Endpoint Encryption

Hello,

I need to deploy (SEE 11.1) SEE full disk encryption and SEE removable media encryption in our WIndows AD environment.

Question:  How long is everyones install times on Windows 7/8 machine startup when deploying the SEE MSI's via GP?

I understand package deployment performance is dependent on network speed but what I'm experiencing is the install on startup for all packages takes a long time regardless of network speed, it doesn't matter whether the machine is on the LAN or remote site, it takes 10-15 minutes. The user is stuck watching the package name appear on system startup for that amount of time before it installs and the user can start using it.

I know this is a one-off install but anything above 5 minutes for a package deployment this size is too long. If I look in a machines Event Viewer/Group Policy I can see an error under Event 7016   Completed Software Installation Extension Processing in 834731 milliseconds (13 minutes).

Other MSI packages in group policy install without delay which makes me think the problem lies with the SEE group policies. The SEE Management Agent when coupled with the FDE & RME packages take similar times (10-15 minutes) to install on startup.

Note: The packages below are on a shared fileserver at our datacentre, we have 200+ sites all of which pickup the below packages from the same fileserver. 

SEE Drive Encryption Client.msi   6,924kb

SEE Drive Encryption Client_x64.msi   7,988kb

SEE Management Agent Client.msi    13,724kb

SEE Management Agent Client_x64.msi    15,608kb

SEE Removable Media Encryption Client.msi   28,196kb

SEE Removable Media Encryption Client_x64.msi     31,436kb

Worth mentioning: All user configuration settings are disabled (as these aren't needed) in Group policy manager which hasn't made any difference.

Any feedback, assistance appreciated.

Thanks, G

The only reported issue that I have seen regarding crazy long startup times are when the packages are installed out of order, which causes the system to fail prerequisite checks and seems to make it hang for several minutes.

Since you have the view set where the user can see the packages, see if you can check what is being pushed first.  You should also check the group policy link order to make sure that the GPO containing the Management Agent is on the bottom (since link order processes from the bottom up).

It should also be noted, if the installs failed the first time (i.e. Drive Encryption ran first, which would fail, then Management Agent installed successfully), I have seen the subsequent reboot take an additional long time while it straightens things out getting the second install completed.  Either perform the second test on a different system, or remove the Management Agent Client before adjusting the link order, etc.

Thanks Mike, I suspect you're right about them installing in the wrong order. Below is a screenshot of group policy manager showing link order on the far lift for the computer container:

As per your advice I've changed the order to the below. Is this correct?

Lastly, I have a GPO called "SEE Policy Controls" which I don't think I need. Should I only have the 6 packages if the settings are in them, not sure if you have an environment where you can check this?

Thanks

I would do it this way unless you really have to use GPO to install it -----

SEP - 12.1 RU5 --- Host Integrity Policy --- can forcibly install the SEE client I have a write up on the forums of how to do it

If you don't use SEP for AV ---- than SCCM --- can also forcibly install the client ----------

The script itself is easy to do if you have Windows 7  / 8.1 / or even Windows 10 ---- you can use Powershell scripts to install the entire thing

We got the script down to run -- download --- install --- with time factors for safety too 10 Minutes ----

Changing the order as you have should work.  Note that on an existing system where it already had the long boot issue, it will probably have that same issue one additional time, but if you use a fresh system to test, that should make it much faster.

Thanks Mike, I changed the order and used a fresh system to install. On startup I saw it installed in the correct order this time round, however it took 14 minutes 49 seconds to install/disappear from the windows startup screen. The system then rebooted , I logged on adn the SEE software was installed successfully. It's still taking far too long!! 

I agree that is still a lot longer than expected.  I usually see a drastic reduction in time to install after the order is modified (e.g. 15-20 minutes drops to 5 minutes or less).  I'll see if I can get any additional insight on this from some other resources.