File Share Encryption

I'm trying to encrypt a partition on a second SATA disk in the expansion bay of my Lenovo W520.  It's a basic disk formatted with MBR.  I already have the main boot disk encrypted in the normal way.

I want two partitions on the second drive, one bootable (for a second OS) and one just for storage.  I want to encrypt the storage partition, but leave the bootable partition so I can boot into that OS without PGP.

PGP desktop lets me start the encryption just fine, but it stops immediately.  Nothing is in the logs, nothing in the event viewer.  Then if I try again nothing happens at all, until I restart the Symantec Endpoint Security service, when it does the same thing again.

It always does this, regardless of how many partitions I have on the second disk.  I tried deleting the bootable one, still nothing.

I've googled all over the place but found nothing.

First it would be great to enable debug logs on the client to see if there is more information logged that could point to an issue. Also running the latest Encryption Desktop client would solve some issues that happened with older versions (especially related to disk encryption). When you select to encrypt the partition and nothing happens / progress is stuck at 0%, it basically means that for whatever reason (that can be quite a few) it is unable to start the encryption on the partition. If that is due to GPT (not in your case since you mentioned it is MBR) or issues with a particular hard drive (there were/are some issues with particular Western Digital or Hitachi drives). HOW TO: Add Debug Level Logging on Windows 7 for PGP Desktop http://www.symantec.com/business/support/index?page=content&id=HOWTO64205

Wait.. issues with Western Digital drives you say?

This is a Western Digital WD5000BPVT on SATA bus, and PGP is version 10.2.1

From the logs and their timestaps it looks like that it tries to start the encryption process and stops it immediatly (no detailed reason given sadly). That said, I would try to see if the latest version of the desktop client also has this issue with your drives. With other customers and WD drives that looked to be all ok, but did not want to be encrypted, updating to version 10.3.1 solved the issue.

 

Your client version is currently 10.2.1 MP2 (build 4869).

Your server version is currently 3.3.0 (no build number is shown so not sure if there is a MP applied).

 

The latest desktop version is 10.3.1 (build 13100) and server is 3.3.1 (build 13100).

You probably should be able to get the upgrade from http://fileconnect.symantec.com which could either update the complete server, but as a test it would make more sense just to download the client installer and update this particular client only. If that solves the issue, you could plan to update both the server and other clients to the latest version as well.

Upgrade to Symantec Encryption Management Server 3.3.1
http://www.symantec.com/docs/HOWTO93842 

Symantec Encryption Current Version Available
http://www.symantec.com/docs/TECH187067

 

Version 10.3.0 is on our corporate intranet.  However it also contained a note saying secondary hard drives installed in a caddy in a laptop were not supported.  I thought this was odd so I Googled for it and came across some more articles.  I followed links to this article

http://www.symantec.com/business/support/index?page=content&id=TECH173657

Which says that drives with native 4k sector size aren't supported.  My drive is as follows:

It says physical sector size is 4k but sector size is 512b.  Does this mean it supports 512e sector emulation?

Your drive is a WD5000BPVT Specs: WD Scorpio Blue Mobile Hard Drives http://www.wdc.com/wdproducts/library/SpecSheet/ENG/2879-701278.pdf The specs mentions that AF is indeed set for PVT models only (which you have). Advanced Format Technology White Paper http://www.wdc.com/wdproducts/library/WhitePapers/ENG/2579-771430.pdf So it seems that indeed 512e is available. If version 10.3.1 does not solve the issue, it could be that running the align utility helps. (Note that I did not test this at all, but it is mentioned for the usage of these drives in an external closure). Installing an Advanced Format WD drive into a third party USB enclosure http://wdc.custhelp.com/app/answers/detail/a_id/3885

Did Japkes response solve your problem? If so, please mark his post as the solution. You could download Symantec Encryption Desktop 10.3.1 trial from here:

https://www4.symantec.com/Vrt/offer?a_id=109355

This would allow you to at least test this version and if it works they can license it with your Symantec Encryption Mangement Server. It would probably be a good idea to get your IT dept to upgrade the server version to 3.3.1 to support these newer clients first.

 

Also, was it possible that the dirve was formatted as some point as GPT then switched to MBR format? There was a known issue in 10.3.0 where this would cause problems with encrypting the drive in this case because Microsoft would leave an EFIPART string left over on the disk. This was resolved with 10.3.0 MP1.