Enforce Data Exchange (only) on USB Removable Media for all users of a PC

Hi there,

We're having some problems with a basic setup and wonder if more experienced users could point us in the right direction.

We have SafeGuard Management Center 7, but a mix of 6 and 7 clients, used previously to encrypt laptops so all working fine.

Our new objectives:

For most desktop Win 7 PCs we now wish to enforce encryption of USB removable media;

We want the policy to apply to any user of that PC, as almost any of our PCs can be used by any of our users;

We do not want POA, or volume encryption, only Data Exchange, and that to only apply to removable media, so file-based not volume-based;

We have enabled generation of Group Keys as we wish to use Group Keys so users in-house can seamlessly exchange USB devices and files;

SGPortable can be used for external recipients.

We have no problem getting the PreInstall, Client, and the Config onto the PCs.

The problem:

How to assign all our users to a PC or ideally to an OU?  It seems only possible to assign individual users to a PC.  If I create a group of users and assign that group, the users are individually enumerated in the assignment.

Then when attempting to save the configuration after adding the users, I get an error such as attached,

"You have already assigned a max of 0 user(s).  Please remove 110 object(s)"

We have 250 available DE licences, so even if the license is per user, this doesn't make sense.  (Although we thought the license was per device?). 

After going round in circles with this one for some days now, I'm getting confused between AD groups, Safeguard groups, group keys, OUs etc...

All we want to do is assign everybody to each configured PC in the simplest possible way (i.e. groups) all using the same group key.

If someone could point out where we are going wrong, this would be much appreciated.  Thanks in advance,

Dave T