Endpoint Encryption

Hi All,

A few questions regarding upgrade please?  Have read article http://www.symantec.com/business/support/index?page=content&id=TECH164395:

* When did 7.0.6 go out of support/EOL?

* Is an inline upgrade of 7.0.6 > 8.2.1 (MP9) supported and does it nwork or any extra steps involved beyond the above article?

* After the management server is upgraded and looking to upgrade clients - for laptops with Full Disk client - does the hard disk have to be decrpyted first then have the FD client installed/upgaded?

* What deployment mechanism is used to upgrade the clients (i.e. is there autoupdate something in SEE or this dirven by what is in the environment i.e. SCCM..etc..etc)

* Any other considerations or issues people have seen.

Thanks in Advance!

I'll have a crack at these 

1. You can check EOL information for SEE on the below link (just select 7.0.6 from the version drop-down):
   http://www.symantec.com/business/support/index?page=releasedetails&key=55414
2. An inline upgrade is indeed supported.  In fact, inline upgrades can be performed even from GuardianEdge branded products:
   http://www.symantec.com/docs/TECH193044
3. As per the above article and the one below, decryption of HDDs beforehand is not required:
   http://www.symantec.com/docs/TECH104199
4. Unfortunately, there is no native auto-upgrade option other than via GPO (which can be managed from within the SEE Manager Console but is not exactly built-in).  The above article from step 3 can be easily scripted and works fine in Altiris, I don't imagine SCCM would be that much different.
5. As far as any gotchas go, just make sure you back everything up, and thoroughly test on each/every model of machine before pushing out.  As you already have machines working on 7.0.6, the upgrade should just work, but there have been a few cases of issues as below:
   
   http://www.symantec.com/docs/TECH172083
   http://www.symantec.com/docs/TECH178216

Man Thaks SML -  a new model of laptop and SSD's has prompted the upgrade as well as staying current!  Thank you for the quick reply!

No probs 

As you're looking at SSDs, I'd recommend you have a search around the SEE KB, as a number of issues have been raised about SSDs in general.  Also, AFAIK, SSDs that run hardware encryption is not supported (not even those adhering to OPAL standards).

Thorough testing is the best thing to employ.

On a final note, if all works out, please remember to mark a post as the Solution in order to aid others that may have the same question.

Yes, one of the prompts is SSD and an article pointing to new verison as a work around as we have seen poor performance on an SSD laptop we have tested on v7.xxx.

I was unaware these are not supported from Syamntec.  Thank you for highlighting this!

Reading the Admin guide for MP11, some things are open for interpretation or my understanding:

Can you confirm the FD clients can definately be installed/upgraded on a device with FD client that already has it's disk encrypted?  I ubndersatand this is fine for the management server.

Comments I have seen:

(1) "Ensure that the hard drives of the Client Computers are not encrypted with any other full disk encryption software before deploying Full Disk."

(2) "Full Disk must be uninstalled before an upgrade to the operating system occurs. Moving from one Edition

to another is considered an upgrade of the operating system. The application of a service pack is not
considered an upgrade of the operating system.

[I assume 'edition' here refers to Operating system installations and not edition of SEE?]

Also is there an upgrade document or just the mentioned KB?  Install guide doesn't appear to have an upgrade section, unless I have overlooked it?  Thanks a million.

I got the below from page 146 of the SEE-FD installation Guide:

About Upgrading Windows Clients
Always upgrade Framework first. 
Note: The Encryption Anywhere brand was phased out onAugust 28, 2007. If you have any Encryption 
Anywhere clients, before attempting to upgrade to this release, ensure that the following minimum version 
is installed: Encryption Anywhere Hard Disk 8.2.0.
Note: The Encryption Anywhere brand was phased out onAugust 28, 2007. If you have any Encryption 
Anywhere clients, before attempting to upgrade to this release, ensure thatthe following minimum 
versions are installed: Encryption Anywhere Framework 8.7.2 and Encryption Anywhere Removable 
Storage 2.0.0 or 2.1.0.
The latest version of Framework is only compatible with the latest versions ofFull Disk and Removable 
Storage. All three must be upgraded.

Essentially, the old Encryption Anywhere product the Install Guide talks about is even older than v7 of SEE and should work fine for the upgrade.

As always though, test thoroughly first before proceeding to production machines.