This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos Encryption Windows 10

Hello

I am installing Sophos Safeguard Version 7.0.2 on a Windows 10 laptop.  This is my first as the rest of the environment is still at Windows 7.  The install goes smoothly and

the laptop talks to the Sophos server however does not begin encryption automatically as the Windows 7 machines do.  I do notice that the method is set to Bitlocker mode.

I have been able to manually run Bitlocker and it talks back to the server acknowledging  the encryption.  I guess the question is this normal or should the Bitlocker auto

encrypt.  Also I do not see the normal pre boot Sophos login screen just the manual code you set when creating Bitlocker encryption.  Thanks.  



This thread was automatically locked due to age.
Parents
  • FormerMember
    0 FormerMember

    Hi Nathan,

    There's no POA on Windows 10, it's replaced by the BitLocker PIN/Password.
    What's happening there is perfectly normal, SafeGuard can take over the BitLocker encryption if manually enabled, however you can get SafeGuard to encrypt the machine for you automatically.

    The following criteria needs to be met for BitLocker machines:
    BitLocker Drive Encryption must be installed and activated.
    ■ If TPM is to be used for authentication, TPM must be initialized, owned and activated.
    ■ To install BitLocker Drive Encryption support, either deactivate User Access Control (UAC) or
    log on with the built-in Administrator account.
    These GPOs also need to be set:
    ■ To use "TPM + PIN", "TPM + Startup Key" or "Startup Key" please enable the Group Policy "Require additional authentication at startup" either in Active Directory or locally on computers.
    ■ To use "Startup Key", you must also tick the checkbox "Allow BitLocker without a compatible TPM" in the Group Policy.
    ■ To use "TPM + PIN" on tablets, you must also enable Group Policy "Enable use of BitLocker authentication requiring preboot keyboard input on slates".

    I hope that helps Nathan, please let me know if you need anything further.

  • Toby - you mention this "SafeGuard can take over the BitLocker encryption if manually enabled"

     

    How do you do this ?

     

    Thanks in advance

Reply Children
  • FormerMember
    0 FormerMember in reply to DickieColangelo

    Hi Dickie,

    Basically if you have BitLocker already enabled on the machine you can just install SafeGuard with an encryption policy applied and the key will then be managed in the SafeGuard Management Center.

  • No - my point was can you have ONLY the safeguard encryption on Windows 10, and not use BitLocker.

    Due to there only being 1 password on bootup. We want multiple logins at bootup, like it does with Safeguard on a Windows 7 machine.

  • Hi - As I understand if you're using Windows 10 (not Home) it will have to be encrypted with BitLocker. Sophos will just help manage the BL keys centrally for you.

    This table may help

    https://community.sophos.com/kb/en-us/118945

     

    Multiple people could log into a shared machine - Just select Other User from the welcome screen. However I'd probably create a "shared computer" policy and then apply just TPM only to this group. That way you wouldn't need to share the PIN/passcode with all the users that need to log on?

    This is set in the authentication policy - BitLocker Logon Mode for Boot Volumes

     

    Hope that helps?

  • No. We would like 10 to work the same as 7 works. With the Safeguard login at bootup. Using domain credentials.

     

    Is there not a way to do this ?

     

  • Unknown said:

    Hi Dickie,

    Basically if you have BitLocker already enabled on the machine you can just install SafeGuard with an encryption policy applied and the key will then be managed in the SafeGuard Management Center.

     

     

    So similar issue.  We are imaging Lenovo X1 tablets (which have Opal drives that are not supported) via MDT, during the deployment we enable Bitlocker as TPM only and install Safeguard and the config.  The console shows the machine as encrypted, but when I log in as a user for the first time there is the yellow warning sign over the Bitlocker icon on the drive.  I still have to enable Bitlocker on the drive manually.  The drive is already encrypted however, so after being asked by the Bitlocker wizard to save the key or print it everything works normally or am I missing a setting somewhere?

     

    Is this standard behavior now on an Opal drive using MDT?

  • That's not really what I am asking. We do not want to have to enter a pin or key on bootup. (in Bios before the post)

     

    We want the safeguard login as it currently stands on Windows 7. The login with the passthrough.

     

    Is this not possible with Bitlocker and/or Windows 10 ?

  • Hi Dickie.

    I don't believe that is possible. Win10 (not Home) will use BitLocker. If you have TPM you could have a policy that doesn't require a PIN. If you don't have TPM hardware though BitLocker will require a password or USB startup key.

  • No, this is not possible with Windows 10.

     

    The POA  (Power On Authentication) is part of the Sophos Device Encryption module. This module is only available up to Windows 7.

    Starting with Windows 8 Sophos only supports the builtin Bitlocker encryption of Windows. Bitlocker doesn't provide single signon.

  • OK. Thank You. It is what it is.

     

    I do have one more issue. With Windows 10 and Bit Locker, I get the first profile to sync fine. But the others will not.

     

    Do you know what I am doing wrong ? The safeguard icon shows the red exclamation point. And the console never sees the new login.

  • Hi Dickie,

    I'd recommend that you contact support and open a ticket. They can trouble shoot this with you.

    Bill.