Device Encryption QuickStart Guide - McAfee

Device Encryption Quick Start Guide
McAfee, Inc.
5140(513-0015)

McAfee, Inc.
McAfee, Inc. 3965 Freedom Circle, Santa Clara, CA 95054, USA
Tel: (+1) 888.847.8766
Internet: www.mcafee.com
McAfee, Inc.
For more information regarding local McAfee representatives please contact your local McAfee
office, or visit:
www.mcafee.com
SafeBoot ® Device Encryption
For best results when viewing this guide
If you are using Adobe Reader 8:
View → Page Display → Two Up / Show Cover Page During Two Up
Document: Device Encryption QuickStart Guide
Last updated: Wednesday, 27 February 2008
SafeBoot Enterprise Build: 5140(513-0015)
Device Encryption Product Version: 5.1.3
For older versions of Adobe Reader:
View → Page Layout → Facing
Copyright (c) 1992-2008 McAfee, Inc., and/or its affiliates. All rights reserved.
McAfee, SafeBoot and/or other noted McAfee related products contained herein are registered
trademarks or trademarks of McAfee, Inc., and/or its affiliates in the US and/or other
countries. McAfee Red in connection with security is distinctive of McAfee brand products. Any
other non-McAfee related products, registered and/or unregistered trademarks contained
herein is only by reference and are the sole property of their respective owners.

1. Introduction
McAfee, Inc.
Proper implementation of your company’s security policies is
critical to the protection of its data assets. SafeBoot recognizes
that careful planning and testing must accompany any largescale
software installation.
This document provides you with basic installation and setup
guidelines for a small network system secured by SafeBoot ®
Device Encryption. Within this system, you can create users,
machines and groups of all types. You can also run client
installations and work out the implementation details with the
SafeBoot Technical Support team prior to the full-scale rollout.
If the extent of your implementation requires only a basic
system, this document provides the essential information you
need to complete the installation and setup of users, machines
and policies.
Equipment
To complete the installation and setup of the SafeBoot
Management Centre and the SafeBoot Communications Server,
you need the following equipment:
• One PC to be used for the SafeBoot Management Centre
• An additional PC for the client
• Each PC should be capable of running Windows 2000, or
Windows XP, Windows Vista 32bit and 64bit
• Each PC requires a network card and TCP/IP installed and
working, as well as access to ports 5555 and 5556 (Note:
these are the default ports and can be changed) on the
administration PC.
1

Sequence of Events
McAfee, Inc.
The installation and setup of SafeBoot is order-dependent and
must be done in the following sequence:
1. Install the SafeBoot Management Centre.
2. Create the object database.
3. Create the SafeBoot Server Application.
4. Add Administrative Users to the System.
5. Set Up Machine Configurations.
6. Create Installation Sets.
7. Install the SafeBoot Device Encryption Client(s).
8. Test the System.
You can use this basic system for testing, planning and training
administrators.
2

2. Installing SafeBoot ®
McAfee, Inc.
Management Centre
SafeBoot Management Centre provides centralized
management of the entire SafeBoot network of users and
machines. Two major components are the Object Database and
the SafeBoot Administration Application. The following steps will
guide you through the installation of the administration
software. You only need to do this once.
Installation
1. When you insert the SafeBoot Disk into the CD drive, the
various program file folders are displayed.
2. Select the setup.exe file to start. The Welcome to SafeBoot
Installation screen will appear. Click “Next”.
3. Enter your product code. The product code will arrive
separately from the installation CD, usually via email.
Contact your SafeBoot sales representative if you need
further clarification or you lose your product code.
4. Read and approve the license agreement, click “Yes” to
proceed.
5. Determine where you want the program files to be installed.
Click “Next”.
6. Choose an encryption algorithm. If you are unsure, or have
no preference, then select the default AES (FIPS 256) or
the algorithm that matches your company’s security policies.
7. There are many types of components that you can select
from the Optional Components window:
a. Tokens: If you are not using physical tokens, uncheck all
boxes for this option. Otherwise, select the type of
device used to store the token.
b. Smart Card Readers: If you plan to use hardware
devices to store tokens, you will need to select the type
of reader to be used on both the administration system
3

McAfee, Inc.
and the client systems. Deselect all the readers if they
are not required.
c. SafeBoot Device Encryption: Deselect this option if you
are not installing Device Encryption.
d. Device Encryption Themes: Select the pre-boot graphic
theme you would like to appear on your client machines.
Note: you can insert your own graphics. Contact
SafeBoot for further instruction.
e. Device Encryption Client Languages: SafeBoot supports
multiple languages. Specify the language, or languages,
required for your client machines.
8. When you have selected your components click on “Next”.
The Start Copying Files window provides you with the
opportunity to review your choices before actually installing
the SafeBoot software. Review this list carefully.
a. If you want to make changes, simply hit the “Back”
button until you get to the appropriate window.
b. Make your changes.
c. Continue to click the “Next” button until you reach the
Start Copying Files screen. You can review your
configuration within the Current Settings window.
9. Click on “Next” to create the installation set. This takes just
a couple of minutes.
10. SafeBoot will display the Setup Wizard Complete screen
when the installation has finished. Click the “Finish” button
to complete the process.
11. Restart the computer if required.
4

3. Create the Object Database
McAfee, Inc.
To use the SafeBoot Management Centre, you must first
configure the SafeBoot Administration Database (object
database). The object database is a repository for all the security
information (keys, policies, etc.) used in SafeBoot.
The SafeBoot Administration System (SBAdmin) provides the
interface for configuring this database. The SafeBoot
Administration Database and the SafeBoot Management Centre
tools must reside on the same computer.
Creating the object database is a one-time setup requirement.
The only time you will be given the option to create the database
is the first time you run the SafeBoot Administration Tools.
To start the process:
1. Click the “Start” menu.
2. Select “Programs”.
3. Select "SafeBoot Administration Tools”.
4. Select “SafeBoot Administration”.
5

McAfee, Inc.
Configuring the SafeBoot Administration Database
1. Accept the defaults.
Click the “Next” button.
2. Click the “Next” button.
6

McAfee, Inc.
As with many network applications, you can define users
individually or within groups. The same concept applies to
SafeBoot users and machines (devices) that are attached to the
network. The “SafeBoot User Group” is created automatically,
and the first SafeBoot user (SBAdmin) is automatically placed in
this group.
1. The Administration Database screen contains the default
description, driver and data path for your SafeBoot
installation. You can accept the defaults or assign your own
meaningful names to each of these initial assignments.
2. The next window is the logon screen. This first logon
assumes the user is the “Root User” and will require the
highest level of privileges. This user is automatically
assigned to the SafeBoot User Group.
a. Enter your user name.
b. Select the Token type; the default is Password Only
Token. Note: If you select something other than
Password Only Token, e.g. Smartcard, SafeBoot USB,
you will be asked to enter the token password when you
click on the “Next” button.
c. Enter a password and confirm it.
3. The next screen, “Program Files”, lists all of the files that
should be stored within the object database. Accept the list
that is presented by clicking “Next”. Note: you can add, edit
or remove program files by selecting the respective button.
4. Click the “Finish” button to create the database.
The status of the database installation is displayed as the files are
copied. Upon completion, a pop-up window indicates that the task
is complete.
5. Click the “Done” button and then “Ok” to confirm. The login
screen will automatically display.
6. Log in as the administration user you created earlier.
7

4. The SafeBoot ®
Administration System
SafeBoot® Administration Tools
McAfee, Inc.
SafeBoot automatically creates the initial Object Tree structure
for Users, Machines and System objects.
Area 1: The “Object Tree”
The display is for the object groups
contained within each category of
users, machines and system
components.
Area 2: Navigation tabs
These allow the administrator to switch
the Object Tree display between Users,
Machines, Policies and System objects.
Click each tab to become familiar with the structure that was
created during the installation and setup process.
8

Area 3: Group Members
Double-clicking on an object listed in
Area 1 brings up a detail window which
displays each member contained within
the group.
Area 5: System Log
McAfee, Inc.
Area 4: Properties Window
Double-click on a specific object listed in
Area 3, and the Properties window for
that object will be displayed.
This log displays system-level actions.
This pane can be closed and reopened
from the View menu.
9

Groups
McAfee, Inc.
You can create groups for Users, Machines, Policies and
Systems. Groups allow you to categorize and specify the
properties of a collection of users machines, policies and
systems. Creating additional groups, or, modifying the
properties of an existing group is a simple task:
Creating a user Groups
1. Select the tab containing the groups you want to manage,
e.g. "Users".
2. Right-click the group root, e.g. “SafeBoot User Groups” and
select "Create new group".
3. Enter a meaningful name and description for the group. This
could relate to the properties assigned or perhaps an
organizational unit within your company.
10

McAfee, Inc.
4. There is a check-box beneath the Description field See the
picture in the previous page). Check this if you want all
users in the group to have the same properties.
5. Click “Ok” and the group is created.
The remaining sections of this guide show some further
examples of groups and how to set the properties. See the DE
Administration Guide for more detailed information on creating
and configuring groups.
Renaming Groups
1. Right click on the group you wish to rename.
2. Select the “Rename” option.
3. Type over the highlighted text with the new name.
4. Click outside the text or press the key.
11

5. Create a SafeBoot ®
McAfee, Inc.
Server Application
The SafeBoot system requires a communication server to
handle the exchange between the client machines and the
SafeBoot Object Directory. To create this server:
1. Open the Servers
Window:
a. Select the “System”
Tab and expand
“SafeBoot Servers
Groups”.
b. Double click on
“Servers” to open the
Servers window.
2. Open the New Server
Window:
a. Right click inside the
“Servers” window”.
b. Select “New Server”
from the menu. This will
open the New Server
window. See opposite.
12

3. If you are using multiple machines for
testing, leave all the SafeBoot Server settings at
their defaults. If you are testing the SafeBoot
Management Centre and the SafeBoot Client on
one machine, you must change the IP
address of the server to “127.0.0.1.”
3. Double-click on “Servers”.
4. Right-click inside this
window and select “New
Server” from the menu.
McAfee, Inc.
4. Click “OK.” SafeBoot will
create authentication keys for
the server. This may take a few
minutes.
Once you have created your server,
you can start it as a service or run it as
an application:
1. Select “Start” → “Programs” →
“SafeBoot Administration Tools”
→ “SafeBoot Database Server”.
2. Log in and select the server
when prompted. This starts the
server application.
3. If you wish to run the server as
a service then select “File” →
“Start service” from the
SafeBoot Database Server
application.
13

Creating Users
McAfee, Inc.
All users of the SafeBoot system need their own account, with
the exception of Windows mobile devices, as these are treated
as machines.
To create users:
1. Open the user group:
a. Select the “Users” tab.
b. Expand “SafeBoot User
Groups”.
c. Double click on the user
group you wish to add a
user to. This will open the
user group window.
2. Open the Create User
window:
a. Right click inside the
user group window.
b. From the right-click
menu choose the “Create
User” option. This will load
the Create User window.
14

4. Create the user:
McAfee, Inc.
a. Enter a name for the user. They will
use this to log in.
b. Add identifying information for
authenticating a user when they need
assistance from the helpdesk.
c. The identifying information can be
edited or cleared when required.
d. Click “Ok” to add the user.
15

User Properties
McAfee, Inc.
From the Properties window you can set or reset any attribute
from general user information and password policies to specific
privileges assigned to the user.
1. Select the group containing the
user. Right-click or double click the
user name and select “Properties”
to open their settings window.
2. Click each attribute category
and specify the rules for the use.
16

3. You can scroll up and down to
view more categories.
4. Enter the values in the
Properties window.
McAfee, Inc.
5. You can click “Apply” to save
the settings, “Close” to close the
window and (optionally) apply the
settings, or “Restore” to restore the
settings to their saved state.
17

6. Setup Machine Configurations
The next step is to create a machine group and configure it.
1. Create the Machine
Group:
a. Select the “Devices”
Tab and right click on
“SafeBoot Machine
Groups”.
b. Select the “Create
Machine Group” option.
c. Enter a name and
description for the
group in the New Group
window.
McAfee, Inc.
18

2 Set the properties of the
machine group:
a. Right-click on the machine
group you have created.
b. Select the “Properties”
option.
McAfee, Inc.
WARNING
Do not select any encryption if
you intend to install the client
software on the same machine
as the administration system!
5. You can click “Apply” to save
the settings, “Close” to close the
window and (optionally) apply the
settings, or “Restore” to restore the
settings to their saved state.
19

McAfee, Inc.
Adding users to your machine group
You can add individual users or the entire group of users to a
machine group.
Users must be added to a machine group in order to log in to a
protected machine.
1. Select the “Devices” tab and
right-click on the machine group
you wish to add users to.
2. Select the “Add Users” option.
This will load the Select Users
window.
3. If you select a group from the left hand pane the
users within that group will appear in the right hand
pane. Select one or more users and click “Ok” to add
them to the group. Alternatively, to add a group, select it
from the right hand pane and click “Ok”.
20

7. Creating an Install Set
McAfee, Inc.
The files necessary for creating the install set are located in the
SafeBoot Administration Database. The install set is associated
with the machine level functions.
From the SafeBoot Administrator window:
1. Right-click on the machine
group.
2. Select “Create installation
set.”
From Page 1 of the Wizard:
In a previous step, you set up a communications server, so use
the “Online” install method.
21

From Page 2:
McAfee, Inc.
3. Check “Online”. Click
“Next.”
4. Check the server
created to handle the
communications
between the client
machines and the
SafeBoot
Administration
Database.
Click “Next.”
Keep in mind that this server will be remote from the clients. You
need to create an install set for each machine group that you
have created.
In large scale network installations you may have more than one
server running. Clients will select the best connection from the
available servers to perform the synchronization function.
22

McAfee, Inc.
Before proceeding to the next step, please check you have
selected the correct server from the list. Remember that the local
connection (SBFILEDB.DLL) is only local to the machine you are
working on - it is not accessible by network-connected machines.
5. From the final page:
5. Specify the
destination folder
where SafeBoot will be
installed.
Click “Finish.”
For testing, DO NOT select either the “Silent Installation” option
or the “Automatic Restart.” You will want to monitor the install,
and selecting either of these options does not allow you to
monitor the success of the installation. The resulting executable is
saved to the desktop of the server.
The SafeBoot Administrator takes the files needed out of the
SafeBoot Object Database and creates one file, SafeBoot5x.exe.
• Copy the executable to a CD or diskette that can be taken to
each client machine in the group, or, copy the file to a
network directory to which the client machine has access.
23

McAfee, Inc.
8. Installing the Device Encryption Client
There is no need to install the administration software on each
machine in your environment. Only administrators need access to
this package. General users of SafeBoot need only the single
SafeBoot5x.exe file..
The installation will have to be executed from the client
machine.
1. From the location where the executable was saved, run
SafeBoot5x.exe.
2. When the install is complete, restart the machine.
Before installing the Device Encryption client, unplug any
removable hard disks (such as USB or Firewire drives) from the
machine.
3. When the machine reboots, it will automatically attempt to
communicate with the SafeBoot Server to get its proper
configuration.
4. The first time the user boots the machine, SafeBoot
protection is operational. SafeBoot takes over the initial boot
process and requires the user to log in before the operating
system completes the boot up process.
On Windows 2000, XP and Vista you need to have local
administration rights to install SafeBoot.
In a production environment, you can distribute SafeBoot5x.exe
via tools such as SMS, Zen Works, or other distribution software.
You can also run it via automation such as PsExec.
24

9. About the SafeBoot ®
Client
McAfee, Inc.
Other than the login process, SafeBoot is transparent to the user.
The only evidence of its existence is the icon in the tool tray.
The user has a few options available:
5. Right-click on the SafeBoot icon.
6. Select the “Lock Workstation” option. The user must log
back into the machine to clear the screen saver.
7. If a Synchronize event has been initiated, selecting the
“Show Status” option displays the status of the event on the
Progress bar and the Activity Log will show the items being
checked for updates during the synchronization event. Other
activities are also logged. During a synchronize event, the
Activity Log is uploaded to the audit screen in the SafeBoot
Administration tool.
25

10. Testing the SafeBoot ®
System
McAfee, Inc.
Below you will find some typical SafeBoot administration
operations you may like to try.
Recover a User Password
1. From the client machine instruct the user to:
a. Restart the machine. The log in screen is displayed.
b. Cancel the token logon, and click the SafeBoot icon on
the bottom left of the screen.
c. Click the “Recovery” option.
d. Select “User Recovery” and enter his/her user name.
The user is presented with an alphanumeric challenge that is
unique to the user and machine.
The challenge code.
26

2. The SafeBoot Administrator should now:
McAfee, Inc.
a. Log in as a user with more privileges than the target
user.
b. Select the user’s machine group followed by the
“Recovery” menu.
c. Select “Perform Recovery”.
d. Ask the user to tell you the challenge code displayed on
the machine.
e. Enter the code into the space provided. If correct, the
user name is displayed.
f. Click on the “Properties” button to view the user‘s
details.
g. Validate that the user is who he/she claims to be by
asking for the answer to the specific authentication fact
specific to the user (Mother’s maiden name, pet name,
etc).
h. Click the “Next” button.
i. Select “Reset users password” and then click “Next.” A
list of response codes is displayed.
27

3. From the user’s machine, instruct the user to:
Auditing
a. Click “Next.”
Response codes.
McAfee, Inc.
b. Repeat the response code to the user and have him/her
enter the sequence into the space displayed.
c. Click “Next.”
d. The user will be prompted to change the password and
confirm it.
SafeBoot Object Database maintains an audit log for all
machines, devices and users. Audit logs are updated every time a
machine or device connects to the central database via the
SafeBoot Server.
To view the audit log:
1. Right-click on the object, e.g. user name.
2. Select “View audit.”
28

McAfee, Inc.
Audit information.
Audit logs are maintained automatically and indefinitely for each
user and machine. Audit logs are only accessible by
administrators with the assigned privileges. An audit log can be
exported by right-clicking on the log and selecting the “Export”
option.
Additional Activities
Now that you have a working SafeBoot environment, you can
start customizing the configuration of users and machines. Some
things to try are listed below.
If you have separate administration and client machines:
1. Log in to a client with an account other than “SBAdmin”.
2. Disable the users account. Use the “General” tab of their
properties and deselect “Enabled”.
3. Update the client machine using any of these methods:
• Reboot it
Or..
• Right-click on the SafeBoot Monitor on the client and select
“Synchronize”
29

Or..
McAfee, Inc.
• Find the machine in SBAdmin, right-click on it and select
“Force Sync.” This forces a synchronization event on a
network-connected machine.
The login screen activates on the SafeBoot Client machine. This
indicates that the client is locked out of the machine.
If you are running SBAdmin and SafeBoot on the same
machine:
1. Find your machine entry in the Object Database.
2. Open its property pages and go to its “Warning Text” tab.
3. Add some new warning text to the boxes and then click the
“Apply” button to save the changes.
4. Synchronize your machine with the object database by one
of the following methods:
a. Right-click on the SafeBoot Monitor on the client and
select “Synchronize”, or
b. Find the machine in SBAdmin, right-click on it and select
“Force Sync.” This forces a synchronization event on a
network-connected machine.
On Windows 9x, start the SafeBoot screen saver by doubleclicking
on the SafeBoot Monitor tool tray icon; move the mouse
or press a key - you should find the new warning message. On
Windows NT, 2000 and XP, you will need to reboot to see the new
text.
30

Removing the SafeBoot ® Client from Machines
McAfee, Inc.
Removing client software from a machine is also a simple
process. To remove:
Synchronize the machines with the database using one of the
methods described in the “Additional Activities” section.
1. Select the Machine
group.
2. Double-click the
machine you want to
remove.
3. Select “Remove”, or
“Remove and Reboot”
from the “Boot
Protection” menu.
31

Removing SafeBoot ® Administration
McAfee, Inc.
Once you have removed the SafeBoot Client from your machines,
you can remove SafeBoot Administration:
• Use the “Add/Remove Programs” utility from the Control
Panel and choose the “Remove” option for SafeBoot
Administration Tools.
Once you perform this step, you will no longer be able to remove
SafeBoot or recover passwords from remaining Clients. Make sure
you have removed all clients before removing the administration
software.
32

Notes
McAfee, Inc.
33