As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
Technical Articles ID:
KB79614
Last Modified: 2022-04-28 12:14:26 Etc/GMT
Environment
Management of Native Encryption (MNE) 5.x, 4.x
Summary
This article provides a consolidated list of common questions and answers and is intended for users who are new to the product. But, it can be of use to all users.
Recent updates to this article
Date
Update
April 28, 2022
Minor formatting updates; no content changes.
To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.
Contents
Click to expand the section you want to view:
What's the primary purpose of MNE?
MNE 1.0 is a new encryption product that provides the ability to report and manage the Mac OS X FileVault feature directly from ePolicy Orchestrator (ePO). MNE 2.0 and later introduce the ability to also report and manage Windows BitLocker.
What's new in MNE?
MNE 4.0 and 4.1 - This release includes several fixes and new features.
New features are documented in the Release Notes.
NOTE: MNE 4.1 adds new features to the BitLocker client only. The Mac client isn't updated in this release, so the MNE 4.1.0 release package includes the Mac OS X 4.0.0 software packages.
How can I obtain MNE?
MNE is included in the following four suites:
Complete Data Protection (CDB)
Complete Data Protection - Advanced (CDA)
Complete Data Protection - Essential (CDE)
Complete Endpoint Protection - Business (CEB)
NOTE: There's no additional charge to customers for this capability.
Why add management of Windows BitLocker with MNE when we already have Drive Encryption (DE) or Endpoint Protection for PC (EEPC)?
MNE for BitLocker is a secondary option for our existing DE customers and new prospects. One of the goals is to provide customers an option if they want only basic encryption. This goal is especially for customers who are already using BitLocker on all or a group of endpoints. One application of MNE for a Windows system is to enable management through ePO of small clusters of systems that you can't currently manage with DE today. For example, Windows to Go devices or Surface Pro tablets.
For bring your own device type assets, there's also a "Report Only" mode. This mode is similar to what's offered in MNE 1.0 for FileVault management. With this version, ePO can report that encryption is enabled for that endpoint, but doesn't manage the endpoint.
Will DE and MNE both continue to be developed in the future?
Yes. DE is a Gartner-MQ winning Enterprise solution and offers many more customer-oriented features than Microsoft BitLocker, including, but not limited to, the following:
User-based preboot
Smart card and biometric authentication
Self-recovery
Complex user-based policies
Endpoint Assistant
Support for Intel® AMT and ePO Deep Command
MNE is designed to provide a simple and easier-to-manage encryption solution that manages the built-in operating system encryption of Apple OS X and Microsoft Windows.
What's FileVault?
FileVault is the native operating system encryption product from Apple. It encrypts the entire OS X startup volume, typically including the home directory, but not non-OS volumes. It supports a user-based preboot.
What's BitLocker?
BitLocker is the native operating system encryption product from Microsoft. It's available on certain editions of the operating system. It can encrypt the entire operating system volume and any other volumes on the system. It doesn't support a user-based preboot, meaning that all users that share a system need to know the same password. Support for management of Windows BitLocker is added in MNE 2.0.
Compatibility - Mac (FileVault) specific
What versions of OS X does MNE Support?
MNE 4.1 provides full support for Mac OS X 10.10.x (Yosemite) and Mac OS X 10.11.x (El Capitan).
Is Windows 10 Enterprise Long-Term Servicing Branch (LTSB) supported with MNE?
No. MNE currently only offers support for official Windows 10 builds, which include Current Branch (CB) and Current Branch for Business (CBB).
NOTE: LTSB is Microsoft terminology for a Sustaining build that doesn't receive feature updates and is limited to security patches in general.
Does MNE support XP or Vista?
No. BitLocker support is added with the introduction of MNE on Windows 7 and later.
NOTE: MNE 4.x only supports ePO 5.x; support for ePO 4.6 (which is End of Life) is dropped in MNE 4.0 and later.
Can I simply move from Microsoft BitLocker Administration and Monitoring (MBAM) client to MNE?
Yes. You need to push the MNE client software to the endpoints and enable the MNE reporting policy in the first instance. After you see your systems reporting BitLocker status, you can then start removing MBAM from the endpoint and enabling the MNE management policy. For example, set the BitLocker product policy to Turn-on (enable) BitLocker with appropriate options. If you fail to remove MBAM from the endpoint, it results in conflict between the two management solutions as they compete to manage BitLocker.
Can MNE manage Trusted Platform Module (TPM)?
No. MNE doesn't manage TPM. On Windows 7 systems, you need to manage TPM yourself. On Windows 8 and above, the operating system can manage TPM for you if you've not already managed it.
Does MNE support Opal drives on supported operating systems?
Yes. Support for Opal drives is included with MNE 4.1 and later.
How do I deploy Network Unlock (MNE 4.0 and later)?
When you deploy MNE 4.0, make sure that you've installed the MNE Advanced Features extension (mneadvancedfeatures.zip) to ePO. Installing this extension unlocks the network unlock feature.
Installation/Upgrade - Mac (FileVault) specific What's the quickest way to go to compliant mode with MNE 4.0 Mac OS X?
MNE 4.0 and laterprovide a standalone installer for Mac OS X system, which installs McAfee Agent (MA) and MNE (FileVault) products. For more information about installing MNE, see the Management of Native Encryption Product Guide.
How can we provision MA in unmanaged mode to the ePO server after we install MA using the MNE standalone installation package?
With MA 4.8 Patch 2, it's now possible to provision MA running in unmanaged mode to connect to the ePO server for remote management. The ePO Remote Provisioning tool bundled with MNE 2.x and later provides a simple interface for remote provisioning with the ePO server when installed on a Mac OS X. The ePO Remote Provisioning tool requires the ePO address, username, and password of the user to be available in the ePO server. These items are needed to configure the MA running in unmanaged mode to connect with the ePO server. The user can be limited to an executive reviewer role with limited role permissions on the ePO server. The following table describes two solutions with procedural explanations:
Solution
Procedure
Provision the MA running in unmanaged mode to connect to the ePO server for remote management. Create a user on the ePO server with restricted permissions.
Log on to the ePO server console on a supported browser.
Click Menu, User Management, Users.
To add an ePO user, under Users click New User.
Enter the username.
Set the logon status as Enabled.
Select the authentication type as ePO authentication.
Set the password for the user.
Add other details such as Full Name, Email Address, and Phone Number. These details are optional.
Select the permission set as Executive Reviewer under Manually assigned permission sets.
The default permission set Executive Reviewer has permissions to view dashboards, events, contacts, and can view information that relates to the entire System Tree.
Provision the MA on an OS X client system using an ePO user.
Start the ePO Remote Provisioning Tool obtained from the MNE extracted package found under /Applications/Utilities/.
Enter the ePO address, username, and password.
Click Configure.
Enter the OS X administrator password when prompted.
What's the best practice recommended in deploying MNE and Endpoint Security for Mac (ESM), formerly Endpoint Protection for Mac (EPM), together?
Generally, either MNE or ESM (or EPM) can be deployed on Mac OS X systems in any order. We recommend deploying ESM or EPM followed by MNE, when being deployed on large-scale enterprises.
Is it possible to migrate from Endpoint Encryption for Mac (EEMac) to MNE?
Yes. Follow the upgrade steps below:
Deploy MNE to the client system with the appropriate policy settings for your company environment.
NOTES:
The system can have both EEMac and MNE installed at the same time.
MNE doesn't enable FileVault on a client system if EEMac is installed and active.
Mac OS X: The system must be running Lion or Mountain Lion. EEMac doesn't support Mavericks.
Deactivate and uninstall EEMac.
Monitor the progress of the removal of EEMac in the ePO dashboard. Confirm that it's uninstalled.
NOTE: After EEMac is uninstalled, MNE automatically enables FileVault at the next policy enforcement.
Configuration - General How do I define access rules for Network Unlock?
Access rules can be defined on the Server Settings page via ePO. For more information about server settings and policy setting network unlock policies, see the Product policies section of the MNE 4.0 Product Guide.
The data volumes on the target servers are protected by encryption keys. These keys are held by the ePO server and released to endpoints on request according to workflows that the Administrator can define. Audit reports via ePO help the Administrator review the state of volume access control within the server estate.
Why must I enable key-rotation in the server settings page?
Unlike DE, BitLocker recovery keys have no random element. This statement means that until the recovery key is changed, the recovery key can continue to be used. If the recovery key falls into the wrong hands, an attacker can gain access to the system. When you enable the server-settings key-rotation settings, it protects against anyone who views the recovery key in ePO (via MNE recovery or Data Protection Self ServicePortal (DPSSP)). The reason is because the server instructs the endpoint to change the recovery keys. The recovery keys change to something new at the next opportunity. This action closes this security hole.
Configuration - Mac (FileVault) specific Mac OS X system is configured with Active Directory (AD) server and AD users are also FileVault preboot logon enabled. What's the recommended policy settings for MNE?
Issues have been seen with Mac OS X systems. When an AD user tries to change the password on a periodic basis on the Mac OS X system, a new password set by the user fails to sync with the FileVault preboot. It happens when the MNE policy Destroy FileVault key in standby mode is enabled. We recommend that you disable this policy option if Mac OS X systems have AD users on the system. For more information, see KB81289 - User who changed their password can't authenticate at the FileVault preboot screen.
Is it possible to configure MNE for FileVault to only allow for one user at preboot?
No. After MNE enables FileVault, Mac OS X adds the currently logged in user to the FileVault preboot. After FileVault is enabled on the system, when a new user is created on the system, Mac OS X adds that user to FileVault preboot logon automatically. MNE does not support restricting logon for a single user on the system because MNE doesn't control FileVault user management.
Configuration - Windows (BitLocker) specific Where's the User Interface to manage FileVault users in MNE?
MNE doesn't provide support to FileVault user management. To manage Mac users, you must use the standard Apple user-management features (in System Preferences, Users & Groups), which require administrator rights. For more details, see KB79648 - How to add an Active Directory user to FileVault.
What authentication types are supported with BitLocker?
MNE supports TPM, TPM+PIN, and Password authentication. Password authentication is only available with Windows 8 and later.
Why is there no policy option for USB authentication with BitLocker MNE?
USB authentication is not supported with MNE for security reasons.
Why does MNE encrypt all volumes on a Windows system, and use the same PIN or password to unlock them all?
MNE is configured to use auto-unlock for all non-OS volumes in this release because it simplifies the user experience. A user has only one password or PIN to remember. It reduces the likelihood of users having to write down their passwords.
What permissions are needed to provision the MA running in unmanaged mode when using the MNE standalone installer?
The ePO Remote Provisioning tool requires the ePO address, username, and password of the user to be entered. The user can be limited to an executive reviewer role with limited permission on the ePO server. For more information, see KB82640 - How to use the Remote Provisioning tool bundled with Management of Native Encryption.
General Functionality When a system is deleted from ePO, is it still possible to use the serial number to obtain the recovery key?
Yes. The serial number and recovery key aren't deleted when a system is removed from ePO.
When a computer has two drives that are both BitLocker protected, if the secondary drive fails or is removed and a new one is installed, is the new drive automatically encrypted?
The new drive gets automatically managed by MNE on the next policy enforcement. When a normal encryption policy is enforced, MNE generates a new auto unlock key (the standard unlock mechanism for data volumes). Also, it generates a new Recovery Key for that drive and escrows to ePO before encryption begins. The user doesn't need to take any manual steps.
Can I use Network Unlock on workstations?
Typically, workstations aren't used for the sharing of data via their data volumes. It's a role typically reserved for server-based systems because of their performance specifications and user management capabilities. Because of the specific nature of the feature design, support is limited to server platforms that are documented in the supported platforms list. For MNE supported environments, see KB79375 - Supported platforms for Management of Native Encryption.
Does MNE support BitLocker To Go (BitLocker encryption for USB drives)?
No. We recommend that you use File and Removable Media Protection (FRP) to encrypt USB drives.
Does MNE support encrypting USB drives with FileVault?
No. We recommend that you use FRP to encrypt USB drives.
What's the maximum number of times a user can postpone activation (MNE 4.1 and later)?
The user can postpone activation up to 10 times. This option is located under the Authentication policy section.
NOTE: This feature, introduced in MNE 4.1, restricts the number of postponements on activation to reduce the amount of time a client system isn't encrypted. Systems that are already encrypted are activated. Any policy change that requires different credentials to be entered allows the user to postpone the credentials dialog any number of times. The user is allowed to postpone because the system is already in an encrypted state.
When might I want to use the Postpone Activation option?
Sometimes, it's inconvenient for a product to be installed or updated in busy periods or during a customer meeting. MNE provides you with the flexibility to defer this action, which can improve user experience during a deployment phase.
Why would I want to use the MNE Control Panel Applet?
Credential management is the key to maintaining an effective security posture and usability within a managed estate.
Key points:
Administrators might want to securely lock the user ability to change the configuration of BitLocker. To lock this ability, you have to remove the BitLocker Control Panel and replace it with the MNE user interface. This interface is also accessed through the Control Panel.
Disabling the BitLocker Control Panel removes the ability for the user to disable BitLocker protection and manage TPM. It also removes the ability to save or print the recovery password that might fall outside of a company's security best practices.
When the BitLocker Control Panel item is removed, the MNE interface still provide non-administrator users with the ability to change their password if they need to. The need to raise a help desk ticket is then reduced. This results in a more efficient working practice while maintaining an effective security posture.
Users with administrator rights can still manage BitLocker through the BitLocker command-line tool manage-bde.
How do I Hide Default BitLocker Encryption in the Windows Control Panel?
See this Microsoft TechNet article.
Where do I find the System by username?
You can view the Find MNE systems by username dashboard on the Dashboards page.
Why would I typically use Find System by username?
This feature is useful when the owner of a system calls in and reports their system lost or stolen or doesn't have the system details at hand.
How can I disable protection while I modify the operating system?
MNE 3.0 introduces a new endpoint-side tool MaintenanceMode.exe. This tool can be used to disable protection for a set period or number of reboots. You must use this tool instead of disabling protection yourself through non-MNE tools; otherwise MNE policy enforcement simply re-enables protection when it next enforces a policy. You can build this tool into your endpoint-side scripts during operating system refreshes and upgrades.
How do I achieve scalability?
To achieve maximum scalability within large environments, make sure that your ePO and Database servers run on well-resourced physical servers (not within Virtual Machines). Also, make sure that you configure ePO with more than one agent handler. See the respective ePO best practice guide for more details.
Can I export MNE policies from one ePO server to another?
Yes. You can export MNE policies from one server and import to another. Some versions of ePO export an internal system policy. Make sure that you don't inadvertently import the internal system policy and product policy.
Why does a system with no data drives report "Pass" against Security Posture tests?
The Security Posture Reporting tests returns Fail only if there's something that fails the specific test. In the case that there are no data drives, there's nothing to make the tests fail, and so (by implication) they pass. The report finds systems that are noncompliant. A system with no fixed drives can't be noncompliant to a fixed drive policy.
For reporting methods, is there a way to see what key protectors are in use for a system and its volumes, and also the algorithm in use?
No. There are no ePO reports to show what key protectors are in use for a system and its volumes. You can only use the command manage-bdeto obtain this information.
For more details about how to use the tool manage-bde, see this Microsoft article.
If I transfer systems as per KB79283 or redeploy MA from a different ePO server, where the encryption key is escrowed to the new ePO server?
Yes. If FileVault or BitLocker is enabled using MNE on the source ePO server, and the Transfer Systems option is used, the key is escrowed to the destination ePO server. Specifically, when the Transfer Systems option is used as described in KB79283 - How to transfer computers from one ePolicy Orchestrator server to another.
IMPORTANT: Key points to observe using FileVault as an example:
The MNE FileVault policy must be enabled on the destination ePO server before the transfer of systems.
If the MNE FileVault policy isn't enabled on the destination ePO server, the Endpoint Protection for Mac Console status under Encryption and Management Mode shows the following:
FileVault isn't managed
Recovery Key Status shows that the Client has not escrowed the key in ePO.
If the policy is enabled after the system is transferred and policy enforcement occurs, the Endpoint Protection for Mac Console status under Encryption and Management Mode shows that FileVault is managed. But, Recovery Key Status still shows that the Client has not escrowed the key in ePO.
The system can be transferred back to the source ePO server and then transferred back to the destination ePO server, and the key is then escrowed.
Functionality - Mac (FileVault) specific Does MNE support the use of Boot Camp?
MNE doesn't support Boot Camp. Mac FileVault itself supports Boot Camp. But, FileVault only encrypts the OS X volume on the disk. A Windows partition created using Boot Camp remains unencrypted on the disk. It's pure FileVault functionality.
FileVault is already enabled on the Mac OS X system and the Mac OS X user has the recovery key available. What's the best practice to escrow this key to the ePO database safely?
The following table describes two solutions with procedural explanations:
Solution
Procedure
Mac OS X systems installed with Mavericks 10.9.x) and Yosemite (10.10.x)
The ePO administrator must enable the recovery key import on the client. Turn on the policy item Allow users to import recovery on client under the FileVault Product Settings policy for MNE.
Start the Endpoint Protection for Mac 3.0 application extracted package found under Applications / Encryption.
Enter the recovery key, then click Apply.
Mac OS X systems installed with Mountain Lion (10.8.2 and later)
All users of Mac OS X systems can send the recovery key to the ePO administrator with the serial number of the Mac OS X system.
The ePO administrator can easily import all FileVault recovery keys into the ePO database. Use the import FileVault recovery key feature available in ePO under Menu, Data Protection, Import FileVault Recovery key.
What's the recommended method to generate a new FileVault recovery key on systems installed with Mac OS X Mavericks 10.9.X and Yosemite 10.10.x?
For systems installed with Mac OS X Mavericks 10.9.x and Yosemite 10.10.x, it's possible to change or generate a new FileVault recovery key. You can use either the existing valid recovery key or password. For more information, see KB82481 - How to regenerate recovery key, when FileVault is enabled and key is invalid.
What's the recommended method to enable FileVault after it's turned on by the ePO administrator through policy enforcement?
When the ePO administrator enables FileVault on the system, FileVault gets turned on in deferred enablement mode. It means that the currently logged-in user is authorized to enable FileVault using the password. When the ePO administrator enables FileVault, the user on the Mac OS X system sees a notification to restart the system to enable encryption on the Mac system. The user has to restart and type the password at the password prompt screen to authorize FileVault. It enables FileVault encryption when the system boots again.
MNE has enabled FileVault for a currently logged-on user; but, the system has multiple users. How can the logged-on user enable FileVault preboot logon for other users?
MNE doesn't play any role in adding FileVault log on to the users. The Mac OS X FileVault handles this operation. If a system has more than one user at the time of enabling FileVault, the currently logged-on user is authorized to log on at preboot. If you want to allow other users on the system to log on at the FileVault preboot, then the administrator user on the Mac OS X system can enable these users by following these steps:
Open Applications, SystemPreferences, Security&Privacy.
Click Lock and type the administrator's user credentials.
Click EnableUsers.
Select the users and click EnableUser to enable the selected users as FileVault users.
Functionality - Windows (BitLocker) specific Why does BitLocker not activate?
For BitLocker to activate, the system needs a system partition. Depending on how your Windows image is created, it might not be available, in which case you need to create the system partition before BitLocker activates. In general, if you can activate BitLocker manually, MNE can activate it as well.
Can specific AD groups be delegated the rights to recover the encryption keys?
No. Rights to encryption key recovery is defined with the ePO permission sets to ePO users and not via AD. The DPSSP can be used to allow users to recover systems that they've previously logged into. You can't recover systems that they've not previously logged into.
How does MNE handle BitLocker recovery keys stored in AD; is it done automatically?
When MNE is first installed on a system where BitLocker is already running, MNE takes a backup of the recovery keys that exist on the computer to ePO. It does so by simply pulling them from the client using the BitLocker API (no round trip needed to AD). MNE also adds our own recovery key as well. So, a system where MNE is taking over BitLocker will have multiple recovery keys and all are safely stored in ePO. The above occurs at the first policy enforcement as MNE tries to pull BitLocker into compliance with the MNE policy. Back to Top
EOL period—The time frame that runs from the day we announce product discontinuation, until the last date that we formally support the product. In general, after the EOL period is announced, no enhancements are made.
EOL date—The last day that the product is supported, according to the terms of our standard support offering.