Advanced debug and configuration options for File and Removable Media Protection

Technical Articles ID: KB83461
Last Modified: 2024-01-06 05:10:14 Etc/GMT

Environment

File and Removable Media Protection (FRP) 5.x

For FRP supported environments, see KB81149 - Supported platforms for File and Removable Media Protection.

Summary

The Advanced Debug and Configuration Policy option have been introduced to allow certain specific features to be enabled or disabled on the client. This policy option is available by selecting Show Advanced from the Encryption Options policy page.

NOTE: With the release of FRP 5.0.2, the policy option has been renamed from Advanced Debug Options to Advanced Configuration Options to more accurately reflect the relevancy of the available settings.

Syntax generic rules:

Blank spaces are not allowed anywhere.
Each three letter acronym must be followed with a colon (:).
Every colon (:) must be followed with an integer (in range), a minus sign (to remove value), or a string value.
Each statement (where there is more than one) must be separated with a hash symbol (#).
To force a reboot, add R+ anywhere in the string. To remove the reboot requirement, add R- anywhere in the string.

NOTES:

The configuration changes you can make with the Advanced Configuration Options policy option might require a client restart before they take effect. These configuration settings might modify registry entries on the client and must be exercised with caution.
Any local changes to registry settings on the client are not sent back to the ePO server. The local changes are not overridden via the current policy setting.
Local changes are replaced only if a new configuration setting is explicitly set in the policy option and pushed to the client from ePO.
After a configuration setting has been applied, simply deleting that string does not remove the setting. You must use the correct syntax to reverse the setting.
Example: If you use the string DIS:1#V2E:1 to enable a setting, you must use the string DIS:1#V2E:- to reverse the setting.
A default FRP query, FRP: Advanced Configuration Options Events is available. The query reports on the status of the configured advanced debug or configuration option settings on the endpoint.

Solution 1

FRP 5.0.2 and later. This configuration setting requires a client restart before it takes effect.

Disable pagefile encryption
FRP encrypts the pagefile by default for security purposes unless the disk is encrypted with Drive Encryption or Microsoft BitLocker. All available disks on the system must be encrypted if you want to exempt the pagefile from encryption. In earlier FRP versions, the pagefile was always encrypted, regardless of the disk encryption status.

To accommodate scenarios, such as enabling easy collection of memory dumps, you can disable pagefile encryption. Use the following configuration setting in the Advanced Configuration Options field, regardless of disk encryption status:

PTP:1

If you prefer not to prompt users for a reboot after this setting has been deployed, add (R-) to the following string to remove the reboot prompt:

NOTE: The pagefile is decrypted only after the next reboot:

PTP:1#R-
To remove the above configuration setting and enable pagefile encryption again, input the following string in the Advanced Debug Options field:

PTP:0

IMPORTANT: If the disk is encrypted with either Drive Encryption or Microsoft BitLocker, this setting is ignored and FRP does not encrypt the pagefile.

Solution 2

FRP 5.0.3 and later. This configuration setting does not require a client restart before it takes effect.

Ability to control ‘delete’ options available to the user during USB device initialization
During the initialization container creation process, based on the size of existing data on the USB device. The user is asked to choose between:

Secure Erase
Or
Quick format

This Advanced Configuration setting provides Admins control over the options available to the user.

NOTE: This setting is applicable to the Offsite Access removable media protection level options.

The following string lets users choose between Secure Erase and Quick format options. The default behavior today.

RME:0
To always perform Secure Erase during the initialization process, input the following string in the Advanced Configuration Options field. Since the user makes no decisions, no user interface is displayed to the user:

RME:1

NOTE: Depending on the size of existing data, a Secure Erase operation can take a considerable amount of time.
To always perform Quick format during the initialization process, input the following string in the Advanced Configuration Options field. Since the user makes no decisions, no user interface is displayed to the user:

RME:2
To remove the configuration setting, input the following string in the Advanced Configuration Options field. The resulting behavior is the equivalent to RME:0.

RME:-

IMPORTANT: The configuration setting takes effect the next time a USB device is initialized.

Related Information

For how to resolve performance issues incurred because of the check for encrypted legacy SafeBoot Content Encryption v2.x files. See KB81615 - How to resolve performance issues incurred because of the check for encrypted legacy SafeBoot Content Encryption 2.x files.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Advanced debug and configuration options for File and Removable Media Protection

Environment

Summary

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Title

Title

Knowledge Center

Advanced debug and configuration options for File and Removable Media Protection

Environment

Summary

Solution 1

Solution 2

Related Information

Affected Products

Languages:

Choose your region

Title

Title