Sophos Safeguard

Question

Hi, 
 
 I have a number of Desktop PC's and Laptops that are at remote locations that don't require to be on our Domain as they are running Citrix. 
 
 We have been told to get them to work with Sophos Safeguard, we will need to import the certificate in the 'Personal' section of 'Certificates'. 
 
 The above has been tried with no success, can anyone help or suggest anything I am missing? 
 
 Kind regards, Dan Petford

MichaelMcLannahan · Accepted Answer

Ah ok - Thanks Dan. Sounds like you've set it up well. Have you created a matching workgroup name for the remote laptops and are they all in the same workgroup name? 
 If the workgroup name (you could just use "workgroup" but a bit lazy/confusing!) matches the workgroup name on the clients, they'll populate the auto-registered group. 
 You could then apply the same policies from your successful machines to the "auto-registered" workgroup folder. 
 Sophos client doesn't like blank passwords on accounts, so always best to set one. 
 It's also worth using the client connection tool (assuming you have V7 or better?) - ON the client, C:\Program Files (x86)\Sophos\SafeGuard Enterprise\Client\SGNCSCC.exe.

MichaelMcLannahan · Answer

Log onto console (MAINMSO would be handy as it SHOULD have permissions to view everything) and scroll down to your Workgroup (right below the domain and all the jazz) 
 1 - Select the Workgroup 
 2 - Select Access tab 
 3 - Select a security officer (one from the domain) 
 4- Drag them over to the Access window and give them appropriate rights.

MichaelMcLannahan · Answer

Morning Dan - This is an expected error when you only have one key protector set. 
 There's a few key protectors to help "secure" the data/encryption on the HDD/SDD. 
 Some of these are... 
 TPM (Only) 
 TPM AND PIN 
 Password 
 Startup key (a USB memory key to be plugged in (or left in?!) each and every boot. 
 Numeric Password (This is the recovery key in all digits) This is your "emergency key" and the one the Sophos server holds. 
 
 What this error is telling you is that it's been asked to delete the only key remaining. You can only have ONE active protector AND the recovery key (the numeric password) 
 This PC is telling you that to add another protector it must first delete the other one. However that would leave it with NO key protector as there's not another set! 
 Does that make a bit of sense? 
 
 What you need to do is check your policy - Make sure you have a TPM policy that can be applied AND the PC can use it. TPM MUST be in an accessible state (this can be cleared from BIOS or using the TPM.MSC tool within Windows (at an elevated prompt) 
 You also need to check "manage-bde" (also at an elevated prompt) 
 manage-bde -status 
 If is says there's two key protectors set and working then we need to figure out why the TPMANPIN policy isn't setting. You can manually add a key proctector at the manage-bde prompt but this should be being set by Sophos so applying it this way isn't really fixing the issue - at least not globally! 
 
 manage-bde -add -protectors -TPMANDPIN c: 
 This will replace the key protector with TPM AND a PIN (it'll then prompt for a PIN) 
 
 You're very close now though - don't give up! :)