File Share Encryption

Hey All.

As the title suggest, don't try to encrypt your Retina MBP unless you want to brick it. I'm sure this is Apple's fault because they probably changed something. Not terribly upset myself since I expected it and did it for experimentation.

Anywho after you install the latest PGP and try to restart, a couple things happen.

Obviously the PGP box shows up as the tiniest box you've ever seen in your life (on the retina screen). About 1/4th the size of the normal screen. 

The keyboard input externally and internally DOES NOT WORK properly. You can type in the first 10 or 15 characters, after that the PGP window will no longer detect your keystrokes. I had to hit enter about 14 times before it finally told me that my password was invalid, and to invoke the language menu I had to hit the function key about 3 times before it took. 

Even if I show my keystrokes to the known good passphrase it still does not work. It will either tell you that it's incorrect or it will let you progress but get stuck at grey screen, like what you would normally experience right before it goes to the apple screen and lets you boot as normal. 

I tried different keyboards and booting to different screen sizes (external monitors). Non seem to have worked. 

As for bare metal recovery well I havn't tried anything yet but I should be able to redownload lion with the recovery console. 

Again this is just to report my experiences and to make sure that no one else gets stuck in this situation. This was my new test box so I went in with full understanding that it might screw things up (and it did). Though if anyone else has different experiences (or maybe a fix) please share. 

I too had the exact same experience on Thursday when my system was delivered.  Luckily, I have used PGP for many years on the Mac and expect such behavior. 

I booted up the new system, ran Software Update and installed.  After rebooting I installed PGP.  Once installed, I rebooted and when the machine came back up I kicked off the encryption.  Everything looked fine but after rebooting, the boot screen was presented and I could not go any further.  Exact same situation as the person that posted above me.

I hope Symantec will respond instead of waiting weeks and then responding that a patch will be coming in the next few weeks.  That will be perfect timing for PGP to break again when Mountain Lion is released. :)

Exactly as you've described.  Two machines currently suffer; Rescue Disks to do not help. Ended up using firewire transfer mode to decrypt.  They were fine afterwards.

what version of PGP did you use?

I'm using using 10.2.0 Build 2526.

I've tried with the latest Rescue disks (running a newer version).

Promoting this to a sticky thread while we are investigating.

Has anybody tested with PGP Desktop 10.2.1? By the way, if you have an enterprise support case. Please contact support so that we can gather information and determine if this is a bug with the new hardware.

I tested it with 10.2.1 ,whatever the latest build available through the licensing manager was. I will try to contact support eventually.

Again if this isn't weird enough, the build of 10.7.4 that is included with the rMBP actually mounts pgp virtual disks successfully. Only Apple can break one thing while fixing another.

I can tell you with 100% certainty that I used 10.2.1.  This being a brand new machine, I went to fileconnect and downloaded the newest version.

Let me reiterate that PGP was the first application that I put on the machine, besides the default stuff put on by the OS and software updates.

One thing I've noticed is that the drive manufacturer is listed as "Apple" - does this ring true for you all as well?

Same issue

https://www-secure.symantec.com/connect/forums/symantec-pgp-1021-nukes-osx-1074-bootloader-bricking-laptop

Are you sure this is the same issue? 

The symptons here are:

PGP Desktop Encryption screen appears on boot

Keyboard input is ignored, no way past UI to boot OS X. 

Apologizes,

I hope this can helps

http://www.symantec.com/docs/TECH149729

Did you set keyboard to US encoding?

Is there anyspecific symbol which is not working ? (check typing in passphrase in user´s field, where you can read it)

This is not a keyboard layout issue.
For reference, I'm a Desktop Support tech/admin and I'm familiar with diagnosing these types of issues.

To reiterate:

The bootloader/pgp desktop encryption screen pops up, but upon typing the input freezes within 10 seconds. I can switch to WDRT screen but input freezes there as well. I can unhide the input and am 100% sure that the keys are being entered properly; after around 10 characters it freezes entirely. This has happened on TWO brand-new Macbook Pros running 10.7.3 and 10.7.4.  Problem is identical in each case.

Darn I wish I would have recorded it.

Yochai Gai is right, this isn't a keyboard layout issue. The problem is the keyboard input is ignored multiple times during the process.

As I mentioned in the OP, it takes several keystrokes for the function key options to work. When I could get to the layout menu, it was at the default US English as I expected. This isn't the same issue as the bricked bootloader either because we can never get to the Apple logo screen if we can even type our passwords in to begin with. Trust me, I had a failed bootloader issue when I went to, what, 10.7.2 -> 10.7.3; this issue has much different behavior.

I know the rMBPs are in short supply so if I need to post a video that show the symptoms than I can do so, but it looks like all of the recent macs are having this issue.

Here are the drives currently used in both MBP's I've installed the latest PGP Desktop on:

http://www.costcentral.com/proddetail/Hitachi_Travelstar_5K750_HTS547550A9E384/0J11561/11247124/

Not the "self-encrypting" feature. I wonder if there's some conflict there? 

 

We don't support 4k Native sector disks if there is no 512e mode. I can tell you that. This model, Hitachi HTS547550AE384 says that it uses 4k sector according to several specs that I found published online. But there is nothing about whether the drive supports 512 byte emulation mode or not. But the symptoms of an unsupported 4k sector disk is usually different in that it won't show us a volume that PGP Desktop is able to encrypt.

We do have a bug open with engineering already on this issue with the new Retina display Macbook Pro models with the Ivy Bridge chipset bricking the mac.  I know that this is unfortunate, but the best bet is to use a recovery CD or target disk mode to decrypt the mac for now if you've already encrypted at this point.

Symantec Bug number is:

 For your reference

Which version to fix it?  When available?

What am I supposed to use that Bug number for? Is there a KB article on this yet?

Thanks

The bug number is for support to track the progress of the issue. We are working on a KB article for this issue.  But it looks like we are working quickly to get this issue resolved. I don't have an ETA as of yet.

The bug has been escalated to a priority 1. We don't have a target release date yet. I will update the forum when I have more information. I apologize for any inconvenience this has caused you. In the meantime, we have updated our site with a blog post warning customers.

For a workaround, please do not encrypt your 2012 Macbook Pro with Retina display model.  If you are already encrypted please try the recovery images here to decrypt and repair. Make sure that you use the correct Recovery CD version that matches the version that you encrypted with:

http://www.symantec.com/docs/TECH176187

Also for updates:

https://www-secure.symantec.com/connect/blogs/do-not-encrypt-if-youre-running-latest-macs-powered-intels-ivy-bridge-cpus

We will keep you posted regarding a fix.

Excellent Guys, thanks for all the information.

Please ask the PGP Engineers to not drop support for Mac OS X. I wouldn't be surprised if they did, given the frequency that Apple tweaks those tiny little things that create big problems for which everyone is up in arms. I think the broader community understands the intricacies of a whole disk solution and honestly given the secrecy of Apple for new products, there is no way on the planet that developers can test for issues like this on hardware that practically doesn't exist to the outside world, which must be extremely frustrating.

I've tried encrypting the new (mid 2012) MBP 13inch and 15inch.Both models would only boot to a grey screen.

I only have one 15 inch model to test, has anyone successfully encrypted one of these? I realize this thread is about the Retina but the 15 inch regular seems to be having issues too.

A workaround to test with, I have been told, is to enable bypass on BootGuard (PBA).  You can do so, after encrypting with the pgpwde --add-bypass command from a terminal.

Example:

pgpwde --add-bypass --disk 0 -ap "admin passphrase here"

HI All,

technicly all IVY-Bridges seem to be affected but for the non retina model enabling permanent verbose mode seem to overcom the Issue.

Unfortently I only have the retina model so I can't verifiy it.

But when someone want's to test:

1. sudo nvram boot-args="-v"

2. Install PGP

3. Encrypt Disk

Don't be suprissed Bootguard will look completly diffrent (text only mode)

Maybe that works.

But what I can say is that the Issue is still under investigation.

Is this fixed with the July 24th release?

Not sure why this is Accreditied.  Trying this just bricked my Retina Mac Book.  Do not try this work around.  You get a User\PW B&W text promt but it freezes after a few keystrokes.  Sven, I have no idea how you saw this working...  PGP Server 3.2.1MP2\Desktop 10.2.1

Hi Skyit,

no 3.2.1 MP2 doesn't contain the fix for the Ivy Bridge Models

Support has a HF since today which can be requested:

You need for now: PGP Desktop 10.2.1 MP2 HF3

10.2.1 MP3 will contain the fix in general.

How can I apply this to a system that is already experiencing the issue.  Target disk mode is not avaialable (Thunderbolt cable hasnt arrived yet) and the Retinas SSD is not removable.  

And I realize that 3.2.1 doest contain the fix, but you siad in your above comment that the workaround did work on retina systems.  I attempted it and got the text CLI but still expereiced the freeze.   How were you able to get past the bootloader?

Hi All,

let me explain this in detail:

Hotfix: Available for Customers with valid Support Contract + Maintenance

10.2.1 MP3 will be available within August timeframe and communication about this Version will be via the normal channels. This will be the first general Release which will contain the Fix.

So also to make this fully clear:

10.2.1 MP2 = No Ivy Bridge Fix

10.2.1 MP3 = Ivy Bridge Fix included ==> Release will be available within August timeframe.

And why can't this hot fix just be posted to fileconnect?

We have to go out of our way to create a support case and wait around for a response just to get working software?

This is because hotfixes are not Generally Available releases. Maintenance Packs are. If you wish to get the hotfix send me a message, I will request the hotfix be issued to you. But you have to have some type of support agreement. Even if it's just a basic support contract. When contacting me, please include your customer number, customer name, address, email address, any other relevant information that you have for me to be able to locate you with and we'll get you taken care of.

NOTE: Do not post customer specific information in the forum thread. Please instead message me using the messaging function of Symantec connect.

erased

erased

hotfix confirmed working on Retina running 10.7.4.  WDE working 100%.  Mountain Lion......no go.  I'll wait for Mountain Lion for now, just happy to have WDE back

Wahoo. Also confirmed hotfix worked on my MBP that was the victim in the OP. Feels good to be wrapped up all warm in the PGP blanket. I dont plan to install ML unless I have to so i'll be on this bandwagon for a minute. 

erased

To Sven Frank and PGP Ben,

Gents, will the fixes in 10.2.1 MP3 be migrated over to SEE for Mac at some point? 

Yes, it is my understanding that MP3 for SEE will be out at the same time and it will have the fixes for the FDe issues with the Ivy Bridge Mac's as well.

Thanks Ben. I will look for it in the next few weeks. Is it possible for us to get an update if it is released? Is there a mailing list we can subscribe to for new releases of Symantec PGP and SEE clients?

Thanks!

It looks like you can subscribe to this page. Which notifies you when a new product update is available.

http://www.symantec.com/business/support/index?page=content&key=59267&channel=ALERTS&basecat=ALERT&sort=recent

You can also subscribe to the KB article reporting this issue in particular and when we update that (usually takes a few days after the product release is out) then we will notify you there.

http://www.symantec.com/docs/TECH191890