Reference Guide

ManualsBrandsDell ManualsConverged InfrastructureData Guardian

Security Management Server Virtual

v10.2.7 AdminHelp

Summary of content (332 pages)

PAGE 1
Security Management Server Virtual v10.2.
PAGE 2
PAGE 3
Table of Contents Welcome ............................................................................................................................................................... 1 About Online Help ............................................................................................................................................. 1 Attributions & Copyrights ..................................................................................................................................
PAGE 4
Table of Contents Notifications List .......................................................................................................................................... 35 Notification Types .................................................................................................................................... 35 Priority Levels ..........................................................................................................................................
PAGE 5
Security Management Server Virtual v10.2.7 AdminHelp Add a User Group .................................................................................................................................. 48 Add Non-Domain Users ............................................................................................................................. 49 View or Modify Domain Policies and Information ....................................................................................
PAGE 6
Table of Contents User Endpoints ......................................................................................................................................... 61 User Groups .............................................................................................................................................. 62 User Admin ...............................................................................................................................................
PAGE 7
Security Management Server Virtual v10.2.7 AdminHelp View or Modify Endpoint Policies and Information .................................................................................. 75 View Effective Policy ............................................................................................................................... 76 Endpoint Details & Actions ....................................................................................................................... 76 Endpoint Detail .....
PAGE 8
Table of Contents Send Wipe Command to Self-Encrypting Drive..................................................................................... 91 Set the Dell Server Connection Retry Interval ..................................................................................... 92 Administrators.............................................................................................................................................. 92 Assign or Modify Administrator Roles ...............................
PAGE 9
Security Management Server Virtual v10.2.7 AdminHelp Advanced Threat Prevention Syslog IP Addresses ..................................................................................... 117 Management .................................................................................................................................................. 118 Commit Policies .........................................................................................................................................
PAGE 10
Table of Contents Notification Management ....................................................................................................................... 127 Enable SMTP Server for Email Notifications........................................................................................... 128 Configure SMTP Settings......................................................................................................................... 128 Product Notifications .....................................
PAGE 11
Security Management Server Virtual v10.2.7 AdminHelp %HKLM:regpath% ............................................................................................................................. 183 %ENV:envname% .............................................................................................................................. 183 %% ....................................................................................................................................................
PAGE 12
Table of Contents Client Firewall Settings and Rules ............................................................................................................. 231 Client Firewall Options ....................................................................................................................... 231 Client Firewall Rules........................................................................................................................... 233 Policies Set by Application Control ............
PAGE 13
Security Management Server Virtual v10.2.7 AdminHelp Overview of Data Guardian Features and Policies .................................................................................... 255 Protect data in use, in motion, or at rest ............................................................................................. 255 Control data ........................................................................................................................................... 255 Monitor data ...........
PAGE 14
Table of Contents Legacy Policies for Data Guardian's Force-Protected Mode ...................................................................... 282 Windows: Additional Office menu options for Data Guardian v2.7 and earlier .................................... 283 Windows: Additional Office menu options on Windows for Data Guardian v2.7 and earlier ................ 283 Windows: Additional policies ..............................................................................................................
PAGE 15
Security Management Server Virtual v10.2.7 AdminHelp Advanced Removable Media Encryption .................................................................................................... 299 Removable Media Policies that Require Logoff ..................................................................................... 307 Mac Encryption .............................................................................................................................................. 307 Mac Encryption.......
PAGE 16
PAGE 17
Welcome About Online Help Version: 10.2.7 Attributions & Copyrights Dell, EMC, and other trademarks are trademarks of Dell Inc. or its subsidiaries. Other trademarks may be trademarks of their respective owners. Protected by one or more U.S. Patents, including: Number 7665125; Number 7437752; and Number 7665118. The software described is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Third Party Software I.
PAGE 18
Welcome FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
PAGE 19
Security Management Server Virtual v10.2.7 AdminHelp III. Portions of this product use OrientDB. You may obtain a copy of the license at http://www.apache.org/licenses/LICENSE-2.0. IV. Portions of this product use Apache Wink. You may obtain a copy of the license at http://www.apache.org/licenses/LICENSE-2.0. V. Portions of this product use Jackson JSON. You may obtain a copy of the license at http://www.apache.org/licenses/LICENSE-2.0. VI. Portions of this product use Jetty.
PAGE 20
Welcome XIX. Portions of this product make use of Struts Digester, Apache Software Foundation. You may obtain a copy of the license at http://www.apache.org/licenses/LICENSE-2.0.txt. XX. Portions of this product make use of Apache xmlrpc, Apache Software Foundation. You may obtain a copy of the license at http://www.apache.org/licenses/LICENSE-2.0.txt. XXI. Portions of this product make use of Bean Scripting Framework (http://commons.apache.org/bsf/), Apache License, Version 2.
PAGE 21
Security Management Server Virtual v10.2.7 AdminHelp C. Neither the names of the copyright holders nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
PAGE 22
Welcome The Licensee may distribute original or modified STLport sources, provided that: o The conditions indicated in the above permission notice are met; o The following copyright notices are retained when present, and conditions provided in accompanying permission notices are met : Copyright 1994 Hewlett-Packard Company - Permission to use, copy, modify, distribute and sell this software and its documentation for any purpose is hereby granted without fee, provided that the above copyright notice app
PAGE 23
Security Management Server Virtual v10.2.7 AdminHelp XL. Portions of this product make use of ResizableLib. You may obtain a copy of the license at http://opensource.org/licenses/artistic-license-1.0. XLI. Portions of this product make use of Spring Framework. You may obtain a copy of the license at http://www.apache.org/licenses/LICENSE-2.0. XLII. Portions of this product use $File: A. LEGAL NOTICE,v 1.15 2006/05/03 18:48:33 christos Exp $. Copyright (c) Ian F.
PAGE 24
Welcome Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. This version of the GNU Lesser General Public License incorporates the terms and conditions of version 3 of the GNU General Public License, supplemented by the additional permissions listed below. 1. Additional Definitions.
PAGE 25
Security Management Server Virtual v10.2.7 AdminHelp You may convey a Combined Work under terms of your choice that, taken together, effectively do not restrict modification of the portions of the Library contained in the Combined Work and reverse engineering for debugging such modifications, if you also do each of the following: a) Give prominent notice with each copy of the Combined Work that the Library is used in it and that the Library and its use are covered by this License.
PAGE 26
Welcome If the Library as you received it specifies that a proxy can decide whether future versions of the GNU Lesser General Public License shall apply, that proxy's public statement of acceptance of any version is permanent authorization for you to choose that version for the Library. XLVIII. Portions of this product use DropNet. You may obtain a copy of the license at http://www.apache.org/licenses/LICENSE-2.0. Portions of this product use Hardcodet WPF NotifyIcon 1.0.8.
PAGE 27
Security Management Server Virtual v10.2.7 AdminHelp THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
PAGE 28
Welcome LXXVII. Portions of this product use Jackson Annotations 2.4.4. You may obtain a copy of the license at http://www.apache.org/licenses/LICENSE-2.0. LXXVIII. Portions of this product use Apache Maven Wagon 2.2. You may obtain a copy of the license at http://www.apache.org/licenses/LICENSE-2.0. LXXIX. Portions of this product use Scribe OAuth Library 1.3.0. You may obtain a copy of the license at http://opensource.org/licenses/MIT. LXXX.
PAGE 29
Security Management Server Virtual v10.2.7 AdminHelp XCVIII. Portions of this product use Azure Active Directory Authentication Library 1.2.9. You may obtain a copy of the license at http://opensource.org/licenses/MIT. Portions of this product use AF Networking 2.6.3. You may obtain a copy of the license at XCIX. http://opensource.org/licenses/MIT. C. Portions of this product use Box iOS SDK 1.0.11. You may obtain a copy of the license at http://www.apache.org/licenses/LICENSE-2.0. CI.
PAGE 30
Welcome CXIX. Portions of this product make use of the Mono and the Mono runtime, under MIT, BSD, and Apache licenses. You may obtain a copy of the licenses at http://www.monoproject.com/docs/faq/licensing/.
PAGE 31
Security Management Server Virtual v10.2.7 AdminHelp Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Portions of this product make use of the Mono .NET assemblies under MIT and BSD licenses. CXX.
PAGE 32
Welcome NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Portions of this product make use of mkbundle in Mono under GNU LESSER GENERAL CXXI. PUBLIC LICENSE v3. You may obtain a copy of the license at https://www.gnu.org/licenses/lgpl.txt. GNU LESSER GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc.
PAGE 33
Security Management Server Virtual v10.2.7 AdminHelp 3. Object Code Incorporating Material from Library Header Files. The object code form of an Application may incorporate material from a header file that is part of the Library.
PAGE 34
Welcome b. 6. Give prominent notice with the combined library that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work. Revised Versions of the GNU Lesser General Public License. The Free Software Foundation may publish revised and/or new versions of the GNU Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns.
PAGE 35
Security Management Server Virtual v10.2.7 AdminHelp License Information: Copyright (c) 1999 - 2017 Dell Inc. All rights reserved. This software and associated documentation (if any) is furnished under a license and may only be used or copied in accordance with the terms of the license. Dell elects to use only the Apache license for any software where a choice of Apache v2, and Mozilla Public License 1.
PAGE 36
Welcome 3. Conveying Modified Versions. If you modify a copy of the Library, and, in your modifications, a facility refers to a function or data to be supplied by an Application that uses the facility (other than as an argument passed when the facility is invoked), then you may convey a copy of the modified version: a.
PAGE 37
Security Management Server Virtual v10.2.7 AdminHelp 6. Combined Libraries. You may place library facilities that are a work based on the Library side by side in a single library together with other library facilities that are not Applications and are not covered by this License, and convey such a combined library under terms of your choice, if you do both of the following: a.
PAGE 38
Welcome Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
PAGE 39
Get Started Get Started with Dell Data Security • Once your environment has been configured in the Server Configuration Tool, ensure that Dell services are . • Log in to the Management Console. • Add Client Access Licenses, as needed. • Add domains from your directory server. • If you require that users receive non-default policies upon activation, modify policies at the appropriate level. • Add groups and users, as necessary. • Assign administrators, as necessary. • Deploy clients.
PAGE 40
Get Started Dashboard The dashboard displays an overview of status information for your enterprise. Access more detailed information directly from the dashboard by clicking its statistics, graphs, and chart legends. In the top right, select the Widgets menu to add or remove the following widgets: • • • • • • Notifications Protection Status Threat Protection History Inventory History Summary Statistics The images below reflect what may be seen in the dashboard, depending on widgets enabled.
PAGE 41
Security Management Server Virtual v10.2.7 AdminHelp An Advanced Threat Prevention event is not necessarily a threat. An event is generated when a recognized file or program is quarantined, safe listed, or waived. Threats are a category of events that are newly detected as potentially unsafe files or programs and require guided remediation.
PAGE 42
Get Started Change Superadmin Password 1. In the masthead at the top of the screen, click the gear icon and select Change superadmin password. 2. Enter the current password. 3. Enter the new password. The new password must be at least 6 characters, contain at least one capital letter and one of these characters: ~@#$%^*()|?!{}[]. 4. Confirm the new password. 5. Click Update. After three failed login attempts, the superadmin account is locked for five minutes.
PAGE 43
Components Default Port Values Compatibility Server: TCP/1099 (closed) Compliance Reporter: HTTP(S)/8084 Identity Server: HTTPS/8445 Core Server: HTTPS/8888 Policy Proxy: TCP/8000/8090 Security Server: HTTPS/8443 Forensic Server: HTTPS/8448 Client authentication: HTTPS/8449 (If using Dell Encryption on a server operating system) Management Console: HTTPS/8443 Client communication if using Advanced Threat Prevention: HTTPS/TCP/443 Beacon server if using Data Guardian: HTTP/8446 NTP time synchronization: TCP
PAGE 44
Components Note: The purpose of Device Server proxy is to support legacy Encryption clients (pre-v8.0) that communicate with port 8081. Newer Encryption clients (v8.0 and later) are configured by the client installer to communicate with the Security Server (or Security Server proxy) on port 8443. The full Device Server is not installed in v8.1. The Device Server proxy forwards all communications to the Security Server behind the firewall.
PAGE 45
Security Management Server Virtual v10.2.7 AdminHelp Policy Proxy Policy Proxy serves as intermediary between Dell Server and Encryption client, delivering information from each to the other. Time Slotting To prevent Dell Server traffic jams, Policy Proxies use a time slotting mechanism that allows them to independently choose well-distributed time slots for communicating with the Dell Server. Polling On every poll, the endpoint authenticates, checks for policy updates, and uploads inventory.
PAGE 46
PAGE 47
Navigate the Dell Server Navigation The Management Console is a central control center that the administrator can use to deploy and monitor security for the organization. It consists of security and configuration settings that are applied through policy to groups called Populations. The menu pane allows access to the following: Dashboard The Management Console opens to the dashboard.
PAGE 48
Navigate the Dell Server To determine if a Dell Server is running in Disconnected mode, click the gear icon at the top right of the Management Console and select About. The About screen indicates that a Dell Server is in Disconnected mode, below the Dell Server version. Disconnected mode is different than a standard connected installation of Dell Server in the following ways.
PAGE 49
Security Management Server Virtual v10.2.7 AdminHelp Dashboard The dashboard displays an overview of status information for your enterprise. Access more detailed information directly from the dashboard by clicking its statistics, graphs, and chart legends.
PAGE 50
Navigate the Dell Server An Advanced Threat Prevention event is not necessarily a threat. An event is generated when a recognized file or program is quarantined, safe listed, or waived. Threats are a category of events that are newly detected as potentially unsafe files or programs and require guided remediation.
PAGE 51
Security Management Server Virtual v10.2.7 AdminHelp Notifications List The notifications list provides a configurable summary of news, alerts, and events to display on the dashboard or to be sent as email notifications. For more information, see Dashboard Field Descriptions and Notification Management. Notification Types Select the notification types to include in the list. Notifications of the remaining types are hidden. Types include: Update - News of upcoming product updates.
PAGE 52
Navigate the Dell Server Threat Event - An event detected by Threat Protection. Certificate - Certificate expiration notification. Server Exceptions - A Dell Server communication issue is impacting deliveries of the following notifications: Threat Protection, Update, Config, Knowledge Base, and Announcement. After selecting one or more types, click in the neutral space above the list to apply the selections. Select Clear selected items to reset the selections in this list.
PAGE 53
Security Management Server Virtual v10.2.7 AdminHelp Agent Inventory Received - The date and time that the inventory was received and placed in the queue. Agent Inventory Processed - The date and time that the inventory was picked up from the queue and processed (Note: If the Dell Server is under load, the Processed and Received times may be different, but usually they are the same.) Shield - If encryption is installed on the endpoint, an icon displays.
PAGE 54
Navigate the Dell Server The Advanced Threat Prevention Events pane displays a time line of Advanced Threat events over the course of a month, by file type as assigned by Advanced Threat Prevention. Click a file type for details of the events of that type.
PAGE 55
Security Management Server Virtual v10.2.
PAGE 56
Navigate the Dell Server Set to auto run on any device False +0 Detected by Execution Control True +5 Total score 5: High Priority Advanced Threat Prevention Classifications Advanced Threat Prevention can provide details on the static and dynamic characteristics of files. This allows administrators to not only block threats, but also to understand threat behavior to further mitigate or respond to threats.
PAGE 57
Security Management Server Virtual v10.2.7 AdminHelp removal by administrators or security technologies. Trojan Malware that disguises itself as a legitimate program or file. Zeus Virus Malware that propagates by inserting or appending itself to other files. Sality, Virut Worm Malware that propagates by copying itself to another device. Code Red, Stuxnet Dual Use Dual Use indicates the file can be used for malicious and non-malicious purposes.
PAGE 58
Navigate the Dell Server The file has been identified as a Potentially Unwanted Program. This indicates that the program may be unwanted, despite the possibility that users consented to download it. Some PUPs may be permitted to run on a limited set of systems in your organization (EX. A VNC application allowed to run on domain administrator devices). A Dell Server administrator can choose to waive or block PUPs on a per device basis or globally quarantine or safelist based on company policies.
PAGE 59
Security Management Server Virtual v10.2.7 AdminHelp Note: Occasionally, a file may be classified as Unsafe or Abnormal even though the score displayed doesn’t match the range for the classification. This could result from updated findings or additional file analysis after the initial detection. For the most up-to-date analysis, enable Auto Upload in the Device Policy. Priority Level The file is given a priority level.
PAGE 60
Navigate the Dell Server  Modified policies Summary Statistics provides a breakdown of endpoints by platform, with a link to a detailed report for the selected platform:  Windows  Mac  Mobile device  All Endpoint OS Report To access this page, click a platform link on the dashboard's Summary Statistics. If you click All and the Platform Report page opens, click view in the OS Report column.
PAGE 61
Security Management Server Virtual v10.2.7 AdminHelp Details & Actions Members Settings ● ● ● ● User Groups ● ● ● Users ● ● Endpoint Groups ● ● Endpoints ● ● Populations Security Policies Enterprise ● Domains Administrators Key Server Endpoint Groups ● ● ● ● ● To access the tabs for each Population:  Enterprise - Click Populations > Enterprise.
PAGE 62
Navigate the Dell Server 3. Select the desired severity level and time period to display events. To view threat events on a specific endpoint, follow these steps: 1. In the left pane, click Populations > Endpoints. 2. Search or select a hostname, then the Threat Events tab.
PAGE 63
Security Management Server Virtual v10.2.7 AdminHelp Domains Domains On the Domains page, you can add a domain or search and select a domain to View or Modify Domain Information. Add a Domain To add a Domain, follow these steps: 1. In the left pane, click Populations > Domains. 2. On the Domains page, click Add. 3. Complete the fields on the Add Domains page. Domain DNS Suffix - Enter the fully qualified host name or the computer name and domain portion of the hostname (for example, .
PAGE 64
Navigate the Dell Server 1. In the left pane, click Populations > Users. 2. On the Users page, click Add Users by Domain. 3. In the Add Users by Domain dialog, select a domain from the pull-down list. 4. In Full name, enter the exact text for the user name or use the wildcard character (*). 5. Select Common Name, Universal Principal Name, or sAMAccountName from the list. A Common Name, Universal Principal Name, and sAMAccountName must be defined in the enterprise directory server for every user.
PAGE 65
Security Management Server Virtual v10.2.7 AdminHelp Notes: Universal security groups are only supported for domains that connect through the Global Catalog port. Nested groups are not supported. Add Non-Domain Users To add non-domain users, the non-domain activation feature can be enabled by contacting Dell ProSupport and requesting instructions. View or Modify Domain Policies and Information 1. In the left pane, click Populations > Domains. 2.
PAGE 66
Navigate the Dell Server LDAP Url - URL to the active directory. This field is populated after adding the domain. The information is derived from the completed hostname. Example - LDAP://domainname.com:portnumber/DC=domainname,DC=com To configure LDAP settings for the domain, click the Settings tab. Status - Describes the health of the domain server (Good, Fair, Poor). Domain Members This page allows you to view, add, or modify information for groups and users within the domain.
PAGE 67
Security Management Server Virtual v10.2.7 AdminHelp text) and 3269 (secure). Distinguished Name - This field is populated when you tab from the completed hostname or refresh the URL. If necessary, correct the entry to reflect the domain (for example, DC=domainname, DC=com). Secure LDAP - Select this check box for LDAPS. User Name - The user name with rights to read and run queries on the enterprise directory server. The format must be UPN, such as user@domain.com.
PAGE 68
Navigate the Dell Server c. Click Add Group. Notes: Universal security groups are only supported for domains that connect through the Global Catalog port. Nested groups are not supported. Remove User Groups 1. In the left pane, click Populations > User Groups. 2. Click a group name link or enter a filter to search for available groups. The wildcard character (*) is supported. 3. Select a row to highlight it. 4. At the top, click Delete.
PAGE 69
Security Management Server Virtual v10.2.7 AdminHelp • AG Enabled - Access Group is configured for a user group when selected Members - To view or modify the information of a user in the group, click Members. The list of users in the group displays. Click a user to view the user's Security Policies, Details & Actions, Endpoints, User Groups, and Admin. For instructions on how to view or modify User information, refer to View or Modify User Information.
PAGE 70
Navigate the Dell Server Policy Updates Removable Media Encryption Windows Media Encryption Windows Media Encryption Removable Media Encryption Windows Media Encryption EMS Scan External Media On On Not Selected Not Selected User Group Details & Actions The User Group Details & Actions tab lists the properties of a selected user group. 1. In the left pane, click Populations > User Groups. 2. Search or select a group name, then the Details & Actions tab.
PAGE 71
Security Management Server Virtual v10.2.7 AdminHelp 3. Click Add Selected Users to Group. OR Select Upload Multiple User from File, then click Browse to select a CSV file and click Upload. Valid CSV requirements: • The file must be in valid CSV format and contain a maximum of 999 endpoints. • The first column must contain valid fully qualified host names. All columns except the first column are ignored. • Only activated endpoints are added to the group. Remove Users from the Group 1.
PAGE 72
Navigate the Dell Server Precedence Ranking The System Defined Non-Persistent VDI Endpoint Group has the highest priority level, followed by the Persistent VDI Endpoint Group. Order of priority: 1. Non-Persistent VDI Endpoint Group 2. Persistent VDI Endpoint Group 3. Highest ranked Active Directory/Rule-Defined/Admin-Defined Endpoint Group 4. Second and subsequent highest ranked Active Directory/Rule-Defined/Admin-Defined Endpoint Groups 5. Opt-in Endpoint Group 6.
PAGE 73
Security Management Server Virtual v10.2.7 AdminHelp To edit User Group priority: 1. In the left pane, click Populations > User Groups. 2. Click Edit Priority. 3. Select the row of the appropriate group and drag it to the location in the list of Endpoint Groups that reflects its new priority level. 4. Click Save. Assign or Modify Administrator Roles View or modify existing administrator privileges. 1. In the left pane, click Populations > Administrators. 2.
PAGE 74
Navigate the Dell Server Administrator Roles User Admin Delegate Administrator Roles View Reconciliation Date To view the date and time a user group's or user's information was last reconciled with Active Directory, click the Details & Actions tab for the group or user, and refer to last reconciled. For instructions, refer to View or Modify User Group Policies and Information and View or Modify User Policies and Information.
PAGE 75
Security Management Server Virtual v10.2.7 AdminHelp group but does not display in the domain or group members list in the Management Console, ensure that all three names are properly defined for the user in the enterprise directory server. 6. Click Search. Depending on the size, this may take a few minutes to populate. If the query is too large, a dialog prompts you to revise the query. 7. Select users from the directory user list to add to the Domain.
PAGE 76
Navigate the Dell Server 5. Click Save. 6. Commit Policies. To reactivate a deactivated Windows user, follow the instructions in Reinstate Suspended Users. Reinstate Suspended Users To reinstate a suspended user, follow these steps: 1. In the left pane, click Populations > Users. 2. Click a user name link or enter a filter to search for available users. To Search, enter Common Name, Universal Principal Name, or sAMAccountName. The wildcard character (*) is supported. 3.
PAGE 77
Security Management Server Virtual v10.2.7 AdminHelp Last Modified - Date/time stamp Last Reconciled - Date/time stamp Endpoints - Click to view or modify information for the User's endpoints. For instructions on how to modify endpoint information, refer to View or Modify Endpoint Information. User Groups - Click Groups to view information for groups for which the user belongs. Click a user group to view the group's Security Policies, Details & Actions, Members, and Admin.
PAGE 78
Navigate the Dell Server Last Unsuccessful Login - Date/time stamp, per endpoint Last Gatekeeper Sync - Date/time stamp, per endpoint Effective Policies - Click view for a simple layout view of the effective endpoint policies Actions - Click Recover to proceed to the Recover Data page Last Encryption Sweep Start - Date/time stamp, per user Sweep End - Date/timestamp, per user Encryption Failure - Click view for a simple list of files that could not be encrypted, per user States (Date/time stamp, per endpoin
PAGE 79
Security Management Server Virtual v10.2.7 AdminHelp Common Name - non-technical name of the user group User Admin This page allows you to assign, modify, or view administrator roles for the user. 1. In the left pane, click Populations > Users. 2. Search or select a user name, then the Admin tab. Administrator Roles - Assign or modify roles for the user and click Save. Inherited Group Roles - A read-only list of roles that the user inherited from a group.
PAGE 80
Navigate the Dell Server 2. Click a user name link or search for a user and then click a link to display the user detail. Enter Common Name, Universal Principal Name, or sAMAccountName. The wildcard character (*) is supported. 3. On the Security Policies tab, click Policy-Based Encryption. 4. Set the value of Policy-Based Encryption to Off. 5. Click Save. 6. Commit Policies. Once this policy reaches the specified Encryption client, decryption begins.
PAGE 81
Security Management Server Virtual v10.2.7 AdminHelp 7. (For Rule-Defined and Active Directory Groups only) Click Preview to view the endpoints to be included in the group. 8. Click Add Group to save the group definition. 9. After the group is added, modify the group priority if necessary. Remove an Endpoint Group 1. In the left pane, click Populations > Endpoint Groups. 2. Select the group to remove. 3. Click Delete, then click OK. Modify an Endpoint Group 1.
PAGE 82
Navigate the Dell Server Windows Encryption Hardware Crypto Accelerator Hardware Crypto Accelerator (HCA) (HCA) Windows Encryption Policy-Based Encryption SDE Encryption Enabled Windows Encryption Policy-Based Encryption Windows Encryption Policy-Based Encryption Windows Encryption Off Off Not Selected Not Selected Common Encrypted Folders Encrypt Windows Paging File Not Selected Not Selected Policy-Based Encryption Secure Windows Cre
PAGE 83
Security Management Server Virtual v10.2.7 AdminHelp available for another user. Endpoint Groups Specification To skip to instructions about how to add an endpoint, see Add Endpoint Groups. At deployment time, all endpoints belong to a default endpoint group, which is generally sufficient for most deployments. This feature is used to assign policy to a specific group of endpoints. For instance, you may want to create an endpoint group based on the locale that the operating system sends up in inventory.
PAGE 84
Navigate the Dell Server The current locale of the endpoint. This is typically only reported by Encryption Enterprise.
PAGE 85
Security Management Server Virtual v10.2.
PAGE 86
Navigate the Dell Server You can capture the assigned number of the asset, and that it is within a certain subsection of assets. This example shows how to look for assets that have a value less than 1000. MID(DISPLAYNAME , 2, 5) < 1001 This example targets user’s computer where their last name begins with ‘r’. MID(DISPLAYNAME , 8, 1) = “r” • Data Guardian: To display Data Guardian internal clients, add the specification "cloudpresent and cloudinternal".
PAGE 87
Security Management Server Virtual v10.2.7 AdminHelp 5. Opt-in Endpoint Group 6. Default Endpoint Group To change Active Directory/Rule-Defined/Admin-Defined Endpoint Group priority: 1. In the left pane, click Populations > Endpoint Groups. 2. Click Edit Priority. 3. Select the row of the appropriate group and drag it to the location in the list of Endpoint Groups that reflects its new priority level. 4. Click Save.
PAGE 88
Navigate the Dell Server 3. If applicable, View or Modify Endpoint Information. View or Modify Endpoint Group Policies and Information 1. In the left pane, click Populations > Endpoint Groups. 2. Click a Group Name or enter a filter to search for available Endpoint Groups. The wildcard character (*) is supported. When you click a Group Name, the Endpoint Group Detail page displays. 3.
PAGE 89
Security Management Server Virtual v10.2.7 AdminHelp Endpoint Group Members This page lists the endpoints within an endpoint group. Information displays based on the group specification used to create the endpoint group. 1. In the left pane, click Populations > Endpoint Groups. 2. Search or select a Group Name, then the Members tab.
PAGE 90
Navigate the Dell Server *Hostname - Endpoint hostname. *OS/Version - Operating system and version running on the endpoint (Example: Microsoft Windows 10 Enterprise). *Category - Catetory of endpoint (Example: Windows or Mac). *Protected - A green check displays if the endpoint is protected. If the endpoint is not protected, the column is blank. *Serial Number - Manufacturer assigned serial number. *Win Computer Name - Computer name Windows uses to identify the computer on the network.
PAGE 91
Security Management Server Virtual v10.2.7 AdminHelp 5. Click OK to confirm removal of the endpoint. As another option, click an endpoint and select the Details & Actions tab. Under Endpoint Detail, click Remove. Find Endpoints 1. In the left pane, click Populations > Endpoints. 2. Navigate the list of endpoints using the scroll bar or page navigation controls at the bottom of the page or enter a filter into Search to search for available endpoints. The wildcard character (*) is supported.
PAGE 92
Navigate the Dell Server View Effective Policy When you view Effective Policies, you are viewing the policies and settings that are enforced on an endpoint. 1. In the left pane, click Populations > Endpoints. 2. Click a hostname in the list or enter a filter to search for available endpoints. The wildcard character (*) is supported. For Windows and Mac, if you know the endpoint hostname, enter it in Search. Leave the field blank to display all Windows and Mac endpoints.
PAGE 93
Security Management Server Virtual v10.2.7 AdminHelp Mac Category - Mac OS/OS Version - Example: Mac OS X 10.11.0 Processor Serial Number - Manufacturer assigned serial number Host ID - Endpoint identifier Unique ID - Dell assigned unique identifier Hardware ID - A unique identifier sent to the server from the client. Protected - Date and time stamp Mobile Device Category - Mobile Device OS/OS Version - Example: Lollipop / 5.
PAGE 94
Navigate the Dell Server Battery remaining% (will display if the data is available) Serial Number - Manufacturer assigned serial number Unique ID - Dell assigned unique identifier Actions - Hide or Remove Endpoint Shield Detail Commands: To view the policies of the endpoint, click View Effective Policies. Obtain the endpoint's recovery keys: 1. Click Device Recovery Keys. 2. Enter a Recovery Password and click Download. The recovery bundle containing this endpoint's encryption keys is downloaded.
PAGE 95
Security Management Server Virtual v10.2.
PAGE 96
Navigate the Dell Server Sweep Started: Date and timestamp Sweep Completed: Date and timestamp Inventory Received: Date and timestamp Inventory Processed: Date and timestamp Protected: Protection Status Tab: Disk Name Capacity (storage) Protection Status (Protected, Protecting, Unknown) Interface type Model number of the endpoint Actions: Effective policies on the specific endpoint and Recovery Keys for the specific endpoint Manager Detail (Windows only) Command: Click View Effective Policies to go to the
PAGE 97
Security Management Server Virtual v10.2.7 AdminHelp Logical Disk - The name of the logical disk. ID - The identifying number of the logical disk. Encryption % - The percentage of the partition that has been encrypted. Capacity - The capacity of the partition.
PAGE 98
Navigate the Dell Server Dell Server, via the activation process, plugins are always started with the last policy the client is aware of. • SED Plugin: Initialized - Manager is initialized waiting for delayed startup Starting - Manager is starting up. Because this is a fairly quick process, it is unlikely an inventory update would capture this so you would probably never see this state in the Management Console. Disabled - Manager is disabled by policy and not enforcing any previously received policy.
PAGE 99
Security Management Server Virtual v10.2.7 AdminHelp Current State of the Endpoint - Unlocked or Locked Commands: PBA commands for a specific endpoint are carried out in the PBA Device Control area. Each command has a priority ranking. A command with a higher priority rank cancels commands of lower priorities in the enforcement queue. For a list of command priority rankings, see Priority of Commands for SelfEncrypting Drives. Lock - Locks the PBA screen and prevents any user from logging into the computer.
PAGE 100
Navigate the Dell Server Protected Status Protected status is indicated if any of the following criteria are met: • Advanced Threat Prevention is installed and enabled. • Data Guardian is installed and enabled. • Self-Encrypting Drive Management is installed, enabled, and the PBA is enabled. • BitLocker Manager is installed, enabled, and encryption has completed. • Dell Encryption (Mac) is installed and enabled, and policy-based encryption has been enforced.
PAGE 101
Security Management Server Virtual v10.2.7 AdminHelp Policy Updating User Encryption Profile Updating EMS Encryption Profile Updating User Data Encryption On EMS Data Encryption On Deactivation Pending Suspension Pending Suspended Cloud User - Each user on the specific endpoint Endpoint Threat Events This page lists information on threat events for the selected endpoint. 1. In the left pane, click Populations > Endpoints > Workstation. 2. Search or select a Hostname, then the Threat Events tab.
PAGE 102
Navigate the Dell Server  Refresh the data. Endpoint Advanced Threats This page allows you to view, export, quarantine, or waive unsafe files that trigger events on the selected endpoint. An event is not necessarily a threat. An event is generated when a recognized file or program is quarantined, safe listed, or waived. Threats are a category of events that are newly detected as potentially unsafe files or programs and require guided remediation. 1. In the left pane, click Populations > Endpoints. 2.
PAGE 103
Security Management Server Virtual v10.2.7 AdminHelp Drag a column header, such as Status, to the area directly above the column headers to group the data by Status. When you drag a column header, it turns green, indicating that the table can be grouped by that data. You can drag additional headers over the table to group the data even further. For each group, a number displays in parentheses to indicate the total number of threats that share that group's attribute.
PAGE 104
Navigate the Dell Server User Name - Name of the user who was logged in when the exploit attempt was identified. Endpoint Advanced Threat Events The Advanced Threat Events tab displays if the Advanced Threat Prevention service is provisioned and Advanced Threat Prevention is enabled on the endpoint. The tab displays information about events for the endpoint based on information available in the Dell Server. To access the Enterprise Advanced Threats tab, follow these steps: 1.
PAGE 105
Security Management Server Virtual v10.2.7 AdminHelp 5. Click the Device ID of the appropriate endpoint. 6. On the Endpoint Detail page, click the Details & Action tab. 7. In Server Device Control, click Suspend. Suspension takes effect the next time the endpoint is rebooted. To reinstate an encrypted server, follow the instructions in Reinstate a Suspended Server Encryption Client. Reinstate an Encrypted Server To reinstate an encrypted server, follow these steps: 1.
PAGE 106
Navigate the Dell Server Allow PBA Login Bypass Allow PBA Login Bypass You can allow users to bypass the Preboot Authentication (PBA) screen one time to allow a user into the computer without authenticating on an endpoint equipped with a self-encrypting drive. To send the Bypass Login command, follow these steps: 1. In the left pane, click Populations > Endpoints. 2. Select the Workstation Endpoint Type. 3. If you know the full endpoint hostname, enter it in Search.
PAGE 107
Security Management Server Virtual v10.2.7 AdminHelp 4. Click the search icon. An endpoint or list of endpoints displays, based on your search filter. 5. Click the Hostname of the endpoint from which to remove users. 6. Click the Details & Actions tab. 7. Under SED Device Control, click Remove Users. 8. Click Yes to confirm that you want to send the Remove Users command to the endpoint.
PAGE 108
Navigate the Dell Server Set the Dell Server Connection Retry Interval To set the interval that the SED client attempts to contact the Dell Server when it is unavailable to communicate with the SED client, set the following value on the client computer: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DellMgmtAgent\Parameters CommErrorSleepSecs (DWORD Value)=300 This value is the number of seconds the SED client waits to attempt to contact the Dell Server if it is unavailable to communicate with the SED
PAGE 109
Security Management Server Virtual v10.2.7 AdminHelp There are 11 types of administrators. Distributed administration is key to the secure administration of your environment. It allows you to divide roles appropriately among your administrators and ensures the proper level of privileges are assigned to each administrator. A single administrator can have privileges of more than one administrator type.
PAGE 110
Navigate the Dell Server View audit events ● Analyze logs ● ● ● ● ● ● View Administrators ● Create, change, and delete Administrator accounts ● Delegate Administrator privileges ● Download Endpoint software Download recovery key bundle ● ● ● ● Provision or recover the Advanced Threat Prevention service ● Enroll for Advanced Threat Prevention auto updates ● Set email notifications of Client Access Licenses, Threat Protection, and Advanced Threat Prevention alerts ● ● Manage Data Gu
PAGE 111
Security Management Server Virtual v10.2.
PAGE 112
Navigate the Dell Server set to run at a specified interval in the Compliance Reporter Scheduler Enter or modify settings in Compliance Reporter Settings ● Set up Compliance Reporter plugins ● Open a Report, modify an online Report display, and rename a Report view in Compliance Reporter ● Generate, export, store, print, and email a Report result in Compliance Reporter ● Add, edit, and delete a Compliance Reporter Report folder ● Access the Manage Reports Tab ● 1 The forensic administrator role
PAGE 113
Security Management Server Virtual v10.2.7 AdminHelp 1. In the left pane, click Populations > User Groups. 2. Search for the appropriate group. 3. Click the Admin tab. 4. Under Delegated Roles, click Add. 5. Search for and select the user to receive administrator rights, then click Add. To remove delegated administrator rights, under Delegated Roles in User Group Detail, locate the user to remove as delegated administrator and click the red X next to the user name.
PAGE 114
Navigate the Dell Server On the Manage Reports page, click Create New Report and select an option. An instance of that report opens to customize the information to display. See View Report. View Report On the Manage Reports page, select an option in Create New Report or click an existing report in the Name column. • • New report - An administrator can select Save As. Save, Rename, and Delete options are activated, and the report is saved to the Manage Reports page.
PAGE 115
Security Management Server Virtual v10.2.7 AdminHelp client. Data Guardian and Audit Events Get Started with Data Guardian Audit Events ATP Event Provides reports of events for the entire enterprise based on information available in the Dell Server. See Advanced Threat Events tab filters. EMS Event Provides data about events that occur when removable media is used. BitLocker Manager Customize a report to see if BitLocker is enabled and to view details. See Manager Detail (Windows only).
PAGE 116
Navigate the Dell Server Export to Excel or a .csv file. Add Schedule To add an email schedule for a report: 1. In the left pane of the Management Console, click Reporting > Manage Reports. 2. In Columns, click a report name then click Schedule. 3. In Schedules, click Add Schedule. 4. In Add Schedule, set the following parameters: 5.
PAGE 117
Security Management Server Virtual v10.2.7 AdminHelp Map visualization In Populations > Enterprise > Global Settings, if you enable the Data Guardian Geo Location Audit Data policy and have the operating system's geolocation API, audit events that are sent to the Dell Server include the geolocation data (latitude and longitude) of each device.
PAGE 118
Navigate the Dell Server • Protected Office (Windows, Mac, mobile, and web portal) - also applies to Cloud_Access_Security_Broker • System - Populates the user logged into or logged out of the device that has Data Guardian installed. • Content Based Protection - previously Data Classification (Windows) • Protected Email (Windows) - Relates to files other than protected Office documents. • Share (Windows) - Lists events when a user shares one or more files or attaches an encrypted file to an email.
PAGE 119
Security Management Server Virtual v10.2.7 AdminHelp Options can apply to all monikers or to a specific moniker. Policies must be enabled for audit data to display. Search icons in the columns - If you click next to an item in the device, user, file name, or key ID columns, it copies the cell content to Search and executes a search on that content. You can then select Action or IP address to do additional filtering.
PAGE 120
Navigate the Dell Server Protected Office Document or Basic File Protection audit events (Windows, Mac, mobile, web portal, CASB) This table lists audit events that apply to Office documents or other files entered in Basic File Protection: • For Windows and Mac, audit events apply to Opt-in or Force Protected modes. • Mobile has Opt-in mode only.
PAGE 121
Security Management Server Virtual v10.2.7 AdminHelp detected on protected Office documents but not .xen files. Modified Repaired tampering Tampering was detected in the wrapper of the protected Office document, which contains the cover page that opens in the cloud or on a device that does not have Data Guardian installed. Data Guardian repaired the wrapper or cover page.
PAGE 122
Navigate the Dell Server Process Name (Windows only and Data Guardian v2.7 and earlier) The name of the process that was blocked, for example, Snipping Tool. Process Disposition (Windows only and Data Guardian v2.7 and earlier) Indicates whether the process has exited or has been terminated.
PAGE 123
Security Management Server Virtual v10.2.7 AdminHelp audit events Description earlier device portal Created Encrypt A new .xen file has been uploaded and encrypted. ● ● ● ● Modified Encrypt An existing .xen file has been modified in the cloud and encrypted. ● ● ● ● Unprotected Decrypt Data Guardian decrypted a .xen file. ● ● ● ● Deleted Deleted A user deleted a .xen file from the cloud sync folder or cloud storage provider. ● ● ● ● Accessed Decrypt A user accessed a .
PAGE 124
Navigate the Dell Server • Audit - If a rule in the Categories list has a priority of two and higher, audit events are created. • Encrypt - If the Encrypt check box is selected for a rule in the Categories list, the file was encrypted based on the rules set. Public rule has no actions. Content Rule Triggers The rules that cause the actions to occur. Column options for Protected Email only (Windows) Audit Event - Column options Description Email Keyid The Key ID used to protect the email.
PAGE 125
Security Management Server Virtual v10.2.7 AdminHelp Options_in_the_Columns_menu, Cloud Encryption audit events, and Protected_Office_Document_or_Basic_File_Protection_audit_events. Example of drilling in at the map level 1. In the global view, drill in to a marker cluster and select a blue marker. 2. Select the Show only visible check box for the columns to list only the files for that audit event. 3. Click next to a device, user, file name, or key ID.
PAGE 126
Navigate the Dell Server • Detected tampering • Repaired tampering If these options display, determine any potential issues. 8. For Windows, in Moniker, select System. In Action, select Login and Logout to identify a user who logged into the device that has Data Guardian installed. 9. Analyze the data in the Management Console or select Export File > Excel or CSV where you can sort the data. Optionally, you can export the audit events to a SIEM server.
PAGE 127
Security Management Server Virtual v10.2.7 AdminHelp 5. Analyze the data in the Management Console or click Export File > Excel or CSV where you can sort the data. Optionally, you can export the audit events to a SIEM server. 6. Clear Search and press Enter to return to the global map view. Audit Cloud Encryption (Mac or mobile) To audit protected .xen files only: 1. In Moniker, select Cloud Encryption. 2. In More, select Action and Cloud Action. 3.
PAGE 128
Navigate the Dell Server Event Data Event data displays below the map about the events represented on the map. Narrow the amount of data displayed by using the + icon in the upper left corner of the map to zoom in. Expand the amount of data displayed by using the - icon in the upper left corner of the map to zoom out.
PAGE 129
Security Management Server Virtual v10.2.7 AdminHelp Export to Local File allows export of audit events to a file. Enter the location in which to store the file. This option also provides a backup of the audit events database. Export to Syslog allows specification of the syslog server to which to export the file. If TCP protocol is not selected, select it. 4. Click Save Preferences.
PAGE 130
Navigate the Dell Server 07-10-2017 16:27:02.653 -0500 INFO TcpInputProc - Creating raw Acceptor for IPv4 port 5540 with SSL 07-10-2017 16:27:02.653 -0500 INFO TcpInputProc - Creating raw Acceptor for IPv4 port 5541 with Non-SSL 07-10-2017 16:27:02.654 -0500 INFO TcpInputProc - Creating fwd data Acceptor for IPv4 port 9997 with Non-SSL 3. Configure the Dell Server to communicate with the Splunk server and export audit events. Use the keytool command to add the Splunk server's root certificate (cacert.
PAGE 131
Security Management Server Virtual v10.2.7 AdminHelp Select this option to send device events to the Syslog server. • When a new device is registered, two messages for this event are received: Registration and SystemSecurity. Example Message for Device Registered Event: • When a device is removed. Example Message for Device Removed Event: • When a device’s policy or logging level has changed.
PAGE 132
Navigate the Dell Server Selecting this option logs any newly found scripts that have been blocked or have triggered an alert to the Syslog server. Syslog Script Control events contain the following properties: • Alert: The script is allowed to run. A script control event is sent to the Dell Server. • Block: The script is not allowed to run. A script control event is sent to the Dell Server.
PAGE 133
Security Management Server Virtual v10.2.7 AdminHelp Specifies the type of Syslog server or SIEM that events are to be sent to. Protocol This must match what is configured on your Syslog server. The choices are UDP or TCP. UDP is generally not recommended as it does not guarantee message delivery. Dell recommends TCP (default). TLS/SSL Only available if the Protocol specified is TCP. TLS/SSL ensures the Syslog message is encrypted in transit from Advanced Threat Prevention to the Syslog server.
PAGE 134
Navigate the Dell Server EU (my-vs0-euc1.cylance.com and my-vs1-euc1.cylance.com): 52.28.219.170 52.29.102.181 52.29.213.11 Note: This IP Address should remain static. For the latest IP addresses for Syslog messages, contact Dell ProSupport. Management Commit Policies Uncommitted policies display in a badge icon in the top left of the Management Console. Click the badge icon to navigate to Management > Commit. To commit polices that have been modified and saved: 1.
PAGE 135
Security Management Server Virtual v10.2.7 AdminHelp • And more severe - Select this option to include all areas of greater severity than the priority level you selected. • Date Range - Enter a Start Date and End Date to limit results to entries that occur between these dates. To insert dates into these fields, click the calendar icons to the right of the fields. • Time Range - If you entered a Date Range, further narrow the entries by entering a Start Time and End Time.
PAGE 136
Navigate the Dell Server 10. Under Actions, click the Recover link. Tip: Numbers are red and letters are blue. 11. Ask the user for the Shield ID and verify that it is correct or enter it into Shield ID. Shield IDs do not contain the letters B, O, Q, and S. 12. Ask the user for the 8, 16, or 32-character Endpoint Code (not case sensitive) and enter it into the appropriate field. Endpoint Codes contain only the letters A-F. 13.
PAGE 137
Security Management Server Virtual v10.2.7 AdminHelp password. If a password does not meet the criteria set by policy, a dialog displays, outlining the password criteria. used too recently, a dialog displays asking them to use a different password. If a password does not meet the criteria set by policy, a dialog displays, outlining the password criteria. dialog displays asking them to use a different password.
PAGE 138
Navigate the Dell Server Enable Federated Key Recovery If more than one Dell Server is part of a federation, to perform Encryption External Media Recovery across Dell Servers in the federation, enable federated key recovery: 1. Navigate to \conf\ and open the federatedservers.properties file. 2. Update the server.code property with a new a code, password or passphrase to be shared across Dell Servers in the federation.
PAGE 139
Security Management Server Virtual v10.2.7 AdminHelp Mac Recovery See the Encryption Enterprise for Mac Administrator Guide, available at dell.com/support for the most up-to-date recovery instructions. License Management License Management To view usage of Client Access Licenses (CALs) that you own and upload new licenses, click Management > License Management.
PAGE 140
Navigate the Dell Server Licensing 1. 2. License structure: a. Disk Encryption (DE) – Dell Encryption (Windows and Mac), Encryption External Media , SED Management, Full Disk Encryption, BitLocker Manager. b. Encryption External Media (EME) c. Dell Data Guardian (CE) d. Threat Protection (TP) - includes Malware Protection and/or Client Firewall and/or Web Protection features e.
PAGE 141
Security Management Server Virtual v10.2.7 AdminHelp 1. In the left pane of the Management Console, click Management > License Management. 2. Under Upload Licenses, click Choose File to browse to the location of the saved CAL. Related topics: CAL Information License Management Services Management Services Management From the left pane of the Management Console, select Management > Services Management.
PAGE 142
Navigate the Dell Server You will need your backed up certificate to recover the Advanced Threat Prevention service. 1. In the left pane of the Management Console, click Management > Services Management. 2. Click Recover Advanced Threat Prevention Service. 3. Follow the guided service recovery dialogs and upload the Advanced Threat Prevention certificate when prompted. Enroll for Advanced Threat Prevention Agent Auto Updates You can enroll to receive Advanced Threat Prevention agent auto updates.
PAGE 143
Security Management Server Virtual v10.2.7 AdminHelp 2. Select the Product Notifications tab. 3. Click On then click Save Preferences. Note: The product notification switch does not display when servers are configured in disconnected mode. Stop receiving product notifications To stop receiving product notifications: 1. In the left pane of the Management Console, click Management > Services Management. 2. Select the Product Notifications tab. 3. Click Off then click Save Preferences.
PAGE 144
Navigate the Dell Server Email Frequency: Select how often alerts of this type. The default frequency is 24 hours. 3. Click Add when complete. To edit an alert: • Select the alert to change, click Edit, make the changes, and press Enter. To delete an alert: • Select the alert to delete, and click Delete. Related topics: License Management Enable SMTP Server for Email Notifications Use this procedure to enable the SMTP server for email notifications for purposes outside of Data Guardian.
PAGE 145
Security Management Server Virtual v10.2.7 AdminHelp 11. A Service alert reminder is triggered when the reminder interval has passed after a notification is sent about a system health issue and the host or service remains in the same state. 12. In the Summary Report, to enable reports of notifications, select the desired interval (daily, weekly, or monthly) and then press the space bar to enter an X in the field. 13. Select OK.
PAGE 146
Navigate the Dell Server 1. In the left pane, click Reporting > Audit Events. 2. In the user column, click to the right of the user name to add to the blacklist. Key Request Data Guardian external users can request a key from an internal user to access a protected Office document. Key requests are shown on the Key Request Management page until the internal user approves or denies the request. After 48 hours, key requests are removed from the list. At that time, external users can request access again.
PAGE 147
Security Management Server Virtual v10.2.7 AdminHelp Key Management The administrator can manage key ownership. The keyid is available here: • Reporting > Audit Events > Columns > File KeyID. See Options_in_the_Columns_menu. • On the client side, a user can right-click a protected file to see the KeyID. To find/change the owner for a key: 1. In the left pane, navigate to Management > Data Guardian Management. 2. Select the Key Management tab. 3. Enter the keyid and click Find Owner.
PAGE 148
Navigate the Dell Server The new password must be at least 6 characters, contain at least one capital letter and one of these characters: ~@#$%^*()|?!{}[]. 4. Confirm the new password. 5. Click Update. After three failed login attempts, the superadmin account is locked for five minutes. To change these settings, see Set or Change Account Lockout Settings. Change Account Lockout Settings After three failed login attempts, the superadmin account is locked for five minutes. To change these settings: 1.
PAGE 149
Security Management Server Virtual v10.2.7 AdminHelp To download the latest version of Endpoint Security Suite Enterprise (ESSE): 133 1. In the left pane, click Management > Downloads. 2. Select the Endpoint Software tab. 3. Click Dell Support to contact Dell for access to Dell Endpoint Security Suite Enterprise.
PAGE 150
PAGE 151
Manage Policies Manage Security Policies You can apply security policies at the Enterprise, Domain, User Group, User, Endpoint Group, and Endpoint levels. Default policy settings allow your enterprise to get started with Dell security, but you should customize the security and configuration settings. If you've migrated from an earlier version of Dell Server, your policy settings have been migrated for you. Security policies are grouped by technology.
PAGE 152
Manage Policies Icons and their meanings: The master switch for policies in the subgroup is On, which means the policy group is enabled. Policies in the group are sent to clients when policies are committed. Policies in the subgroup are not enabled. At least one default setting in the policy group has been overridden. Group of policy settings that has no master switch. The policy change is not yet committed.
PAGE 153
Security Management Server Virtual v10.2.7 AdminHelp 2. Click the Security Policies tab. 3. Select the technology group, such as Windows Encryption, or policy group, such as PolicyBased Encryption, to modify. 4. Select a language for localizable policies from the list at the top right of the screen. 5. Enter text that is in the language you selected for localizable policies. Navigate the populations and technology groups as necessary to localize all desired policies for that language. 6.
PAGE 154
Manage Policies The following policies can be displayed in a selected language on the endpoint computer: Enterprise Level Technology Group Policy Windows Encryption > Full Disk Encryption Support Information Text Full Disk Encryption Title Text Legal Notice Text Self Help Questions Windows Encryption > Self-Encrypting Drive (SED) Support Information Text PBA Title Text Legal Notice Text Self Help Questions (Pre-8.
PAGE 155
Security Management Server Virtual v10.2.
PAGE 156
Manage Policies Legal Notice Text Self Help Questions (Pre-8.
PAGE 157
Security Management Server Virtual v10.2.7 AdminHelp Full Disk Encryption (FDE) Encryption Algorithm Encryption Mode Enable FDE Plugin Off On Off Toggle to ON to enable all full disk encryption policies. If this policy is toggled to OFF, no full disk encryption takes place, regardless of other policy values. On means that all Full Disk Encryption policies are enabled. Changing the value of this policy triggers a new sweep to encrypt/decrypt files.
PAGE 158
Manage Policies Choose a key to indicate who can access files encrypted by Application Data Encryption List, and where. More... Common for these files to be accessible to all managed users on the computer where they were created (the same level of access as Common Encrypted Folders), and encrypted with the Common encryption algorithm.
PAGE 159
Security Management Server Virtual v10.2.7 AdminHelp -^@%ENV:SYSTEMDRIVE%\;vol -^%ENV:SYSTEMDRIVE%\Program Files\PGP Corporation -^3%ENV:SYSTEMDRIVE%\PGPWDE00 -^3%ENV:SYSTEMDRIVE%\PGPWDE01 -^3%ENV:SYSTEMDRIVE%\PGPWDE02 -^3%ENV:SYSTEMDRIVE%\PGPWDE03 -^%ENV:SYSTEMDRIVE%\Program Files\Symantec -^%ENV:SYSTEMDRIVE%\Program Files (x86)\Symantec -^%ENV:SYSTEMDRIVE%\Program Files\Common Files\Symantec Shared -^%ENV:SYSTEMDRIVE%\Program Files (x86)\Common Files\Symantec Shared -^%ENV:SYSTEMDRIVE%\ProgramData\Symante
PAGE 160
Manage Policies If the same folder is specified in both this policy and the User Encrypted Folders policy, this policy prevails. See advanced settings Policy Default Setting Description Bitlocker Encryption This technology manages Microsoft BitLocker policies for full disk and removable media encryption. BitLocker Encryption TPM Manager Enabled Disable Sleep Mode Encrypt System Drive Not Managed Managed Not Managed Toggle to Managed to enable BitLocker Manager policy settings.
PAGE 161
Security Management Server Virtual v10.2.7 AdminHelp Encrypt Fixed Drives Encrypt Removable Drives Require Additional Authentication at System Startup Allow BitLocker Encryption Without a Compatible TPM 145 Do Not Manage Do Not Manage Turn On Encryption Turn Off Encryption This policy does not encrypt the system drive. To also encrypt the system drive, make sure that Encrypt System Drive Only is also Turn On Encryption. Do Not Manage ignores Fixed Drives.
PAGE 162
Manage Policies Configure TPM Startup Configure TPM Startup PIN Configure TPM Startup Key Configure TPM Startup Key and PIN Encryption Method and Cipher Strength (OS Volumes) Allow Do Not Allow Require Allow On computers with a compatible TPM, three types of authentication are supported.
PAGE 163
Security Management Server Virtual v10.2.7 AdminHelp Encryption Method and Cipher Strength (Removable Volumes) Encryption Method and Cipher Strength (Fixed Volumes) AES-128 AES-128 AES-256 XTS-AES-128 (for use with Windows 10 Anniversary Edition and later) XTS-AES-256 (for use with Windows 10 Anniversary Edition and later) Algorithm and cipher strength used by BitLocker Drive Encryption for Removable Volumes.
PAGE 164
Manage Policies other policy values. Selected allows a maintenance schedule to control application of policy that requires a reboot. Server Maintenance Schedule Repeats Port Control System SDE Encryption Enabled Weekly Daily, Weekly, Monthly, Quarterly, Annually The schedule configuration defines when the task should run. Daily: Runs the task every day at the specified Server Maintenance Schedule Start Time. Weekly: Runs the task weekly on the days specified in Server Maintenance Day of the Week.
PAGE 165
Security Management Server Virtual v10.2.7 AdminHelp triggers a new sweep to encrypt/decrypt files. See advanced settings Variables Some Windows policies support the following variables. A pathname can consist entirely of one or more of these variables, or can include one or more of these variables at any point. To get directory locations that these CSIDL values resolve to, go to http://msdn.microsoft.com/enus/library/bb762494.aspx. All names listed on the MSDN page are CSIDL_.
PAGE 166
Manage Policies APPDATA PRINTHOOD LOCAL_APPDATA ALTSTARTUP COMMON_ALTSTARTUP COMMON_FAVORITES INTERNET_CACHE COOKIES HISTORY COMMON_APPDATA WINDOWS SYSTEM PROGRAM_FILES PROGRAMFILES MYPICTURES PROFILE SYSTEMX86 PROGRAM_FILESX86 PROGRAMFILESX86 PROGRAM_FILES_COMMON PROGRAM_FILES_COMMONX86 COMMON_TEMPLATES COMMON_DOCUMENTS COMMON_ADMINTOOLS ADMINTOOLS CONNECTIONS COMMON_MUSIC COMMON_PICTURES COMMON_VIDEO RESOURCES PROFILES %HKCU:regpath% • Includes a numeric or text value stored in the registry for the curr
PAGE 167
Security Management Server Virtual v10.2.7 AdminHelp • Includes a numeric or text value stored in the registry for the local computer.
PAGE 168
Manage Policies Policy Default Setting Description Policy-Based Encryption This technology uses Dell's proprietary data centric encryption to allow user data and computer encryption. This allows greater protection over individual data than traditional full disk encryption, by limiting access on a computer to only what a user is authorized to view. Encrypt with SDE when SED is detected User Encrypted Folders Not Selected When Selected, this policy applies SDE encryption to self-encrypting drives.
PAGE 169
Security Management Server Virtual v10.2.7 AdminHelp winword.exe powerpnt.exe msaccess.exe wordpad.exe mspaint.exe excel.exe The following hard-coded system and installer process names are ignored if specified in this policy (you can also add to this list via the registry value HKLM\Software\Dell\CMGShield\EUWPrivilegedList): hotfix.exe, a Windows update process update.exe, a Windows update process setup.exe, a third-party installer process msiexec.exe, a third-party installer process wuauclt.
PAGE 170
Manage Policies String String - maximum of 100 entries of 500 characters each (up to a maximum of 2048 characters) When a service is managed by this policy, the service is started only after the user is logged in and the Encryption client is unlocked. This policy also ensures that the service managed by this policy is stopped before the Encryption client is locked during logoff. This policy can also prevent a user logoff if a service is unresponsive. More... Syntax is one Service name per line.
PAGE 171
Security Management Server Virtual v10.2.7 AdminHelp The scan priority levels are used in two ways. 1. These values correspond with the values used by the Microsoft SDK to set thread execution priority. 2. The client uses these values to introduce a delay in the encryption sweep after every single file is processed.
PAGE 172
Manage Policies Winlogon\CMGShield\GKConnectionsOverride. The client communicates with Policy Proxies using the GKPORT (the default is 8000). If necessary, change that port via the registry key HKLM\SOFTWARE\Microsoft\WindowsNT\Current Version\Winlogon\CMGShield\GKPort. Inherited values for this policy accumulate. For the client to connect to a Policy Proxy specified in this policy, it must be in the same group as the Policy Proxy specified during client installation.
PAGE 173
Security Management Server Virtual v10.2.7 AdminHelp Important: Allowing a user to pause encryption could allow the user to prevent the Encryption client from fully encrypting or decrypting data per policy. Suppress File Contention Notification Number of Encryption Processing Delays Allowed Selected This policy controls whether users see notification pop-ups if an application attempts to access a file while the client is processing it. More...
PAGE 174
Manage Policies Delays Allowed Allow Encryption Processing Only When Screen is Locked Hide Overlay Icons The number of times the user is allowed to delay reboot for device-based policy. False True, False, User-Optional When True, there is no encryption or decryption of data while the user is actively working. The client will only process data when the workstation screen is locked. When False, encryption processing occurs any time, even while the user is working.
PAGE 175
Security Management Server Virtual v10.2.7 AdminHelp Fixed Data Drives from Earlier Versions of Windows Do Not Install BitLocker to Go Reader on FAT Formatted Fixed Drives When Selected, fixed data drives with the FAT file system can be unlocked and viewed on computers running Windows Server 2008. This policy does not apply to drives that are formatted with the NTFS file system.
PAGE 176
Manage Policies Do Not Enable BitLocker Until Recovery Info is Stored in AD DS for Fixed Data Drives Allow Data Recovery Agent for Protected Fixed Data Drives Configure User Storage of BitLocker 48-digit Recovery Password Configure User Storage of BitLocker 256-bit Recovery Key Omit Recovery Options from the BitLocker Setup Wizard Save BitLocker Recovery Information to AD DS for Fixed Data Drives BitLocker Recovery Information to Store in AD DS Do Not Enable BitLocker Until Recovery Information is S
PAGE 177
Security Management Server Virtual v10.2.
PAGE 178
Manage Policies the identification field and allowed identification field. The allowed identification field is used in combination with the Deny Write Access to Removable Drives Not Protected by BitLocker policy to help control the use of removable drives in the organization. This policy must be set to Selected to use the policies Set Organizational Unique Identifiers and Set Allowed Organizational Unique Identifiers.
PAGE 179
Security Management Server Virtual v10.2.7 AdminHelp maximum of 20 digits. Allow Network Unlock at Startup on Operating System Drives Not Selected Selected Not Selected This policy specifies if a user is allowed to use the Network Unlock at Startup feature on operating system drives. Selected Selected Not Selected This policy specifies if a user is allowed to use SecureBoot on operating system drives.
PAGE 180
Manage Policies Omit Recovery Options from the BitLocker Setup Wizard Save BitLocker Recovery Information to AD DS for Operating System Drives BitLocker Recovery Information to Store in AD DS (Windows Server 2008 Only) Do Not Enable BitLocker Until Recovery Information is Stored in AD DS for Operating System Drives Configure Use of Hardware-Based Encryption for Operating System Drives Use HardwareBased Encryption for Operating System Drives Use BitLocker Software-Based Encryption on Operating System Dr
PAGE 181
Security Management Server Virtual v10.2.7 AdminHelp Operating System Drives Configure Specific Crypto Algorithms and Cipher Suites Settings on Operating System Drives Encryption Type for Operating System Drives Configure Use of Passwords for Operating System Drives Configure Password Complexity for Operating System Drives Minimum Password Length for Operating System Drives Require ASCII-Only Passwords for Operating System Drives Use Enhanced Boot Configuration Data Profile 2.16.840.1.101.3.4.1.2;2.16.
PAGE 182
Manage Policies BCD Settings Configure TPM Platform Validation Profile Configure Specific TPM Platform Settings Configure BIOS TPM Platform Validation Profile Exclude specific Boot Configuration settings. To use this policy, Use Enhanced Boot Configuration Data Profile must be set to Enabled. Not Selected Selected Not Selected Set to Selected to enable boot up TPM drive unlocking for Windows 7 and Windows Server 2008 R2.
PAGE 183
Security Management Server Virtual v10.2.7 AdminHelp PCR0,on PCR1,off PCR2,on PCR3,off PCR4,on PCR5,off PCR6,off PCR7,off PCR8,on PCR9,on PCR10,on PCR11,on PCR12,off PCR13,off PCR14,off PCR15,off PCR16,off PCR17,off PCR18,off PCR19,off PCR20,off PCR21,off PCR22,off PCR23,off This policy setting allows you to configure how the computer's TPM security hardware secures the BitLocker encryption key.
PAGE 184
Manage Policies Bitlocker Encryption - Removable Storage Settings Allow User to Apply BitLocker Protection on Removable Drives Allow User to Suspend and Decrypt BitLocker Protection on Removable Data Drives Configure Use of Smart Cards on Removable Data Drives Deny Write Access to Removable Drives Not Protected by BitLocker Allow Access to BitLocker Protected Removable Data Drives from Earlier Versions of Windows Do Not Install BitLocker to Go Reader on FAT formatted Removable Drives Configure Use of Pas
PAGE 185
Security Management Server Virtual v10.2.7 AdminHelp must be set to Allow or Require.
PAGE 186
Manage Policies to Store in AD DS for Removable Data Drives.
PAGE 187
Security Management Server Virtual v10.2.7 AdminHelp Server Encryption This technology manages Dell's data centric encryption using certificate-based authentication instead of the typical user-based authentication instead of the typical user-based authentication. This technology allows for protection of devices such as Windows Servers that do not commonly have users logged in. Off On Off This policy enables or disables System Data Encryption (SDE) and Common encryption on the client server.
PAGE 188
Manage Policies Port Control System policies. All PCS policies require a reboot before the policy takes effect. Port: Express Card Slot Enabled Enable, Disable, or Bypass ports exposed through the Express Card Slot. Port: USB Enabled Enable, Disable, or Bypass port access to external USB ports. Note: USB port-level blocking and HID class-level blocking is only honored if we can identify the computer chassis as a laptop/notebook form-factor.
PAGE 189
Security Management Server Virtual v10.2.7 AdminHelp (WPD): Storage Full Access: Port does not have read/write data restrictions applied. Read Only: Allows read capability. Write data is disabled. Blocked: Port is blocked from read/write capability. Class: Human Interface Device (HID) Enabled Control access to all Human Interface Devices (keyboards, mice). Note: USB port-level blocking and HID class-level blocking is only honored if we can identify the computer chassis as a laptop/notebook form-factor.
PAGE 190
Manage Policies when logged on to any encrypted device, regardless of the Dell Server the user activated against. The user cannot work with encrypted data using any unencrypted device. EMS Device Whitelist String - Maximum of 150 devices with a maximum of 500 characters per PNPDeviceID. Maximum of 2048 total characters allowed. "Space" and "Enter" characters count in the total characters used.
PAGE 191
Security Management Server Virtual v10.2.7 AdminHelp USBSTOR\DISK&VEN_SEAGATE&PROD_USB&REV_0409\2HC01 5KJ&0 VEN=Vendor; Green highlighted text is for the vendor to be excluded PROD=Product/Model Name; Adding text highlighted blue also excludes all of Seagate’s USB drives REV=Firmware Revision; Adding text highlighted gray also excludes the specific model being used Serial number (in this example); Adding text highlighted yellow excludes just this device OR To find the PNPDeviceID for removable media on Wind
PAGE 192
Manage Policies • Wipe Encryption Keys to delete the encryption keys on the media, making the encrypted data inaccessible until the owner takes the media to an encrypted computer for which he has a login. String EMS Access Code Authentication Failed. Please contact your system Required Message administrator. String - 5-512 characters - Authentication Failed: Please contact your system administrator.
PAGE 193
Security Management Server Virtual v10.2.7 AdminHelp ;ppt .doc.xls .pptx.docx .xlsx ^R#: \iPod_Control ;ppt.doc .xls.pptx .docx.xlsx ^R#:\Notes ;ppt.doc .xls.pptx .docx.xlsx ^R#:\Photos ;ppt.doc .xls.pptx .docx.xlsx Replacing these five rules with the following rule will force encryption of ppt, pptx, doc, docx, xls, and xlsx files in any directory on the iPod, including Calendars, Contacts, iPod_Control, Notes, and Photos: ^R#:\;ppt.doc.xls .pptx.docx.
PAGE 194
Manage Policies -^%ENV:SYSTEMROOT%\System32 applying patch updates. -^%ENV:SYSTEMROOT%\SysWow64 Contact ProSupport for guidance if you are unsure about changing the -^%ENV:SYSTEMROOT%\WinSxS values. -^%ENV:SYSTEMROOT%\Fonts ^3@%ENV:SYSTEMROOT%\SYSTEM32\;exe -^3@%ENV:SYSTEMROOT%\SYSTEM32\cmd.exe;exe -^3@%ENV:SYSTEMROOT%\SYSTEM32\autochk.exe;exe -^3%ENV:SYSTEMDRIVE%\ProgramData\Dell\Kace -^3%ENV:SYSTEMDRIVE%\Program Files\Dell\Kace -^3%ENV:SYSTEMDRIVE%\Program Files (x86)\Dell\Kace Encryption Enabled Select
PAGE 195
Security Management Server Virtual v10.2.7 AdminHelp Dell strongly recommends not listing applications or installers that write system-critical files. Doing so could result in encryption of important system files, which could make a Windows computer unbootable. Common process names: outlook.exe winword.exe powerpnt.exe msaccess.exe wordpad.exe mspaint.exe excel.
PAGE 196
Manage Policies Once encryption is complete, this policy determines what happens to the unencrypted residue of the original files: • No Overwrite deletes it. This value yields the fastest encryption processing. • Single-pass Overwrite overwrites it with random data. • Three-pass Overwrite overwrites it with a standard pattern of 1s and 0s, then with its complement, and then with random data.
PAGE 197
Security Management Server Virtual v10.2.7 AdminHelp is 8000). If necessary, change that port via the registry key HKLM\SOFTWARE\Microsoft\WindowsNT\Current Version\Winlogon\CMGShield\GKPort. Inherited values for this policy accumulate. For the client to connect to a Policy Proxy specified in this policy, it must be in the same group as the Policy Proxy specified during client installation. Because the client supports up to 255 users per computer, this policy is available only at the Enterprise level.
PAGE 198
Manage Policies FONTS TEMPLATES COMMON_STARTMENU COMMON_PROGRAMS COMMON_STARTUP COMMON_DESKTOPDIRECTORY APPDATA PRINTHOOD LOCAL_APPDATA ALTSTARTUP COMMON_ALTSTARTUP COMMON_FAVORITES INTERNET_CACHE COOKIES HISTORY COMMON_APPDATA WINDOWS SYSTEM PROGRAM_FILES PROGRAMFILES MYPICTURES PROFILE SYSTEMX86 PROGRAM_FILESX86 PROGRAMFILESX86 PROGRAM_FILES_COMMON PROGRAM_FILES_COMMONX86 COMMON_TEMPLATES COMMON_DOCUMENTS COMMON_ADMINTOOLS ADMINTOOLS CONNECTIONS COMMON_MUSIC COMMON_PICTURES 182
PAGE 199
Security Management Server Virtual v10.2.7 AdminHelp COMMON_VIDEO RESOURCES PROFILES %HKCU:regpath% • Includes a numeric or text value stored in the registry for the current user. If you specify a path but not an item, the client uses the default value %HKLM:regpath% • Includes a numeric or text value stored in the registry for the local computer.
PAGE 200
Manage Policies The Encryption client has several directories that are, by default, protected from encryption. The level of protection varies from folder to folder. If a folder is protected, then the only way to encrypt data within that directory is to use the override modifier described in Modifiers – What they are and what they do. There are four levels (categories) of protection that directories and files can have: 0, 1, 2, and 3. Category 3 is the most protected level.
PAGE 201
Security Management Server Virtual v10.2.7 AdminHelp Encrypting/Not Encrypting Directories To include or exclude directories using encryption rules, use the following within your rules: • After specifying your directory location, you do not need to list a trailing backslash (\). • If you list a directory for inclusion, every file contained within that directory is encrypted. • The Override command (^) can be used with folders only when specifying an exclusion policy.
PAGE 202
Manage Policies files with the extension doc, docx, xls, xlsx, ppt, and pptx in the protected directories and in the folder “MyApplicationFolder”. Example 2 of competing directives: C:\ -C:\MyApplicationFolder ^C:\;doc.xls.ppt.docx.xlsx.pptx -^C:\MyApplicationFolder;doc.xls.ppt.docx.xlsx.
PAGE 203
Security Management Server Virtual v10.2.
PAGE 204
Manage Policies %ENV:SYSTEMDRIVE%\CustomApplication What this does: This lists the folder \CustomApplication\ for encryption on the default drive where Windows is installed. -%ENV:USERPROFILE%\Desktop What this does: This lists the user who is logged in to have their desktop obtain a category 0 protection. Application Data Encryption (ADE) ADE encrypts any file written by a protected application, using a category 2 override.
PAGE 205
Security Management Server Virtual v10.2.7 AdminHelp encryption by SDE. This allows the SDE key to be used to encrypt data that would not otherwise be possible with the Common or User keys due to time-based availability of the keys. Due to the difference in how the SDE key can be used, there are several caveats to be aware of when considering use of this feature. • The built-in exclusions covered in protected directories do not apply to SDE.
PAGE 206
Manage Policies The Removable Drive rule can only be used within an Encryption External Media Encryption Rules policy. Remove System Data Encryption (SDE) To completely decrypt SDE encrypted files, apply the following policies: SDE Encryption Enabled = Not Selected Encrypt Windows Paging File = Not Selected Secure Windows Credentials = Not Selected Authentication Authentication Authentication policies allow you to configure user experience and Windows authentication.
PAGE 207
Security Management Server Virtual v10.2.7 AdminHelp Administrators Logon Authentication Policy for Users Windows Password None Fingerprints Contactless Card Windows Password and None The possible VALUES are: Windows Password None Fingerprints Contactless Card One-Time Password See advanced settings Microsoft Passport This technology allows the use of Microsoft Passport, specifically authentication attempts and PIN usage.
PAGE 208
Manage Policies Support Information Text PBA Title Text Sync Users at PBA Activation Legal Notice Text Self Help Questions (Pre-8.0 clients) String Please contact your system administrator. 0-17 characters Not Selected String 0-512 characters Text to display on the PBA support information screen. Customize the message to include specific instructions about how to contact the help desk or Security administrator.
PAGE 209
Security Management Server Virtual v10.2.7 AdminHelp Initial Access Code String 1-100 characters Encryption Administrator Password String String 1-100 characters This policy is used to log on to a computer when network access to Dell Server and Active Directory (AD) are both unavailable. The Initial Access Code policy should only be used if absolutely necessary, it is not the recommended method to log in.
PAGE 210
Manage Policies Length of Forced Shutdown/Restart Notice Allow PBA to Remember User Name Crypto Erase Password Enable Client Check for PBA Commands 60 seconds Selected String 0-100 characters Not Selected 60-1800 seconds When user has reached the maximum number of authorized shutdown/restart snoozes/delays, this policy sets the number of seconds allowed before forcing a shutdown/restart. TPM requires a reboot. SED requires a shutdown.
PAGE 211
Security Management Server Virtual v10.2.7 AdminHelp In-session Authentication Policy for Users Recovery Questions for Windows Authentication Allow Recovery Questions 195 Windows Password and None The possible VALUES are: Windows Password None Fingerprints Contactless Card One-Time Password At least 3 selectable questions Specify the questions to present to Windows users during recovery questions setup. Separate each question by a carriage return.
PAGE 212
Manage Policies Log Events Level False Accept Rate of Fingerprint Audit Errors Audit Details Level of detail in Windows Event logs. Determines whether events such as fingerprint registration and authentication attempts are logged in the Windows Event log. Each higher level includes all previous levels. Events are logged on the computer where they occur. Normally, the auditing level provides sufficient detail, covering all logon, authentication, fingerprint management, and user management events.
PAGE 213
Security Management Server Virtual v10.2.7 AdminHelp Reminder to Enroll Credentials Expiration Date (Admin) Now Reminder to Enroll Credentials (User) In one day Reminder to Enroll Credentials Expiration Date (User) Action Upon Smart Card Removal Now Lock Workstation The date (time is always 12 am) when authentication policy is going into full effect. Meaning, the client stops asking the local administrator to enroll credentials and forces them to enroll before they can logon. The default is “now”.
PAGE 214
Manage Policies execution. Abnormal Executable Auto Quarantine with Executable Control Enabled Selected Selected Not Selected If selected, Abnormal executable files are automatically quarantined or blocked to prevent their execution. Note: If you Auto Quarantine, it is highly recommended that before deployment, you test Auto Quarantine only on devices using a test policy to observe the behavior and ensure that no business-critical applications are blocked at execution.
PAGE 215
Security Management Server Virtual v10.2.7 AdminHelp the server. Action on Malicious Activity for Registry On-Access Protection Block and Report Selected Block Only Report Only Block and Report Prevents users from modifying or deleting Threat Protection registry keys and values and sets the action to take upon attempt. Block Only: Blocks activity but does not report to the Server. Report Only: Reports activity to the Server but does not block activity.
PAGE 216
Manage Policies Enable Secure Search Block Links to Risky Sites in Search Results Not Selected Selected Not Selected A Selected value enables Secure Search, automatically blocking malicious sites in search results based on safety rating. Not Selected Selected Not Selected A Selected value prevents users from clicking links to risky sites in search results.
PAGE 217
Security Management Server Virtual v10.2.7 AdminHelp mitigation policy is in effect for that violation type. Low 1) A file that was identified as a threat has been added to the Global Safe List or deleted from the file system. 2) A threat has been detected and automatically quarantined. 3) A file has been identified as a threat, but waived on the computer. 4) The status of a current threat has changed (for example, Threat > Quarantined, Quarantined > Waived, or Waived > Quarantined).
PAGE 218
Manage Policies Selected Not Selected Unsafe Executable Auto Quarantine With Executable Control Enabled Unsafe Executable Auto Upload Enabled Abnormal Executable Auto Quarantine With Executable Control Enabled Abnormal Executable Auto Upload Enabled Allow Execution of Files in Exclude Folders Auto Delete Days until Deleted Selected Selected If selected, Unsafe executable files are automatically quarantined or blocked to prevent their execution.
PAGE 219
Security Management Server Virtual v10.2.7 AdminHelp \Program Files\McAfee\Agent\maconfig.exe \Program Files\McAfee\Agent\masvc.exe \Program Files\McAfee\Agent\x86\FrmInst.exe \Program Files\McAfee\Agent\x86\macompatsvc.exe \Program Files\McAfee\Agent\x86\marepomirror.exe \Program Files\McAfee\Agent\x86\McScanCheck.exe \Program Files\McAfee\Agent\x86\McScript_InUse.exe \Program Files\McAfee\Agent\x86\mctray_back.exe \Program Files\McAfee\Agent\x86\Mue.exe \Program Files\McAfee\Agent\x86\policyupgrade.exe \P
PAGE 220
Manage Policies Security Platform\VSCore_ENS_10.1\Release\vtpinfo.exe \Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\x64\aacinfo.exe \Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\x64\cacheinfo.exe \Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\x64\fwinfo.exe \Program Files\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\x64\mfecanary.exe \Program Files\McAfee\Endpoint Security\End
PAGE 221
Security Management Server Virtual v10.2.7 AdminHelp Security\Endpoint Security Platform\RepairCache\CCUninst.exe \Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\Release\aacinfo.exe \Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\Release\cacheinfo.exe \Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platform\VSCore_ENS_10.1\Release\fwinfo.exe \Program Files (x86)\McAfee\Endpoint Security\Endpoint Security Platfo
PAGE 222
Manage Policies Platform\VSCore_ENS_10.1\x64\vtpinfo.exe \Program Files (x86)\McAfee\Endpoint Security\Web Control\McChHost.exe \Program Files (x86)\McAfee\Endpoint Security\Web Control\mfewc.exe \Program Files (x86)\McAfee\Endpoint Security\Web Control\mfewch.exe \Program Files (x86)\McAfee\Endpoint Security\Web Control\mfewcui.exe \Program Files (x86)\McAfee\Endpoint Security\Web Control\RepairCache\McAfee_Web_Control_x64.msi \Program Files (x86)\McAfee\Endpoint Security\Web Control\RepairCache\setupWC.
PAGE 223
Security Management Server Virtual v10.2.7 AdminHelp Exploitation: Overwrite Code Exploitation: Scanner Memory Search Exploitation: Malicious Payload 207 Alert Ignore Alert Block Terminate Specify the action to take when an overwrite code threat is detected. Ignore - No action is taken against identified memory violations. Alert - Record the violation and report the incident to the Dell Server. Block - Block the process call if an application attempts to call a memory violation process.
PAGE 224
Manage Policies Process Injection: Remote Allocation of Memory Process Injection: Remote Mapping of Memory Process Injection: Remote Write to Memory Alert Ignore Alert Block Terminate Specify the action to take when a remote memory allocation threat is detected. Ignore - No action is taken against identified memory violations. Alert - Record the violation and report the incident to the Dell Server. Block - Block the process call if an application attempts to call a memory violation process.
PAGE 225
Security Management Server Virtual v10.2.7 AdminHelp Process Injection: Remote Write PE to Memory Process Injection: Remote Overwrite Code Process Injection: Remote Unmap of Memory 209 Alert Ignore Alert Block Terminate Specify the action to take when a remote attempt to write a portable executable to memory threat is detected. Ignore - No action is taken against identified memory violations. Alert - Record the violation and report the incident to the Dell Server.
PAGE 226
Manage Policies Process Injection: Remote Thread Creation Process Injection: Remote APC Scheduled Process Injection: Remote DYLD Injection (Mac OS X only) Alert Ignore Alert Block Terminate Specify the action to take when a remote thread creation threat is detected. Ignore - No action is taken against identified memory violations. Alert - Record the violation and report the incident to the Dell Server. Block - Block the process call if an application attempts to call a memory violation process.
PAGE 227
Security Management Server Virtual v10.2.7 AdminHelp Escalation: LSASS Read Escalation: Zero Allocate Alert Ignore Alert Block Terminate Specify the action to take when an LSASS read threat is detected. Ignore - No action is taken against identified memory violations. Alert - Record the violation and report the incident to the Dell Server. Block - Block the process call if an application attempts to call a memory violation process. The application that made the call is allowed to continue to run.
PAGE 228
Manage Policies Watch for New Files Set Maximum Archive File Size to Scan Selected 150 MB Selected Not Selected If selected, any new or modified files are detected and analyzed for dormant threats. Dell recommends enabling this policy. However, If Auto Quarantine is enabled for all Unsafe or Abnormal files, all malicious files are blocked at execution.
PAGE 229
Security Management Server Virtual v10.2.7 AdminHelp Enable Change Window Not Selected Selected Not Selected If selected, Application Control is temporarily disabled to allow, edit, and run new applications or perform updates. This includes updating the Advanced Threat Prevention agent. After performing the necessary changes, deselect Enable Change Window. Note: Enable Change Window retains changes made to Application Control.
PAGE 230
Manage Policies Enable Approve Scripts in Folders (and Subfolders) Approve Scripts in Folders (and Subfolders) Quarantine Waive Global Allow Global Quarantine List Global Safe List Not Selected String Selected Not Selected Allows scripts stored in specific folders to be automatically approved to run. This policy must be selected to use the Script Control Approve Scripts in Folders (and Subfolders policy). This policy does not apply to Mac clients.
PAGE 231
Security Management Server Virtual v10.2.7 AdminHelp Minimum Popup Notification Level Enable BIOS Assurance Enable Auto-upload of Log Files Enable Standard UI High Selected Not Selected Not Selected High Medium Low Severity level of events that result in popup notifications that display on the client computer. A setting of High allows only notifications of critical events to display. A setting of Low displays all on-screen notifications for all events.
PAGE 232
Manage Policies Threat Protection Action on Malicious Activity for Files and Folders Action on Malicious Activity for Registry Action on Malicious Activity for Processes Exclude Processes On Off Toggle to ON to enable Threat Protection. If toggled to OFF, no Threat Protection policies are applied. Threat Protection includes Malware Protection, Web Protection, and Client Firewall.
PAGE 233
Security Management Server Virtual v10.2.7 AdminHelp Day of the Week Day of the Month Debug Logging for Malware and Exploit Protection Exploit Protection On-Access Protection Max Seconds for Scan Wednesday 1 Not Selected Sunday, Monday, Tuesday, Wednesday, Thursday, Friday, Saturday The day of the week the task should run. 1-31 The day of the month the task should run. Example: 17. Selected Not Selected A Selected value enables debug logging of Malware and Exploit Protection activity.
PAGE 234
Manage Policies Reputation Service Sensitivity On-Demand Protection - Full Scan Medium Disable Very Low Low Medium High Very High When enabled, samples are submitted to the lab to determine if they are malware. Sensitivity level configures the sensitivity level to use when determining if a detected sample is malware. The higher the sensitivity level, the higher the number of malware detections. However, allowing more detections might result in more false positive results.
PAGE 235
Security Management Server Virtual v10.2.7 AdminHelp Unwanted Programs Decode MIME Files Scan Archives Files Migrated to Storage Program Threats Macro Threats Scan Subfolders 219 Selected Selected Not Selected Enables the scanner to detect potentially unwanted programs. The scanner uses configured information to detect potentially unwanted programs. Not Selected Selected Not Selected Detects, decodes, and scans Multipurpose Internet Mail Extensions (MIME) encoded files.
PAGE 236
Manage Policies Reputation Service Sensitivity Exclusions Medium String Disable Very Low Low Medium High Very High When enabled, samples are submitted to the lab to determine if they are malware. Sensitivity level configures the sensitivity level to use when determining if a detected sample is malware. The higher the sensitivity level, the higher the number of malware detections. However, allowing more detections might result in more false positive results.
PAGE 237
Security Management Server Virtual v10.2.7 AdminHelp Threat First Response Threat First Response Fails Exploit First Response Exploit First Response Fails Use Scan Cache System Utilization Scan on Battery Power 221 Clean file Delete file Clean file Delete file Continue scanning Specifies the first action for the scanner to take when a threat is detected. Clean files - Removes the threat from the detected file, if possible. Delete files - Deletes files with potential threats.
PAGE 238
Manage Policies Schedule Repeats Daily Schedule Start Time String Day of the Week Day of the Month Wednesday 1 Daily Weekly Monthly The schedule configuration defines when the task should run. Schedule types are Daily, Weekly, and Monthly. Daily: Runs the task every day at the specified Full-Scan Schedule Start Time. Weekly: Runs the task weekly on the days specified in Full-Scan Schedule Day of the Week. Monthly: Runs the task monthly on the specified Full-Scan Schedule Day of the Month.
PAGE 239
Security Management Server Virtual v10.2.7 AdminHelp Files Migrated to Storage Program Threats Macro Threats Scan Subfolders Reputation Service Sensitivity 223 Not Selected Selected Selected Selected Medium Selected Not Selected Scans files that remote storage manages. When the scanner encounters a file with migrated content, it restores the file to the local computer before scanning. Selected Not Selected Detects executable files that have code that resembles malware.
PAGE 240
Manage Policies String - Comma-separated list of parameters Specify files, folders, and drives to exclude from scanning. Comma separated list of parameters: ,, Possible values: ,, Exclusions String Examples: FileOrFolder,C:\Users,false FileType,xml,false FileType,mp?,false ModifiedAge,120,true AccessedAge,150,false Cre
PAGE 241
Security Management Server Virtual v10.2.7 AdminHelp Use Scan Cache Selected Selected Not Selected A Selected value enables the scanner to use the existing clean scan results. A Selected value reduces duplicate scanning and improves performance. Below Normal Low Priority Below Normal Normal Enables the operating system to specify the amount of CPU time that the scanner receives during the scan. Each task runs independently, unaware of the limits for other tasks.
PAGE 242
Manage Policies within your network allows client computers to obtain signature updates without accessing the Internet. See basic settings Policy Default Setting Description Web Protection This technology protects computers by leveraging a web-based content ranking system to determine if a site that a user is browsing is considered safe or not. This technology also grants the administrator the ability to define what happens when an unsafe site is navigated to (allow, block, warn).
PAGE 243
Security Management Server Virtual v10.2.
PAGE 244
Manage Policies Rating Action for Unrated Sites Rating Action for Red Downloads Rating Action for Yellow Downloads Rating Action for Unrated Downloads Allow Block Allow Warn Specifies the action to apply to sites that are Unrated. Block: Prevents users from accessing the site and displays a message that the site is blocked. Allow: Permits users to access the site. Allow is the default for Unrated sites. Warn: Displays a warning to notify users of potential dangers associated with the site.
PAGE 245
Security Management Server Virtual v10.2.7 AdminHelp with * are selected and blocked by default when this policy is selected.
PAGE 246
Manage Policies Gruesome Content Visual Search Engine Technical/Business Forums Gambling Related Messaging Game/Cartoon Violence Phishing* Personal Network Storage Spam URLs Interactive Web Fashion/Beauty Software/Hardware Potential Illegal Software Content Server Internet Services Media Sharing Incidental Nudity Marketing/Merchandising Parked Domain Pharmacy Restaurants Real Estate Recreation/Hobbies Blogs/Wiki Digital Postcards Historical Revisionism Technical Information Dating/Personals Motor Vehicles P
PAGE 247
Security Management Server Virtual v10.2.7 AdminHelp See Client Firewall Settings and Rules. Settings and Rules See basic settings Client Firewall Settings and Rules In the Client Firewall policy, Settings and Rules, click View/Edit. In the Settings window, you can set Client Firewall Options and Client Firewall Rules. Return to Client Firewall Policies Client Firewall Options Setting UI Control Description Protection Options Check box Allows all traffic that uses unsupported protocols.
PAGE 248
Manage Policies Setting UI Control Description Network Reputation Incoming network - reputation threshold Outgoing network - reputation threshold Setting Drop-down menu High Risk Unverified Do not block Medium Risk Specifies the rating threshold for blocking incoming or outgoing traffic from a network connection. High Risk - This source/destination sends or hosts potentially malicious content/traffic that is considered risky.
PAGE 249
Security Management Server Virtual v10.2.7 AdminHelp Number of seconds (1-300) before UDP and ICMP echo virtual connections time out Setting Up/down number selector Specifies the time, in seconds, that a UDP or ICMP Echo virtual connection remains active if no more packets matching the connection are sent or received. This option resets to its configured value every time a packet that matches the virtual connection is sent or received. The default number is 60; the valid range is 1–300.
PAGE 250
Manage Policies Check box Status Radio button/Check box Actions Drop-down menu Direction Text input field Notes Setting UI Control Select Enable rule to make the rule active. Allow Block Treat match as intrusion Log matching traffic Allow - Allows traffic through the firewall if the item is matched. Block - Stops traffic from passing through the firewall if the item is matched.
PAGE 251
Security Management Server Virtual v10.2.7 AdminHelp domain name IP address - Specifies the IP address to add to the network. Wildcards are valid. Transport Select the transport protocol from the menu. Transport protocol Drop-down menu Executables The name that you use for the executable to add or edit. Name String The file path to the executable. File path String Description of the executable.
PAGE 252
Manage Policies The MD5 hash of the process. String Fingerprint Enable digital signature check Check box Enables or disables the digital signature check that guarantees code has not been altered or corrupted since it was signed with a cryptographic hash. If enabled, specify: Allow any signature — Allows files signed by any process signer. Signed by — Allows only files signed by the specified process signer.
PAGE 253
Security Management Server Virtual v10.2.7 AdminHelp Process Injection: Remote DYLD Injection (Mac OS X only) Terminate Escalation: LSASS Read Terminate Escalation: Zero Allocate Terminate Watch for New Files Selected Advanced Threat Events tab fields and filters The Advanced Threat Events tab displays information about events for the entire enterprise based on information available in the Dell Server.
PAGE 254
Manage Policies To view additional threat information in the table, click the drop-down arrow on a column header to select and add columns. Columns display metadata about the file, such as Classifications, Cylance Score (confidence level), AV Industry conviction (links to VirusTotal.com for comparison with other vendors), Date first found, Data last found, SHA256, MD5, File information (author, description, version), and Signature details.
PAGE 255
Security Management Server Virtual v10.2.7 AdminHelp 3. Select Safe to add the selected items to the safelist, or select Remove from list to remove the selected files from the Global Quarantine list. Manually Add File to the Global Quarantine list 1. Click Edit Global List. 2. Click Add File. 3. Enter the file's SHA256 hash number (required). 4. Enter the file's MD5 number, if available. 5. Enter the file name, if available. 6. Enter the reason the file should be quarantined. 7. Click Submit.
PAGE 256
Manage Policies Columns display the file name, interpreter (PowerShell or ActiveScript), last found, drive type (such as internal hard drive), SHA256, Number of devices on which the script is found, and Number of occurrences that were blocked or triggered alerts. To filter column data, click the filter icon on a column header and select values to include or exclude.
PAGE 257
Security Management Server Virtual v10.2.7 AdminHelp Manage Enterprise Advanced Threats - Cylance Score and Threat Model Updates A Cylance score is assigned to each file that is deemed Abnormal or Unsafe. The score represents the confidence level that the file is malware. The higher the number, the greater the confidence. Threat Model Updates The predictive threat model used to protect devices receives periodic updates to improve detection rates.
PAGE 258
Manage Policies Identify Classifications To identify classifications that could impact your organization, Dell recommends the following approach: 1. Apply a filter to the New Status column to display all Unsafe, Abnormal, and Quarantined files. 2. Apply a filter to the Production Status column to display all Safe files. 3. Apply a filter to the Classification column to only show Trusted - Local threats. Trusted - Local files have been analyzed by Cylance and found to be safe.
PAGE 259
Security Management Server Virtual v10.2.7 AdminHelp Safelist the selected file from the Global Quarantine list to allow it to run on any device in the organization. 1. Select Global Quarantine (n). 2. Select a file. 3. Click Safe. Safe Safelisted files and certificates are permanently treated as safe across all devices. Any certificate that is safelisted is a known safe certificate for the Advanced Threat Prevention tenant.
PAGE 260
Manage Policies 1. Select Safe (n). 2. Select Certificates (n). 3. Select the certificate to remove from the safe list. 4. Click Remove from List. Unassigned Unassigned files can be added to the global quarantine or safe list. Add an unassigned file to the global quarantine list Add the selected file to the Global Quarantine list to prevent it from being run on any device in the organization. Adding a file to Quarantine removes it from lists of Unsafe or Unassigned files. 1. Select Unassigned (n).
PAGE 261
Security Management Server Virtual v10.2.7 AdminHelp 4. Enter the file's MD5 number, if available. 5. Enter the file name, if available. 6. Enter the reason the file should be safelisted. 7. Click Submit. Add the selected file to the Global Quarantine list to prevent it from being run on any device in the organization. Adding a file to Quarantine removes it from lists of Unsafe or Unassigned files. 1. Select Global Quarantine (n). 2. Select a threat. 3. Click Add File 4.
PAGE 262
Manage Policies Events - Lists all events related to the Threat Events graph on the dashboard for the last 30 days. This information includes file hash, device name, file path, and the date the event occurred. Indicators - Lists each threat and the associated threat characteristics. Cleared - Lists all files that have been cleared in your organization. This information includes files that were waived, added to the safe list, or deleted from the quarantine folder on a device.
PAGE 263
Security Management Server Virtual v10.2.7 AdminHelp 4. Right-click Desktop, click Permissions, then take ownership and grant yourself Full Control. 5. Right-click Desktop, then select New > Binary Value. 6. For the name, type CompatibilityMode. 7. Open the registry setting and change the value to 01. 8. Click OK, then close Registry Editor. 9. In the Management Console, enable the Memory Protection Enabled policy. If the Script Control policy was enabled, enable it. 10.
PAGE 264
Manage Policies Default Acme uxSYabW9P2nMbGLzuqJhvT9Y Date(-62135596800000+0000)
PAGE 265
Security Management Server Virtual v10.2.
PAGE 266
Manage Policies DOTlqlI7SLKw1uffUEk2QGv54bUQANLhbAvLbLR1b6v352rw3ANgECdQbqXcvKE/jYKUzHSW3qqI PcPnrguYVoJuydKNiJVmoaqPLJ3LC6m7+PdGBuqEdVo+MK/PMJdTVb47zW1RSYX0t9SJ/4xWEByb UMsHXRZTux6nlca5qCxHDiHb50I677Bi+Y0YLddza7iA7z4mPTRmqEX6jEo5ZorZ4kcTIbNHj77p 4kzouYDg3s+o+9KvoxcI0iw8MAOtKrRVZTN24jjSUAETJ66rb3JdzcfJJeb7w4QVOUckL2kfyaS4 ASp80fzpOxJl3hSLw2bnR2n0WukMhj3kWvY+GeXDBfGzHfDGeLV0pF/+hQTPR/XWuOSsnH1wUeJE XS3al6lyhcRCS7XbVPt+85NYGuk2ntf6zmST/v6a3E2exxerUDAmHfCK/0VQKrqlYec1hkH1SbvC Q==
PAGE 267
Security Management Server Virtual v10.2.
PAGE 268
Manage Policies • Contents of the Temp folder. By default, the scanner scans all file types, regardless of extension. Access Protection – Prevents other computers from making a connection and creating or altering autorun (autorun.inf) files from CDs. The rule prevents spyware and adware distributed on CDs from being executed and automatically blocks and reports such issues. Default: Selected (Enabled).
PAGE 269
Security Management Server Virtual v10.2.7 AdminHelp High - Use this setting for deployment to systems or areas which are regularly infected. This setting results in an average of 20-25 queries per day, per computer. Very High - Dell recommends using this level only for scanning volumes and directories that do not support executing programs or operating systems. Detections found with this level are presumed malicious, but have not been fully tested to determine if they are false positives.
PAGE 270
Manage Policies Rating Action for Yellow Sites - Specifies the action to apply to sites that are rated Yellow. Default: Warn. Rating Action for Unrated Sites - Specifies the action to apply to sites that are Unrated. Default: Allow. Rating Action for Red Downloads - Specifies the action to apply to file downloads that are rated Red. Default: Block. Rating Action for Yellow Downloads - Specifies the action to apply to file downloads that are rated Yellow. Default: Warn.
PAGE 271
Security Management Server Virtual v10.2.7 AdminHelp 8. In Order, set the sequence in which clients will contact the internal update server in relation to other update servers. Dell recommends that you set the Order for internal update servers to precede the Order for external update servers. 9. Select the type of repository or path to the update server: HTTP repository, FTP repository, UNC path, or Local path. 10. Enter the URL or path to the internal update server. 11.
PAGE 272
Manage Policies Monitor data To detect potential security risks, monitor audit events and create reports to identify who uses the data and how it is used.
PAGE 273
Security Management Server Virtual v10.2.7 AdminHelp This technology allows for files to be automatically encrypted prior to being uploaded to supported public clouds; this maintains ownership/control of all data encryption keys. The supported public cloud providers are Dropbox, Dropbox for Business, Box, OneDrive, OneDrive for Business, and Google Drive. Cloud Encryption (Mac; 2.3 and earlier for Windows) Off On Off Toggle On to enable Cloud Encryption policies.
PAGE 274
Manage Policies Policy Default Setting Description Protected Office Documents This technology allows for Office documents (Excel, PowerPoint, and Word) to be encrypted at the file level. Encryption travels with the file wherever it goes, inside or outside the network. Off On Off Toggle On to provide users with a menu option for protecting Office documents (.docx, .xlsx, .pptx, .docm, .xlsm, .pptm, and .pdf). On also allows you to enable other Protected Office policies.
PAGE 275
Security Management Server Virtual v10.2.7 AdminHelp Policy Default Setting Description Mobile Client This technology allows mobile phones and tablets access to encrypted content on supported public clouds, including Dropbox, Box, Google Drive, OneDrive, and OneDrive for Business. Data Guardian Off Off Cloud Protection Office Protected Documents Both Select one option or Both to use Data Guardian with mobile clients.
PAGE 276
Manage Policies Policy Default Setting Description Web Portal The Web Portal is a web-based client for creating and editing documents protected by Data Guardian. Edit Permission Selected Selected Not Selected Selected allows users to edit files within the web client. Selected Not Selected Selected allows external users to edit files within the web client. External User Edit Permission Not Selected Main Title Image (Enterprise only) Choose File button Image or logo to display on the login page.
PAGE 277
Security Management Server Virtual v10.2.7 AdminHelp Policy descriptions also display in tooltips in the Management Console. In this table, master policies are in bold font. Policy Default Setting Description Cloud Encryption This technology allows for files to be automatically encrypted prior to being uploaded to supported public clouds; this maintains ownership/control of all data encryption keys.
PAGE 278
Manage Policies Excluded Files (Windows) Server Polling Interval (Windows and Mac) String String C3901A99-1A1B-55B4-AE11-891207B1D341.xen Files excluded from encryption, separated by desktop.ini carriage returns. thumbs.db creddb.cef ~$* .~* ~*.tmp .DDPCE.attr *.lnk 360 minutes String Use this policy if software updates for users is located at an alternate Server URL. Software Update Server URL (Windows) Obfuscate Filenames (Mac; v2.3 and earlier for Windows) Folder Management Enabled (Windows- v2.
PAGE 279
Security Management Server Virtual v10.2.7 AdminHelp Protected Office Documents (Basic - Windows and Mac) Folder Exclusions for Basic File Protection (Windows and Mac) Off On Off Toggle On to provide users with a menu option for protecting Office documents (.docx, .xlsx, .pptx, .docm, .xlsm, .pptm, and .pdf). On also allows you to enable other Protected Office policies. If this policy is Off, no Office-protected formatting takes place, regardless of other policies.
PAGE 280
Manage Policies Print Control (Mac; Windows- v2.7 and earlier) Allowed Allowed Watermark Disabled Controls the Print function of protected Office documents (.docx, .xlsx, .pptx, .docm, .xlsm, .pptm, and .pdf): • Allowed - Print option is enabled for protected Office documents. • Watermark - Print option is enabled for protected Office documents but a watermark with the user's name, domain name, and computer ID displays on each page. Unprotected documents print without the watermark.
PAGE 281
Security Management Server Virtual v10.2.7 AdminHelp Protected Office Documents Cover Page Notice (Windows and Mac) Protected Office Documents Cover Page Corporate Logo (Windows and Mac) Protected Office Documents Cover Page Dell Server URL (Windows and Mac) Enable Callback Beacon Callback Beacon URL Hidden Audit Trail within Protected Office Document (Windows and Mac) 265 String Enterprise-defined text to be displayed on Officeprotected cover pages. Maximum number of characters is 4096.
PAGE 282
Manage Policies On Screen Watermark (Windows - 2.7 and earlier) Encrypt based on Titus Classification (Windows and Opt-in mode) Titus Classification Encryption Mapping (Windows and Opt-in mode) Allow File Exclusions Email Encryption via Outlook Not Selected Selected Not Selected Selected displays a watermark on the client computer screen when any protected Office file is open.
PAGE 283
Security Management Server Virtual v10.2.7 AdminHelp • Callback Beacon URL Hidden Audit Trail within Protected Office Document On Screen Watermark Server Polling Interval String Selected The Callback Beacon URL policy is set. Specifies the URL to be used when the callback beacon is inserted into Office-protected files. The URL, for example http://server.domain.com:8446, must be externally available, hosted on an HTTP server that is installed as part of Front End Server/Proxy Mode installation.
PAGE 284
Manage Policies Protected Office Documents Cover Page Notice Protected Office Documents Cover Page Corporate Logo Protected Office Documents Cover Page Dell Server URL Protected Office Document Tamper Prompt String Enterprise-defined text to be displayed on Officeprotected cover pages. See Set Cover Page Policies. Browse button and Save Logo File button Image to be displayed on the document cover page. See Set Cover Page Policies. The logo image must be a .
PAGE 285
Security Management Server Virtual v10.2.7 AdminHelp Guide. Callback Beacon URL Hidden Audit Trail within Protected Office Document On Screen Watermark Basic File Protection Basic File Protection Configuration • An administrator must have enrolled to receive Product Notifications. • The Callback Beacon URL policy is set. String Specifies the URL to be used when the callback beacon is inserted into Office-protected files. The URL, for example http://server.domain.
PAGE 286
Manage Policies • • Protected Office Documents policies have been enabled, but the user has not yet installed or activated Data Guardian. • User opens a protected Office document or .pdf from the cloud. • User downloads a protected Office document or .pdf to a device that does not have Data Guardian installed. Unauthorized users - The cover page displays, and the person cannot access the content.
PAGE 287
Security Management Server Virtual v10.2.7 AdminHelp • .txt .vsdx PowerPoint These applications are partially supported: • Add these applications if required by another application: • • • .bmp See .bmp_file. This file extension is partially supported: .odt Currently, when opened with Wordpad, a protected .odt file may not save new content. Add applicable extensions from above. Here are examples: RuntimeBroker.exe:png.rtf.txt.bmp CodeWriter.exe:rtf.txt Microsoft.Photos.
PAGE 288
Manage Policies To configure additional file types to be encrypted: 1. In the left pane, click Populations > Enterprise, enable the Protected Office Documents policy. 2. In the Data Guardian > Windows technology group, enable the Basic File Protection policy. Note: This policy applies to the Enterprise population only. Also, if you enable Allow File Exclusions, users must remove files from the Unprotected Documents folder for these file types to be swept and encrypted. 3.
PAGE 289
Security Management Server Virtual v10.2.7 AdminHelp Note: Do not add Office file extensions to this policy configuration. • NoNetwork – if users io to a network and files hang when users close them, add this to the application to prevent network save. 8. Before deploying Basic File Protection to the enterprise, be sure to test applications and file extensions in a test environment to ensure that the intended file types remain encrypted.
PAGE 290
Manage Policies Enter the string in this format: • Variable with a $VALUE format, for example, $HOME/Documents or $HOME/Hidden Note: For Force-protected mode, a sweep occurs in the /Users folder. Inform users of the impact or usability If you define a unique folder name in the Folder Exclusions for Basic File Protection policy so that users can store files of a specific type that should not be encrypted, the policy does not create that folder on the client computers.
PAGE 291
Security Management Server Virtual v10.2.7 AdminHelp • Windows Photo Viewer (Windows 8.1) This UWP application, is not supported and will not open a .bmp file: • RuntimeBroker.exe:bmp PhotosApp.exe (Windows 8.1) To add a Universal Windows Platform (UWP) application 1. In the Basic File Protection Configuration policy, enter the UWP application name. 2. Also enter the following process names: • RuntimeBroker.exe • sihost.
PAGE 292
Manage Policies If the Protected Office Documents policy is Off, no Office-protected formatting takes place, regardless of other policies. Policy Windows and Mac Enterprise > Data Guardian > Protected Office Documents: Protected Office Documents > On Version availability Description for Opt-in mode Windows and Mac - options for encrypting a file: • • Applies to the Enterprise population. Windows Mac A Secure Documents folder is added to the root of each client's Documents folder.
PAGE 293
Security Management Server Virtual v10.2.7 AdminHelp Content Based Protection policies for Windows in Opt-in mode: Data Guardian > Content Based Protection: • Content Based Protection (previously Data Classification) • Content Based Protection Rules Enforce encryption on sensitive data based on content and a set of rules. Windows Content-based rules can be set at the Enterprise, Endpoint Groups, or Endpoints populations. See Configure Content Based Protection for Data Guardian's Opt-in mode.
PAGE 294
Manage Policies For Office-protected documents, Data Guardian adds a Protected Save As option to the File menu list. This table also lists the behavior of other File menu options. File menu option for Office documents Policy for Opt-in mode: Protected Office Documents Protected Office documents Unprotected Office documents Open Files open as usual. Files open as usual.
PAGE 295
Security Management Server Virtual v10.2.7 AdminHelp Data Guardian's Force-Protected mode provides a higher level of security than Opt-in mode. When you enable encryption for these files in Windows or Mac, you can also set policies for users to view the encrypted files in mobile devices or the web portal. See Set Policies to Protect Office Documents in Mobile Devices or Set Policies to Protect Documents on the web client.
PAGE 296
Manage Policies If your enterprise enables encryption for protected Office documents and PDFs, you can select these additional policies. Policy Version availability Description for Force Protected Enterprise > Data Guardian > Protected Office Documents > advanced: Allow File Exclusions > check box selected Windows and Mac Windows For internal users, an Unprotected Documents folder is added to the root of each Mac computer's Documents folder.
PAGE 297
Security Management Server Virtual v10.2.7 AdminHelp • • Excluded folder if you enable that policy. Unprotected Documents folder at the root of each computer's Documents folder if you enable that policy. Save User clicks Save: the file is protected. If the file is in read-only mode, the Save As window opens. The only option in the Save as type field is Protected (Documents, Presentation, or Workbook). User opens and saves a .xen file - the only option in the Save as type field is Protected. The .
PAGE 298
Manage Policies Protected Office documents Unprotected Office documents Print Enabled for user For Office-protected documents, the Print_Control policy determines how this function behaves. Enabled for user Export (Office 2013 and higher) Office 2013/2016 and Export Control policy: Enabled for user • • Allowed: Enabled for user • Disabled: Disabled for user Watermark: Export is disabled. See Protected Export.
PAGE 299
Security Management Server Virtual v10.2.7 AdminHelp For Data Guardian v2.7 and earlier, you can use these policies and features. Windows: Additional Office menu options for Data Guardian v2.7 and earlier For Data Guardian v2.7 and earlier, this table provides an overview of additional Protected Office policy settings and what displays in the Office File menu. These do not apply to Data Guardian v2.8 and higher. With Force Protected enabled, the user is forced to save any Office document as Protected.
PAGE 300
Manage Policies Set Policies to Protect Documents in Mobile Devices For enhanced security on Office documents (.docx, .pptx, .xlsx, .docm, .pptm, .xlsm, or .pdf), you can implement Data Guardian's Protected Office mode. Protected Office documents are uploaded to the cloud, not as .xen files, but with their file extensions (for example, .docx or .pdf). However, the Office documents are encrypted. Basic File Protection policies allow you to configure additional file extensions to be encrypted.
PAGE 301
Security Management Server Virtual v10.2.7 AdminHelp 4. In the Web_Portal policy group or Global Settings, set additional policies at the Enterprise, Domains, User Groups, or Users levels. Some polices are set at the Enterprise (node level) only. For domains, user groups, or users, click an option to access the Detail page’s Security Policies tab.
PAGE 302
Manage Policies o Internal Use - priority 2 o Public - priority 1, the lowest. The lowest priority displays (default) after the rule name, and no rules or actions apply. Important: Optionally, you can delete the rules in the Categories list, but the policy requires a minimum number. See Delete. • Actions: • Encrypt - If you select the Encrypt check box for a non-default rule in the Categories list, the system encrypts the files.
PAGE 303
Security Management Server Virtual v10.2.7 AdminHelp Return to top Actions To modify: 1. See Configuration_overview. 2. Click the icon to expand a non-default rule name. 3. Select the Encrypt check box if you want the audit report to display files that have met the criteria for encryption. 4. Below the Content Based Protection Rules policy, click Save. Return to top Rules To modify: 1. See Configuration_overview. 2. Click the icon to expand a non-default rule name in the Categories list. 3.
PAGE 304
Manage Policies Predefined Elements: • • Credit Card • • • • • • IP Address Do not modify these elements, except for US Name. For US Name, use these fields: First Names, Last Names, Common Words. Email (IPv4 and IPv6 IP addresses are You cannot delete these elements. recognized.) Social Security Number US Address US Date US Name US Phone Number Keywords elements In the Keywords field, type any key words that you want the system to recognize when encrypting files for that rule name.
PAGE 305
Security Management Server Virtual v10.2.7 AdminHelp 2. In the Elements window, click the add icon (+) next to Elements. 3. In the Content Identifier field, enter a unique identifier. 4. Select a Content Type. Note: Select the KeywordContent for any Keywords elements; the FileTagMetadataContent for any Tag elements, and the CustomRegexContent for any Regex elements. 5. Click Add. 6. Below the Content Based Protection Rules policy, click Save. 7.
PAGE 306
Manage Policies Confidential t_class_3 Restricted t_class_4 For more information, see the TITUS Administration Guide. Management Console Configure the policy on the Management Console: 1. From the TITUS server administrator, obtain the format for each TITUS classification level. 2.
PAGE 307
Security Management Server Virtual v10.2.7 AdminHelp For Windows 2.4 and higher or Mac 2.9 and higher, Data Guardian's Cloud Encryption protection has been disabled to prevent compatibility issues with newer functions of cloud service providers. To view .xen files already protected with Cloud Encryption, use Data Guardian's Mobile app or web portal. Windows 2.3 and earlier or Mac 2.
PAGE 308
Manage Policies Management Console is automatically incremented although an administrator has not modified policy values, at least one updated profile is available. The polling interval for cloud storage provider profile updates is daily at 12:30 a.m. Configure Access Groups Data Guardian's Access Groups (formerly Circle of Trust) enhance security by creating user groups that can collaborate on encrypted data. Users outside a group cannot access or view the data unless the owner of the file grants access.
PAGE 309
Security Management Server Virtual v10.2.7 AdminHelp • Develop a plan for adding and removing users from a group if internal users join or leave the enterprise. • As a best practice, stagger deployment of Access Groups to user groups. Note: Access groups should be specific groups within the enterprise, not the entire enterprise.
PAGE 310
Manage Policies If you have Data Guardian installed, develop a plan for implementing access groups and creating a smooth transition for users who have shared files. Determine a transitional time range for deployment Initially, enable Access Groups and Auto access for swept files for a transitional period. This should be a brief time but owners of a protected, shared file should plan for any impact to that file.
PAGE 311
Security Management Server Virtual v10.2.7 AdminHelp If you have a transitional period, when it is complete, clear the Auto access for swept files check box. Be aware of the following for an enterprise that already had Data Guardian installed on Windows or Mac.
PAGE 312
Manage Policies cannot revoke key access. cannot revoke key access. Internal users outside the access group and external users: Same as above. Internal users outside the access group a Same as above. Internal users outside the access group and external users: Same as above. Internal users outside the access group a Same as above.
PAGE 313
Security Management Server Virtual v10.2.7 AdminHelp added to the removable media without authenticating can be caught. Files can be added to the media if authentication is declined, but encrypted data cannot be accessed. The files added are not encrypted in this case, so the next time the media is authenticated (to work with encrypted data), any files that may have been added are scanned and encrypted.
PAGE 314
Manage Policies Media containing Time Machine backups are not supported. However, media recognized by computers as Time Machine backup destinations are automatically whitelisted, to allow backups to continue. All other removable media with Time Machine backups are handled based on EMS Access to unShielded Media and EMS Block Access to UnShieldable Media policies. Selected allows removable media to be scanned every time it is inserted.
PAGE 315
Security Management Server Virtual v10.2.7 AdminHelp "security", "fail", "30" "security", "success", "30" "application", "error", "30" "application", "warn", "15" "application", "info", "5" "application", "debug", "5" Defines the amount of time (in days) that Encryption External Media, and PCS event types are maintained in the event log. Each event type is defined by category and level. You may set different retention times for each event level in each category.
PAGE 316
Manage Policies EMS Exclude CD/DVD Encryption Not Selected False encrypts CD/DVD devices. EMS Allow Read-access to unShielded Media (5.4.x Only) Selected This policy applies to 5.4.x Windows Encryption clients only. More... If a user chooses not to encrypt media and this policy is set to True, they are able to read or delete existing files on the media that are not encrypted, but the client does not allow any files to be edited on or added to the media unless it is Dellencrypted.
PAGE 317
Security Management Server Virtual v10.2.7 AdminHelp To whitelist a removable media device, provide a string value that matches portions of the device’s PNPDeviceID. Multiple device PNPDeviceIDs are allowed. For example, to whitelist all Kingston DataTraveler Vault Privacy models, input the string: To whitelist both models of Kingston DataTraveler, the Vault and Vault Privacy models, input the string: Space characters are considered part of the substring to match to a PNPDeviceID.
PAGE 318
Manage Policies EMS Password Attempts Allowed 3 EMS Special Characters Required in Password Not Selected 1-10 Number of times the user can attempt to enter the correct password. Selected requires one or more special characters in the password. EMS Access and Device Code Length 16 8, 16, 32 Number of characters access and device codes have. 32 characters is the most secure, while 8 is the easiest to enter.
PAGE 319
Security Management Server Virtual v10.2.7 AdminHelp -R#:\Notes -R#:\Photos You can also force encryption of specific file types in the directories above. Adding the following rules will ensure that ppt, pptx, doc, docx, xls, and xlsx files are encrypted in the directories excluded from encryption via the previous rules: ^R#:\Calendars ;ppt.doc .xls.pptx .docx.xlsx ^R#:\Contacts ;ppt .doc.xls .pptx.docx .xlsx ^R#: \iPod_Control ;ppt.doc .xls.pptx .docx.xlsx ^R#:\Notes ;ppt.doc .xls.pptx .docx.xlsx ^R#:\Phot
PAGE 320
Manage Policies EMS Data Encryption Key User Roaming Common, User, User Roaming Although Common is available, it is not implemented in this release. Choose a key to be used by the Encryption client to encrypt all data encrypted by the Encryption External Media. EMS Alpha Characters Required in Password Selected Selected requires one or more letters in the password. EMS Mixed Case Required in Password Selected Selected requires at least one uppercase and one lowercase letter in the password.
PAGE 321
Security Management Server Virtual v10.2.7 AdminHelp See Encryption Rules for information. More... Storage devices which incorporate multi-interface connections, such as Firewire, USB, eSATA, etc. may require the use of both EMS and encryption rules to encrypt the endpoint. This is necessary due to differences in how the Windows operating system handles storage devices based on interface type. To ensure encrypting an iPod via EMS does not make the device unusable, use the following rules: -R#:\Calendars -R#
PAGE 322
Manage Policies to Encryption External Media, Roaming Automatic Authentication allows Dellencrypted media to be automatically authenticated when it is inserted in any Dellencrypted computer the media owner is logged into. When automatic authentication is disabled, users must always manually authenticate to access Dell-encrypted media. Disabling Roaming Authentication helps to prevent users from forgetting their password when they take the media home or share it with a colleague.
PAGE 323
Security Management Server Virtual v10.2.7 AdminHelp ID, as follows: Capacity:2.06 GB (2,055,019,008 bytes) Removable Media:Yes Detachable Drive:Yes BSD Name:disk2 Product ID:0x5406 Vendor ID:0x0781 (SanDisk Corporation) Version: 0.10 Serial Number:0000188C36725BC8 Speed:Up to 480 Mb/sec Manufacturer:SanDisk Location ID:0x24100000 Current Available (mA):500 Current Required (mA):200 Partition Map Type:MBR (Master Boot Record) S.M.A.R.T. status:Not Supported 4.
PAGE 324
Manage Policies Mac Encryption Policy descriptions also display in tooltips in the Management Console. In this table, master policies are in bold font. Policy Default Setting Description Dell Volume Encryption This technology allows the use of either Mac FileVault full disk encryption or Dell's proprietary Dell Volume Encryption. Dell Volume Encryption Encrypt Using FileVault for Mac Workstation Scan Priority On On Off Toggle ON to enable Dell Volume Encryption policies.
PAGE 325
Security Management Server Virtual v10.2.7 AdminHelp This policy works in conjunction with the Policy Proxy Polling Interval policy. You cannot specify ports in this policy. The Encryption client communicates with Policy Proxies using the GKPORT specified during client installation (the default is 8000). Inherited values for this policy accumulate.
PAGE 326
Manage Policies If Force Restart on Policy Updates is set to Not Selected, this policy is ignored. Advanced Mac Encryption Policy descriptions also display in tooltips in the Management Console. In this table, master policies are in bold font. Policy Default Setting Description Dell Volume Encryption This technology allows the use of either Mac FileVault full disk encryption or Dell's proprietary Dell Volume Encryption.
PAGE 327
Security Management Server Virtual v10.2.7 AdminHelp Delay Authentication No Auth User List FileVault 2 PBA User List Not Selected If Selected, users are not prompted to activate or authenticate to the Dell Server until required, such as to use media encrypted with Encryption External Media. Dictionary Users matching this dictionary are not required to activate or authenticate to the Dell Server.
PAGE 328
Manage Policies See advanced settings Windows Device Control This technology allows for control of all the devices on a Windows computer (disable/enable), and can be customized by device type. Class: Windows Portable Device (WPD) Subclass Windows Portable Device (WPD): Storage Class: Human Interface Device (HID) Enabled PARENT to the next policy. Set this policy to Enabled to use the Subclass Windows Portable Device (WPD): Storage policy.
PAGE 329
Security Management Server Virtual v10.2.7 AdminHelp UDF Only CHILD of Class: Storage. Class: Storage must be set to Enabled to use this policy. Full Access: Optical Drive port does not have read/write data restrictions applied UDF Only: Blocks all data writes that are not in the UDF format (CD/DVD burning, ISO burning). Read data is enabled. Read Only: Allows read capability.
PAGE 330
Manage Policies Policy descriptions also display in tooltips in the Management Console. Policy Default Description Settings This technology allows control over general settings such as polling intervals, support dialogs, in-app feedback, auto updates, data auditing, and client retention periods. Device Lease Period 30 Defines the period of inactivity (in days) before any activated entity (a user, endpoint, or policy proxy) is automatically removed from management.
PAGE 331
Security Management Server Virtual v10.2.7 AdminHelp See advanced settings Audit Control Policies Selected Selected Not Selected Selected enables Audit Control policies. If this policy is not selected, no Audit Control takes place, regardless of other policies. It also enables the collection of audit data from Data Guardian clients. Data Guardian Geo Location Audit Data Selected Selected Not Selected Selected includes geo tracking location data in audit data.
PAGE 332
Manage Policies Policy Default Description Settings This technology allows control over general settings such as polling intervals, support dialogs, in-app feedback, auto updates, data auditing, and client retention periods. DDP Auto Updates Update Check Period 10080 1-43200 minutes (30 days) The period in minutes between checks for updates.