Help? No File Encrypted Using Fast Initial Encryption

(Additional thought..)

The two types of encryption I think have been available in "other" similar products are:

1).  Volume based "Full-disk Encryption" (FDE) and I followed a USENET discussion group on the topic for several years.  Under FDE there were further options to A). Initially encrypt everything, including the Operating System directories, and  B). Initially encrypt ONLY the data added to the computer AFTER the encryption was installed.  So, on this second version, the FDE was required to be installed before the End User's profile was added to the computer, otherwise no data kept within it would EVER be encrypted.  That sounds like a risky limitation, but as long as the Technicians adhered to the proper prodcedures when Imaging a new computer and adding software to it, then everything was safe.

Of course, there was the idea of:  "What if people save data outside of their User Profile?" and this was indeed (IMHO) a true risk, so perhaps this "option" has been done away with on that "other" product by now.  We often coached End Users not to save anything in areas of the hard drive outside of their Profile and that doing so would place the information "at risk" (whether this was literally true of not, did not matter to us at the time - many years ago).

2).  Where the FDE option covering everything encrypted 1 GB per hour, it was ESSENTIAL to allow sufficient time for the computer asset to remain on the Tech Depot workbench until the initial process completed.

3).  The "faster" method would complete the User's Profile in 30 minutes or less, because the initial size of those "first time on this computer" Profiles was typically very small.  Unless the User was being migrated from another, older asset and had many data files (such as a 3, 5 or 7 Gigabyte "Personal Folder" for use with Microsoft Outlook), which then presented an issue we were clearly aware of and could account for in our processes.

If the Sophos product does not support this option, or requires it to be specified on an organizational level (eg. across the board, all users) then I do understand and would just view this as a necessary limitation which must be accounted for.

~ Dennis

(Additional thought..)

The two types of encryption I think have been available in "other" similar products are:

1).  Volume based "Full-disk Encryption" (FDE) and I followed a USENET discussion group on the topic for several years.  Under FDE there were further options to A). Initially encrypt everything, including the Operating System directories, and  B). Initially encrypt ONLY the data added to the computer AFTER the encryption was installed.  So, on this second version, the FDE was required to be installed before the End User's profile was added to the computer, otherwise no data kept within it would EVER be encrypted.  That sounds like a risky limitation, but as long as the Technicians adhered to the proper prodcedures when Imaging a new computer and adding software to it, then everything was safe.

Of course, there was the idea of:  "What if people save data outside of their User Profile?" and this was indeed (IMHO) a true risk, so perhaps this "option" has been done away with on that "other" product by now.  We often coached End Users not to save anything in areas of the hard drive outside of their Profile and that doing so would place the information "at risk" (whether this was literally true of not, did not matter to us at the time - many years ago).

2).  Where the FDE option covering everything encrypted 1 GB per hour, it was ESSENTIAL to allow sufficient time for the computer asset to remain on the Tech Depot workbench until the initial process completed.

3).  The "faster" method would complete the User's Profile in 30 minutes or less, because the initial size of those "first time on this computer" Profiles was typically very small.  Unless the User was being migrated from another, older asset and had many data files (such as a 3, 5 or 7 Gigabyte "Personal Folder" for use with Microsoft Outlook), which then presented an issue we were clearly aware of and could account for in our processes.

If the Sophos product does not support this option, or requires it to be specified on an organizational level (eg. across the board, all users) then I do understand and would just view this as a necessary limitation which must be accounted for.

~ Dennis