Endpoint Encryption

Hi,

Im reading that there are some post upgrade script for encryption desktop after upgrading to a specific win 10 version. Im wondering if there is a similar script for endpoint encryption if you run into issues when a user changes his AD password and this is not synced to the local client so a user needs to login with his old password in the preboot screen.

Thanks.

LEVD

Typically, no.

If you run into a situation whereby you've had to change a user's password via a different channel (like through AD), then SEE should pick up the change after the user has logged into Windows at least once, using the new password.  Kinda like below:

1. Admin changes user's password (for whatever reason)
2. SEE's PBA does not know about the change as it is not network aware
3. User logs into SEE's PBA using old password
4. (Assuming the machine is on the Domain Network, then) Machine fails SSO as the creds provided do not match those requested by Windows
5. User must log into Windows using the new password
6. Tell user to log off and on again (which should casue SEE to resync the password)
7. Reboot the machine to verify sync of passwords from Windows local cache to SEE

Alternatively, you could get a SEE Client Admin to unregister all SEE users from the target machine.  This should cause SEE to bypass PBA until a user is registered, which means it should boot straight into Windows and let Windows perform the authentication.  This can be performed by script (https://support.symantec.com/en_US/article.DOC9136.html), but requires the machine already be booted into Windows, so its usefulness can be limited.