Desktop Email Encryption

Hey guys,

I have one PGP user who has got trouble with his PGP Desktop application. It started with having policy issues. He tried to send a mail to a non-PGP user. Unfortunately he receives a NDR that this is not possible, due to policy reasons, there is no keyring for the recipient. So the application was not able to decide to use encryption or not, it always tries to encrypt for all recipients.

Then I removed the PGPpolicy.xml files from "%appdata%\PGP Corporation\PGP"
After a restart the PGP Desktop seems to download the policies again, but the former situation of alltime encryption occurs as well.

Then I removed both *.xml files from "%appdata%\PGP Corporation\PGP" to trigger a full re-enrollment.

Unfortunately the PGPtray.exe is not willing to come up. Even after a restart. The first uninstallation try failed as well, the process did not finish. After a repair of the application I was to install a newer version of PGP Desktop (I recognized that he still used 10.1.0.860 while the other users already got 10.2.1.5033). I even tried the 10.3.2 MP11 after a clean installation. PGPtray.exe keeps beeing lazy and a start of the PGP desktop app provides this error...

User is not on VPN, can access all other resources, can access https://myPGPserver.com/b/l.e

I have looked up the eventvwr, but unfortunately I did not find obvious error messages.

How could I solve this one?

Universal server: 3.2.1 MP5

Thanks in advance.

regards,

Christian

Hi Woelki,

Looks like you have already tried almost all the possible option from the article below. 

https://support.symantec.com/en_US/article.TECH155959.html

Please check few more options.

Please check the  PGPSTAMP, click Start > Run > Regedit. PGPSTAMP can be found in the following container:

32-bit machines: HKEY_LOCAL_MACHINE\Software\PGP Corporation\PGP

64-bit machines: HKEY_LOCAL_MACHINE\Software\Wow6432Node\PGP

It should look like. ovid=myPGPserver.com&mail=*&admin=1

Please check if it is with IP or with the hostname. Also need to check proxy settings.

Hi Woelki,

Any update on the status of the issue. Please comment on this forum if you need any further information on this, or if this has been resolved.

HI 

at the moment the PGPSTAMP is "ovid=pgp-v-01.mydomain.com&mail=*&admin=1" but I will now try to change it to the IP when I have a remote session with the user later.

In general in the company proxy settings are used. For the last enrollment just to be sure I have deactivated proxy for this user. But he uses the same wpad.dat like all other users.
Is there anything special I have to check?

By the way I read here in the forum that the user must be able to execute telnet mypgpserver 443 and telnet mpgpserver 9000
But I guess the last one ist not necessary, right? Because other users can't do it as well.

I will update about the PGPSTAMP later.

Kind regards,

woelki

Hi Woelki,

If you are using proxy, Enter the Symantec Encryption Management Server FQDN into the exceptions list (separated by semicolon if needed). Use the same name as in the PGPSTAMP registry entry. Telnet to port 443 is required for enrollment.