Assigned Policies | Product | Endpoint Encryption for Files and Folders 4.1.0. Each assigned policy per category appears in the details pane. Locate the Grant Key policy category, then click View Effective Policy. The View Effective Grant Keys Policy page appears with the list of keys available to the system and the policies to which they are associated.
Product Guide
27
View the policies assigned to users

You can view the policies assigned to users, including the available keys. Task 1 2 3 4 5 Click Menu | Systems | System Tree | Systems, then select the required system. Click Actions | Direct Management | View Effective Policy (by user). From the Product dropdown list, select Endpoint Encryption for Files and Folders, then click Select User next to Effective Policy for User. T Select the required user, then click OK. The policies assigned to the selected user appear in the details pane. Locate the Grant Key policy category, then click View Effective Policy. The View Effective Grant Keys Policy page appears with the list of keys available to the user and the policies to which they are associated.
28
Product Guide
Managing EEFF keys
EEFF uses encryption keys to protect files and folders on networks, removable media, CDs or DVDs, and user hard disks. Encryption keys are generated and stored in an internal encryption key repository within the McAfee ePO environment. Contents Encryption keys Create an encryption key Activate or deactivate the encryption keys Assign the encryption keys to a policy Edit an encryption key Delete an encryption key Export the encryption keys Import the encryption keys How user personal keys work
Encryption keys
The EEFF client requests an encryption key when a user accesses an encrypted file or a folder. If a policy is assigned to the user with the requested encryption key, EEFF decrypts the data. An administrator can create and manage encryption keys from McAfee ePO under the EEFF keys tab. These keys are assigned to policies that are later assigned to users or systems. All keys assigned through the policy are loaded at every log on and unloaded every time the user logs off.
Key types
EEFF supports three types of encryption keys:
Product Guide
29
Managing EEFF keys Create an encryption key
Regular keys Created by McAfee ePO administrators and can be used in any policy. User personal keys Generated in McAfee ePO when a key is granted to a user through the Grant Key policy. When assigned to a user, these policies enable the user to use the key across all the client systems in the same domain. User Local keys Created using EEFF client software on a client system. These keys can be used by the user to encrypt or decrypt data on the same network using the context menu. A Local key is limited to the user and client system on which it was created.
Create an encryption key

You can create a regular encryption key, with or without an expiry date. Task 1 2 3 4 5 Click Menu | Data Protection | EEFF keys. The EEFF Key Management page appears. Click Actions | Create New Key. Enter a name and description for the key. Select Never expire key or set an expiration date as required. Click OK.
The new key is available for inclusion in EEFF policies.
Activate or deactivate the encryption keys

Activating or deactivating an encryption key determines the key's availability on the client systems. Task 1 2 Click Menu | Data Protection | EEFF keys. The EEFF Key Management page appears. Select the keys to activate, then click Actions | Activate Key(s). To deactivate keys, select the keys, then click Actions | Deactivate Key(s). In the Deactivate Key(s) dialog box, click OK. When an encryption key is activated, it is added to the client systems during the next policy update. When an encryption key is deactivated, it is removed from all the client systems during the next policy update.
Assign the encryption keys to a policy

Encryption keys are assigned to users or systems through a Grant Key policy, which is a multiple instance policy.
You can assign only active keys to a Grant Key policy.
30
Product Guide
Managing EEFF keys Edit an encryption key
Task 1 2 3 4 Click Menu | Policy | Policy Catalog | Product | Endpoint Encryption for Files and Folders 4.1.0 | Category | Grant Keys (UBP). All the Grant Key policies appear in the details pane. Click Edit Settings next to the required Grant Key policy. The selected Grant Key policy page appears with the list of active keys in the Available Keys pane. Select and move the required keys to the Selected Keys pane. Click Save, then send an agent wakeup call.
Edit an encryption key

You can edit the name, description, and expiry date of an existing encryption key. Task 1 2 3 4 Click Menu | Data Protection | EEFF keys. The EEFF Key Management page appears. Select the key to edit, then click Actions | Edit key. The Edit Key dialog box appears. Edit the name, description, and expiry date of the key. Click OK.
Delete an encryption key

You can delete an encryption key provided that it is no longer active. See Activate or deactivate keys for instructions on deactivating a key.
Files can still remain encrypted on the client systems or removable media even if a key has been removed from all policies. Any files encrypted with a deleted key are inaccessible and cannot be recovered.
Task 1 2 3 Click Menu | Data Protection | EEFF keys. The EEFF Key Management page appears. Select the keys to delete, then click Actions | Delete Key(s). The Delete Key(s) dialog box appears. Click OK.
The keys are deleted and any files encrypted with those keys are no longer accessible.
Export the encryption keys

You can export encryption keys into a passwordprotected .bin file. Task 1 2 Click Menu | Data Protection | EEFF keys. The EEFF Key Management page appears. Select the keys to export, then click Actions | Export Key(s).
Product Guide
31
Managing EEFF keys Import the encryption keys
3 4 5
Enter and confirm the password to be used to protect the exported file, then click OK to open the Export Keys for EEFF page. Click the .bin or .xml file, and save it to the required location. Click Close.
The selected keys are saved in a passwordprotected .bin file in the specified location.
Import the encryption keys

You can import encryption keys from a passwordprotected .bin file. Task 1 Click Menu | Data Protection | EEFF keys. The EEFF Key Management page appears. 2 3 4 Click Actions | Import Keys. Browse to and select the .bin or .xml file, then enter the password if prompted. Click Import Keys.
The encryption keys are imported.
How user personal keys work

User personal keys give you the ability to create userspecific encryption keys. These keys are created at the McAfee ePO server when the user logs on to the client system for the first time after the policy is enforced. User personal keys are assigned to the Grant key policy as a single key, but creates individual user personal keys when assigned. If the policy is assigned at the system level, users using that system will have individual user personal keys. When assigned at user level, these keys can be used on any system within the same domain. The user personal key is enabled and assigned to the Grant Key policy using McAfee ePO. The Grant Key policy can be assigned to specific users using Policy Assignment Rules and specific system or system group using Assigned Policies page. Enforcing the Grant Key policy on the managed node creates a user personal key at the first log on of the user. User personal keys can be used as recovery keys for user local keys and EERM.
Best practice
By assigning a user personal key as a recovery key for EERM, the administrator can make sure that the removable media can be recovered only by the assigned user on any system in the same domain.
32
Product Guide
Managing EEFF keys How user personal keys work
Working with user personal keys

These tasks describe how to create and recover user personal keys.
Assign a user personal key

You can assign a user personal key using a Grant Key policy. Task 1 Enable the creation and assignment of user personal keys in EEFF: a b c 2 Click Menu | Data Protection | EEFF keys. The EEFF Key Management page appears. Click Edit next to User Personal Keys. The Configure User Personal Keys page appears. Select Enable User Personal Keys, then click Save.
Edit the EEFF policy settings to include user personal keys: a b c Click Menu | Policy | Policy Catalog | Product | Endpoint Encryption for Files and Folders. Select Grant Keys (UBP) as policy Category, then click Edit Settings next to the required policy. Select and move the User Personal Key to Selected Keys table, then click Save.
3 4 5 6 7 8 9
Click Menu | Policy | Policy Assignment Rules | New Assignment Rule. The Policy Assignment Builder wizard appears. Enter the name and description in the designated fields, then click Next to open the Selection Criteria page. Select the user by selecting the relevant criteria, then click Next to open the Assigned Policies page. Click Add. The Choose a policy to assign dialog box appears. From the Product dropdown list, select Endpoint Encryption for Files for Folders. From the Category dropdown list, select Grant Keys. From the Policy dropdown list, select the required policy, then click OK.
10 In the Summary page, click Save. After assigning the Grant Key policy to the user, a user personal key is generated when the user logs on to the client system.
Recover a user personal key

Displaying the user personal keys as regular keys enables the administrator to recover files encrypted with a user key belonging to another user. Task 1 2 3 Click Menu | Data Protection | EEFF keys. The EEFF Key Management page appears. Select the required user personal key, then click Actions | Edit Key. Select Display as regular, then click OK.
Product Guide
33
Managing EEFF keys How user personal keys work
34
Product Guide
Managing EEFF reports
The McAfee ePO server ships with its own querying and reporting capabilities. These are highly customizable, flexible, and easy to use. EEFF reports are based on configurable EEFF queries, and can be displayed and exported in several formats. Contents EEFF queries and query results Create EEFF custom queries View standard EEFF queries EEFF client events
EEFF queries and query results

EEFF queries are configurable objects that retrieve and display data from the database. These queries can be displayed in charts and tables. Any query results can be exported to a variety of formats, any of which can be downloaded or sent as an attachment to an email message. Most queries can be used as dashboard monitors. EEFF queries are configurable objects that retrieve and display data from the database. These queries can be displayed in charts and tables. Any query results can be exported to a variety of formats, any of which can be downloaded or sent as an attachment to an email message. Most queries can be used as dashboard monitors.
Query results are actionable

Query results displayed in tables (and drilldown tables) have a variety of actions available for selected items in the table. For example, you can deploy agents to systems in a table of query results. Actions are available at the bottom of the results page.
Queries as dashboard monitors

Most queries can be used as a dashboard monitor (except those using a table to display the initial results). Dashboard monitors are refreshed automatically on a userconfigured interval (five minutes by default).
Exported results
Query results can be exported in four different formats. Exported results are historical data and are not refreshed like other monitors when used as dashboard monitors. Like query results and querybased monitors displayed in the console, you can drill down into the HTML exports for more detailed information. Unlike query results in the console, data in exported reports is not actionable.
Product Guide
35
Managing EEFF reports Create EEFF custom queries
Reports are available in these formats: CSV Use the data in a spreadsheet application (for example, Microsoft Excel). XML Transform the data for other purposes. HTML View the exported results as a web page. PDF Print the results.
Create EEFF custom queries

You can create EEFF custom queries with the Query Builder wizard. Task 1 2 Click Menu | Reporting | Queries | Actions | New Query. The Query Builder wizard opens. On the Result Type page, select Others from the Feature Group pane and Endpoint Encryption Result Type for the query, then click Next to open the Chart page. This choice determines the options available on subsequent pages of the wizard. 3 Select the type of chart or table to display the primary results of the query, then click Next to open the Columns page. If you select Boolean Pie Chart, you must configure the criteria to include in the query. 4 Select the columns to be included in the query, then click Next to open theFilter page.
If you select Table on the Chart page, the columns you select here are the columns of that table. Otherwise, these are the columns that make up the query details table.
Select properties to narrow the search results, then click Run. The Unsaved Query page displays the results of the query, which is actionable, so you can take any available actions on items in any tables or drilldown tables. Selected properties appear in the content pane with operators that can specify criteria used to narrow the data that is returned for that property. If the query does not appear to return the expected results, click Edit Query to go back to the Query Builder and edit the details of this query. If you do not need to save the query, click Close. If this is a query you want to use again, click Save and continue to the next step.
On the Save Query page, enter a name for the query, add any notes, and select one of these options: New Group Enter the new group name and select either: Private group (My Groups) Public group (Shared Groups)
Existing Group Select the group from the list of Shared Groups.
Click Save.
36
Product Guide
Managing EEFF reports View standard EEFF queries
View standard EEFF queries

You can run and view the standard EEFF reports from the Queries page. Task 1 2 Click Menu | Reporting | Queries. In the Groups pane, select EEFF Queries from the Shared Groups dropdown list. The standard EEFF query list appears. Query EEFF Active Keys EEFF Key Usage Protection Status: Removable Media Removable Media Device Events 3 4 5 Select a query from the Queries list. Click Actions | Run. The query results appear. Drill down into the report and take actions on items as necessary. Available actions depend on the permissions of the user.
Optionally, you can edit the query and view its details.
Description Displays the number of active and inactive keys. Displays the available keys, their policy category, and the policy in which they are used. Displays the protection status of removable media. Lists all events related to removable media.
Click Close when finished.
EEFF client events

Enforcement of EEFF policies generates client events, which include the Event ID, system information initialization details, and device information. Table 5-1 Client event types Event ID Event 20500 Removable Media Device Insert Event Removable Media User Response Event EERM Initialization Start Event EERM Initialization End Event Event Description This event is reported whenever any type of removable media is inserted in the client. Event severity: 4 20501 This event is reported whenever the user clicks Yes or No in the Removable Media Format Message window. Event severity: 4 20502 This event is reported whenever the user clicks Initialize or Cancel in the EERM Initialization window. Event severity: 4 20503 This event is reported when initialization is complete. Event severity: 4
Product Guide
37
Managing EEFF reports EEFF client events
Table 5-2
Event details
Information type Description Event ID System Event ID number User information (DomainName, UserName) Timestamp Agent GUID Initialization Initialization state (Failed, Cancelled, Successful) Backup state (None, Failed, Cancelled, Successful) Time taken for initialization (in msec) Time taken for backup (in msec) Backup size (in Bytes) Size of protected part (only when initialization has completed successfully, in bytes) Device Size (in bytes) File system of device (FAT, NTFS, EERM) Vendor name Product name Exempted (Yes, No, Unknown) Protected (Yes, No, Unknown) (only EERM drives are considered protected) Event specific fields User response Valid for events 20501 and 20502 only
Only relevant information is captured in each event. For example, a Device Insert Event does not contain Initialization State.
38
Product Guide
Defining EEFF permission sets for McAfee ePO users
In the McAfee ePO server, administrator rights management determines what McAfee ePO users can perform while administrating EEFF. A permission set is a group of permissions that can be granted to users or Active Directory (AD) groups by assigning it to those users accounts. One or more permission sets can be assigned to users, who are not global administrators (global administrators have all permissions to all products and features). User accounts and their associated permission sets in the McAfee ePO server define the tasks that the users can perform. This allows you to restrict specific users or groups from misusing EEFF features. Contents Create permission sets for user accounts Edit the EEFF policy permissions Edit the EEFF key server permissions
Create permission sets for user accounts

If you are a global administrator, you can create permission sets for user accounts. Task 1 2 3 4 5 6 Click Menu | User Management | Permission Sets. Click Actions | New permission Set. Enter a unique name for the permission set. If you want to immediately assign specific users to this permission set, select their user names in the Users section. If you want to map all users in a specific Activity Directory group to this permission set, select the server from the Server Name dropdown list, then click Add. Click Save to create the permission set.
Product Guide
39
Defining EEFF permission sets for McAfee ePO users Edit the EEFF policy permissions
Edit the EEFF policy permissions

You can define the permissions for configuring EEFF policy settings. Task 1 2 3 Click Menu | User Management | Permission Sets. Click Edit next to EEFF Policy Permissions. The Edit Permission Set page appears. Set the appropriate permissions, then click Save.
The updated permissions are applied to users and Active Directory groups assigned to this permission set.
Edit the EEFF key server permissions

You can define permission sets for creating and managing EEFF keys. Task 1 2 3 Click Menu | User Management | Permission Sets. Click Edit next to EEFF Key Server. The Edit Permission Set page appears. Set the appropriate permissions, then click Save.
40
Product Guide
Additional Information
This additional information is provided for your reference. Contents Uninstalling EEFF Removable media registry controls Best practices
Uninstalling EEFF
You can uninstall EEFF from managed systems and from the McAfee ePO server. Contents Uninstall EEFF from managed systems using McAfee ePO Remove the EEFF extension Remove the EEFF software package Uninstalling EEFF from managed systems
Uninstall EEFF from managed systems using McAfee ePO

You can create a task in McAfee ePO to uninstall EEFF from managed systems in the System Tree.
Any encrypted files should be decrypted prior to uninstallation. Encrypted files remain encrypted following uninstallation.
Task 1 2 Click Menu | Policy | Client Task Catalog, select McAfee Agent | Product Deployment as Client Task Types, then click Actions | New Task. Set these options for the new task: a b c d e f g Make sure that Product Deployment is selected, then click OK In the Name field, enter the name for the task. From the Target Platforms dropdown list, select Windows. From the Products and components dropdown list, select McAfee Endpoint Encryption for Files and Folders. As the Action, select Remove. Select an appropriate Language. Next to Options, specify if you want to run this task for every policy enforcement process (Windows only).
Product Guide
41
Additional Information Uninstalling EEFF
3 4 5
Click Save. Click Menu | Systems | System Tree | Assigned Client Tasks, then select the required group in the System Tree. Select the Preset filter as Product Deployment (McAfee Agent). Each assigned client task per selected category appears in the details pane.
6 7
Click Actions | New Client Task Assignment. The Client Task Assignment Builder wizard appears. Set these options: a b On the Select Task page, select as McAfee Agent as Product and Product Deployment as Task Type, then select the task you created for deploying the product. Next to Tags, select the appropriate option, then click Next: c Send this task to all computers Send this task to only computers that have the following criteria Use one of the edit links to configure the criteria.
On the Schedule page, select whether the schedule is enabled, specify the schedule details, then click Next.
Review the summary, then click Save.
Remove the EEFF extension

You can remove the EEFF extension from the McAfee ePO server. Task 1 2 3 4 Log on to the McAfee ePO server as an administrator. Click Menu | Software | Extensions. The Extension page displays the extension name and version details. Select the Endpoint Encryption for Files and Folders extension file, then click Remove. The Remove extension confirmation page appears. Select Force removal, bypassing any checks or errors to force product extension removal, then click OK.
Remove the EEFF software package

You can remove the EEFF software package from the McAfee ePO server. Task 1 2 3 4 Log on to the McAfee ePO server as an administrator. Click Menu | Software | Master Repository. The Packages in Master Repository page displays the list of software packages and their details. Click Delete next to the EEFF package. When prompted to confirm, click OK.
42
Product Guide
Additional Information Removable media registry controls
Uninstalling EEFF from managed systems

You can uninstall EEFF from managed systems using either McAfee ePO or a command prompt.
Uninstall EEFF from managed systems using Shell command

You can uninstall EEFF from a managed system using the MfeFfShell command. Task 1 At the command prompt, navigate to the folder where EEFF was installed. By default, EEFF is installed in [SYSDRIVE]:\Program Files\McAfee\Endpoint Encryption for Files and Folders 2 Run the following command, MfeFfShell.com force_uninstall. You are prompted to restart the system after uninstallation.
Uninstall McAfee EEFF from managed systems using MSI

You can uninstall McAfee EEFF from a managed system using MSI. Task 1 At the command prompt, navigate to the folder where McAfee EEFF msi is available.
By default, McAfee EEFF msi is available in this location: [LOCAL APPDATA]\McAfee\Common Framework\Current\EEFF_4000\Install\0000 where [LOCAL APPDATA] depends on your operating system: 2 Windows XP and Windows 2003 C:\Document and Settings\All Users Windows Vista, Windows 2008, and Windows 7 C:\ProgramData
Run the following commands to uninstall EEFF: msiexec /q /norestart /I eeff[XX].msi msiexec /q /x eeff[XX].msi
[XX] 32 for 32bit operating systems and 64 for 64bit operating systems You are prompted to restart the system after uninstalling the software .
Removable media registry controls

EEFF defines removable media as a drive, with the exception of boot drive and remote drives. This might be a concern for client systems having builtin extra drives, for example, an extra hard drive with a .zip drive. These drives are subject to removable media encryption. Contents Broaden the removable media definition Exempt local drives and network shares from encryption
Broaden the removable media definition

EEFF allows you to broaden the removable media definition to include USB drives and FireWire drives, or drives that report themselves as removable to the operating system. The removable media
Product Guide
43
Additional Information Best practices
definition is broadened by adding a registry value on the client computer. In EEFF 4.1, the value is configured by default to 1. Task 1 On the client system, create a DWORD registry value in HKLM\System\CurrentControlSet \Services\MfeEEFF called RelaxedRemovableMediaDefinition. Set the registry value as required. 0 Default definition (same as not having this registry value) 1 Only disks reported as 'Removable' or located on the USB or IEEE 1394 (FireWire) port 2 Only disks reported as 'Removable'
Restart the system to save the changes.
Exempt local drives and network shares from encryption

You can exclude local drives and network drives from encryption by adding a registry value on the client. Setting this registry value makes the EEFF driver not attach to local and network drives, but only to removable media drives and CD/DVD drives. Task 1 On the client system, create a DWORD value in HKLM\System\CCS\Service\MfeEEFF called ExemptNonRemovable and set its value to 1. Restart the system to save the changes.
It fails to encrypt the file on the local drive, but encrypts the same file on a removable drive. This registry value must be manually set on each client system. It can also be remotely distributed with a systems management tool. When enabled, it is not possible to read (decrypt) any existing encrypted files on local drives or network shares.
Best practices
These best practice recommendations are for largescale deployments of EEFF. Consult your Endpoint Encryption representative if you have special considerations for your environment. The definition of a largescale installation is any deployment with 1000 users and above. Contents Key caching Tune encryption intensity for network Explicitly encrypt large shares in advance Exclude EEFF client program directory
44
Product Guide
Key caching
Try to make use of the encryption key caching feature. This might not be possible due to security reasons. However, considering this option for any encryption key created will help reduce the communication payload on the McAfee Agent to McAfee ePO.
Tune encryption intensity for network

When encrypting large folders on a network share through a policy, it is recommended to tune the network encryption intensity. Configure these values to tune the network encryption intensity: I/O Utilization: 30% (Set in theEncryption options policy) Bandwidth limit: 100 KB/sec. (Set in the Network policy) Network latency: 600 ms. (Set in the Network policy) Maximum number of clients to encrypt folders: 10
You can limit the size of the files to be encrypted (Set in the Encryption options policy).
Explicitly encrypt large shares in advance

Use a manual (explicit) encryption method for large network folders encryption, rather than encrypting them through a folder encryption policy. Initiate the encryption from a single machine, after logging on with an appropriate EEFF user, then let the encryption run (maybe overnight). The reason is to avoid extreme payload on the file servers from many clients seeking to enumerate, fetch, encrypt, and upload files to/from the servers. This reduces the risk of network failure and file server payload overflow is minimized.
Exclude EEFF client program directory

No matter which antivirus solution is used on the clients, we recommend excluding the EEFF program directory from realtime antivirus scanning. By default, the EEFF program directory is [SYSDRIVE]\Program Files\McAfee\Endpoint Encryption for Files&Folders. Typically, most antivirus solutions can be policy controlled to exclude certain directories from realtime scanning. Consult the operating manuals for your antivirus solution for further details.
Product Guide
45
46
Product Guide
Index
A
about this guide 5 assign policy grant key 30
B
best practices 44 exclusion of EEFF client program directory 45 explicit encryption of large shares 45 key caching 45 tune encryption intensity 45 break inheritance 26
C
client program directory 45 conventions and icons used in this guide 5 custom queries 36
EEFF policies assign to managed system 22 creating from Policy Catalog 21 editing, from Policy Catalog 22 enforcing on a system 23 enforcing on a system group 23 effective policy system 27 user 28 encryption keys activating and deactivating 30 creating 30 deleting 31 editing 31 exporting 31 importing 32 encryption keys, about 29 encryption, persistent 7 enforcement (See policy enforcement) 23 exclusion of EEFF client program directory 45 explicit encryption of large shares 45 extension, EEFF help 11 installing 11 removing from ePO 42
D
deployment installing products 12 DNS settings 11 documentation audience for this guide 5 product-specific, finding 6 typographical conventions and icons 5
G
Grant Key multi-slot policy 26, 27 view effective 27 Grant Key policy assign multiple instances 27 assign personal key to user 33 assigning keys 30 assigning multiple instances to systems 26 assigning to systems 26 personal keys 32 view effective policy 28 groups policy enforcement for a product 23
E
EEFF client 7 deploy on managed systems 12 encryption keys 29 features 8 help extension 11 how it works 7 installation 11 purpose 7 remove from managed systems 41 reports 35 uninstall from managed systems, using MSI 43 uninstall from managed systems, using Shell command 43
H
Help extension 11
Product Guide
47
Index
I
installation, EEFF product extension 11
K
key caching 45 key server permissions 40 keys activating 30 assigning to policy 30 creating 30 deactivating 30 deleting 31 editing 31 exporting 31 importing 32 regular 29 user local 29 user personal 29 user personal, assign 33
L
LDAP servers, registering 11 local keys 29
M
managed systems assign policy to 23 assigning EEFF policy 22 deploy EEFF on 12 policy management on 16 uninstall EEFF 41 uninstall EEFF, using MSI 43 uninstall EEFF, using Shell command 43 master repositories checking in packages 10 McAfee ServicePortal, accessing 6 MSI, using to uninstall EEFF 43 multi-slot policy 24 Grant Key 26 multiple instance policy assigning to system 26 assigning to systems 26 assigning to users 27
permission sets 39 (continued) EEFF policy 40 persistent encryption 7 personal keys 29 policies about 16 assigning to system groups 23 assigning to systems 22 create on Policy Catalog page 21 editing, from Policy Catalog 22 EEFF, configuring 15 enforcement 15 multi-slot 26 viewing 16 policy assignment rules about 24 create 25 multi-slot policy 24 priority 24 Policy Catalog creating EEFF policies 21 editing EEFF policies 22 page, viewing 16 policy categories CD/DVD encryption 16 file encryption 16 folder encryption 16 general 16 password rules 16 removable media 16 policy enforcement enabling and disabling 23 for a product 23 policy inheritance, lock 22 product installation configuring deployment tasks 12
Q
queries about 35 custom, creating 36 exported results 35 view result 37 Query Builder wizard creating custom queries 36
O
operating system requirements 9
R
recovery of user personal keys 33 registered servers LDAP servers, adding 11 regular keys 29 creating 30 removable media broaden the definition 43
P
password rules 16 permission sets 39 about 39 EEFF key management 40
48
Product Guide
Index
removable media (continued) exempt local drives from encryption 44 registry controls 43, 44 reports about 35 formats 35 viewing 37 requirements operating system 9 software 9 system 9 rules policy assignment, creating 25 priority 24
system groups policy enforcement 23 system requirements 9 systems assigning policies to 22, 23 policy enforcement for a product 23
T
Technical Support, finding product information 6 tune encryption intensity 45
U
user accounts permission sets 39 user personal keys about 32 best practices 32 create 33 enable 33 Grant Key 32 recover 33
S
servers ePO 11 LDAP servers, registering 11 ServicePortal, finding product documentation 6 Shell command, using to uninstall EEFF 43 software package remove 42 software packages check in 10 software requirements 9
W
Windows Active Directory 11
Product Guide
49
00

Eeff 410 Product Guide en Us PDF

Uploaded by

Copyright:

Available Formats

Eeff 410 Product Guide en Us PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Eeff 410 Product Guide en Us PDF

Uploaded by

Copyright:

Available Formats

Product Guide

McAfee Endpoint Encryption for Files and Folders 4.1

LICENSE INFORMATION License Agreement

McAfee Endpoint Encryption for Files and Folders 4.1

Purpose of EEFF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 How EEFF works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Installing the EEFF client

Configuring EEFF policies

Managing EEFF keys

McAfee Endpoint Encryption for Files and Folders 4.1

Managing EEFF reports

Defining EEFF permission sets for McAfee ePO users

McAfee Endpoint Encryption for Files and Folders 4.1

About this guide

McAfee Endpoint Encryption for Files and Folders 4.1

Preface Find product documentation

Find product documentation

McAfee Endpoint Encryption for Files and Folders 4.1

How EEFF works

McAfee Endpoint Encryption for Files and Folders 4.1

McAfee Endpoint Encryption for Files and Folders 4.1

Installing the EEFF client

McAfee Endpoint Encryption for Files and Folders 4.1

Installing the EEFF client Check in the EEFF software package

Check in the EEFF software package

McAfee Endpoint Encryption for Files and Folders 4.1

Installing the EEFF client Install the EEFF extension

Install the EEFF extension

Install the Help extension

Register Windows Active Directory

McAfee Endpoint Encryption for Files and Folders 4.1

Installing the EEFF client Deploy EEFF to managed systems

Enter the User name.

Deploy EEFF to managed systems

Review the summary, then click Save.

McAfee Endpoint Encryption for Files and Folders 4.1

Installing the EEFF client Deploy EEFF to managed systems

McAfee Endpoint Encryption for Files and Folders 4.1

Installing the EEFF client Deploy EEFF to managed systems

McAfee Endpoint Encryption for Files and Folders 4.1

Configuring EEFF policies

McAfee Endpoint Encryption for Files and Folders 4.1

Configuring EEFF policies EEFF policy settings

EEFF policy settings

McAfee Endpoint Encryption for Files and Folders 4.1

Configuring EEFF policies EEFF policy settings

Category Removable Media

McAfee Endpoint Encryption for Files and Folders 4.1

Configuring EEFF policies EEFF policy settings

McAfee Endpoint Encryption for Files and Folders 4.1

Configuring EEFF policies EEFF policy settings

Category Encryption Options

McAfee Endpoint Encryption for Files and Folders 4.1

Configuring EEFF policies EEFF policy settings

McAfee Endpoint Encryption for Files and Folders 4.1

Configuring EEFF policies Create a policy

Category User Local Keys Options

McAfee Endpoint Encryption for Files and Folders 4.1

Configuring EEFF policies Edit the EEFF policy settings

Edit the EEFF policy settings