Endpoint Encryption

I just bought PGP Desktop Clients 10.2 and tried to install.  This error came up "PGP memory locking facility is not functioning correctly..." and said to uninstall then reinstall, which I did twice.  The same error message still came up.

Who has a solution?

I have a Dell Vostro, Windows 7 Home edition, 64 bit.

Did you use the 64 bit PGP installer?  This has been reported to occur in the past when one used a 32 bit PGP installer on a 64 bit Windows.

Was this helpful - do you need further assistance?

Dear Tom,

I have the same problem. I have installed PGP Desktop 10.2.0 on a Acer Veriton M670G with Windows 7 32 bits. I have used the 32 bits PGP installer. I reinstalled 3 times but the problem continues. Please, help me with the solution.

PGP must be installed from an admin account - could this be the problem?

Yes, I used the 64 bit installer.  This time it seemed to install correctly and loaded the previous keys.  However, when I restarted the machine,  the same error message came up again.   

I installed as administrator.

I'm not finding anything further specific to this problem and its resolution.  However, I wonder if this might be a variation of the conflict described in these two Knowledge Base Articles:

http://www.symantec.com/business/support/index?page=content&id=TECH149733

http://www.symantec.com/business/support/index?page=content&id=TECH149364

Thanks for your response, but we are installing PGP Desktop 10.2.0 with Administrator privileges. We uninstalled PGP Desktop from Control Panel, erased the folder My Documentos-> PGP and after reinstalled PGP Desktop with Administrator privileges but the problem is the same. I hope you can help me. Thank you...

Dear Tom,

Can you help me with this issue. Please, the customer is very frustated. I hope your early response. Thank you...

The only other thing I can find on this is that it may be related to antivirus/anti-malware software that might interfere with the installation.  So, it may help to deactivate such software before installation.

Try disabling DEP :

Right click Computer, Properties, Advanced System Settings, Advanced tab, Performance, Data Execution Prevention. You should add c:\windows\system32\msiexec.exe if installing from .msi file.

If can´t add the DEP exception, you can disable DEP completely (not recomended but just for testing).

Open an administrator console in windows 7, and type in this command:

bcdedit.exe /set {current} nx AlwaysOff

You should receive "This operation completed succesfully"

Reboot and try PGP installation.

Please feedback results

Are you using UAC? If so, I would try disabling UAC temporarily and see if that resolves your problem.

Dear Tom, the customer has Symantec Endpoint Protection. We have installed and encrypted on other machines and the issue does not appear. We have a encrypted HP ProBook and the problem is the same. The screen I showed you appears.

Dear Julian, I am going to add the msi.exe in this window, but if I can not, please can you say me what is the exact command (bcdedit.exe /set {current} nx AlwaysOff) because I do not know what I should write insted of {current}. Please remember that I can install PGP Desktop 10.2 but after I restart, appears the message PGP memory locking facility is not functioning correctly.

Dear Ben, I am going to say check your proposal. Please remember that I can install PGP Desktop 10.2 but after I restart, appears the message PGP memory locking facility is not functioning correctly.

I hope you help me, please the situation is critical.

Hi everybody,

I have an encrypted laptop HP ProBook that shows the same message. The problem with the ACER Veriton M670G is after I install and restart the desktop. Please, do you know what means this message. I think PGP Desktop response with this message to an event but I need to know what is the event that generates this issue, I do not know for example: any registry key or any parameter that generates this message.

Please I need your help. I hope your response.

I'm having this same problem now.   I've been running PGP Desktop for months with no problems ... all of a sudden today when I booted up my computer I'm getting the dialog box that says "The PGP memory locking facility is not functioning properly .... blah blah blah ... uninstall PGP.... then reinstall..."

which I did, twice ... the message keeps popping up now when I start my machine.  Nothing changed from yesterday, I have no idea why PGP all of a sudden stopped working, and reinstalling doesn't help.

Any help would be appreciated.... even who I should contact.  I've spent an hour going in circles with Symantics phone system and online support.... it just sends me in circles, and when I finally get to a human, either in chat, or on the phone, they just point me to another place that points me back to them.  Very frustrating.

I'm running Windows 7 64-bit SP1, PGP Desktop 10.2

Although it is certainly best that the memory locking work as designed, it is not a major problem for most users if it doesn't.  The memory locking is designed to prevent certain confidential information, such as your passphrase, from being written to your system's paging file.  This problem can be mitigated by not using virtual memory if your system has enough RAM and doen't need it, or setting Windows to zero out the paging file when closing Windows.  This problem does not otherwise affect your use of PGP, and all of its encryption and decryption functioning will continue to work properly.  Some Open PGP compliant encryption software doesn't even attempt memory locking on Windows machines.

Thanks so much for the speedy response, Tom.

So I'll keep using it without the memory locking ... no big deal for me, my data isn't that sensitive, really, to worry about it.  Still, I'd like it to work if it's supposed to be working... so, what I'm wondering now, is... are there any planned updates to PGP Desktop?  This little ordeal had the side effect of me scouring the Symantic website, and, as a result, I now have the feeling this is a product they don't plan on continuing.  Is it even possible to buy PGP Desktop (with virtural disk) now?  All I found was a mention of "Email and Netshare" and another of "whole disk encryption" ... so, are they splitting PGP Desktop into these individual functions, and leaving out "virtual disk", which is what I mainly use it for?

Just wondering... I hope there's a PGP Desktop 10.3, and 11.x some day soon.

Thanks again for the speedy help.

This PDF describes the process for obtaining updates when they are available.  Updates and upgrades are always being worked on, and I've heard nothing to suggest this is being altered, so I don't see anything sugesting that the Desktop product is being discontinued.  I just yesterday discussed with my Manager that the PGP Products page does not mention the Desktop Products other than those specific licensing - I think just is just part of the transition to the Symantec organization.  There is still just the one Desktop software package, with the licensing determining which product is available for use - I'm not aware of any plan to change this, and the Desktop licensing is still available even if hard to locate - the link to Chat with Sales option on the pages for the products you are seeing listed should be an easy way to locate what ever licensing you need.

We bought licenses for 35 computers and on the laptops with Windows 7 64 bit, the error message is starting to pop up.  This impacts about 10 of my users.  So from reading the thread, it sounds like the advice is to tell them to ignore it.  I used the 64 bit installer, installed and encrypted the harddrives just like all of our other computers.  Can we get some idea of when Symantec is going to fix the issue and have an upgrade available?  It sounds like a bug that needs to be fixed.

This is being pursued internally as a bug needing fixed.  However, the impact is described as I mention above regarding the passphrase possibly being written to the paging file.  There is one reported work around at this time:

Creating a new local profile on the machine and installing PGP under that profile

I don't know when a fix will be made available for this, the the resolution is being pursued.

This has still not yet been fixed, but there is a reported work around that will most likely take care of the problem:

On an affected system run regedit (as Administrator). Go to the following registry key:

HKLM\System\CurrentControlSet\Services\PGPsdkDriver

Note that there is a DWORD entry named "Start" with a value of '2'. Change this value to '1'. Close regedit and reboot the computer.

Please check the Article :

http://www.symantec.com/docs/TECH175674

This link is coming up with an error for me.

I'm guessing there is a temporary server problem - I've seen the same response today when following links for other KBA's.

I'm experiencing the same issue on a Viao VPC215FX.

The URL posted in the earlier article (http://www.symantec.com/docs/TECH175674) does not work. It's been several days since the first person reported an issue. Has this URL access issue truly been reported/investigated?

The registry workaround above sounds unsure/unsupported/unofficial. Is it official or not?

I saw the above comment about ignoring the error message. That doesn't seem like an appropriate solution. 

Additionally, the clear pagefile on shutdown solution also doesn't seem like an appropriate solution. It forces users to do a full shutdown to make up for the product's issues. It also takes longer to shutdown than to simply sleep the system.

I just purchased a license of desktop w/WDE for about $300... a fairly high price for the software. I think this sort of defect should be resolved relatively quickly by Symantec and any workarounds should be offerred as official solutions w/specific steps providing guaranteed outcomes.

When will this issue be properly fixed, and what are the interim concrete workarounds which keep security and overall usability of the system equal to that of when things are working fine? Thanks.

I just checked that link again in response to your report, and it is not going through now either - it might be a bad link instead of a server problem.  The last work around I reported, as I recall, was from the then ongoing tech support case on this issue.  Tomorrow when I'm on my Symantec computer, I'll check that out and see if there is anything new I can report.  As I said, I will try to check this out (can't do that from my personal computer), but if you just bought the software, you also have the option of opening a support case on this with tech support.

The product-level fix will be to change the registry setting in the installer.

Thanks David... that helps. Based on that, I'll employ the reg tweak. It might be helpful to others if there were an official Symantec KB article w/that tweak at an accessible URL ... at least until the official patch comes out. Just a suggestion. But as mentioned your clarification really helps, gives "officialdom" to the tweak... thanks again, Tom

I too was receiving the message indicating that the "PGP memory locking facility is not funtioning correctly", so I tried the registry fix from the earlier post, and I no longer see the message when my laptop reboots.  However, I am now seeing a different problem.  I have two drives in my laptop, the C: drive has been encrypted and I now want to encrypt the D: drive.  When I open up PGP Desktop and select Encrypt Whole Disk or Partition, only the D: drive is displayed, the encrypted C: drive is not in the list of drives.  The user that I created is not displayed on the lower half of the window, and when I try to encrypt the D: drive I get no response.

In order to encrypt the D: drive, I had to reset the value of the Start parameter in:

HKLM\System\CurrentControlSet\Services\PGPsdkDriver

back to a value of 2.  After rebooting, I received the error about the memory locking facility, but I can now see both drives in PGP Desktop, the user that I had defined, and I can now encrypt the D: drive successfully.

Any thoughts?  Jay

I would also like to know thoughts on this as I was about to deploy the registry fix when I came across this post.  I don't want to cause another problem by implementing this.

I'm sorry you're seeing this additional problem.  We aren't seeing it in our testing.  Our engineers are also not sure how or why the registry change might lead to the behavior you are seeing.

Are you confident that this was the only registry change, and is the issue quite consistent?