topic Re: How to check if FDE now works on Test PC? in Endpoint

How to check if FDE now works on Test PC?

K-R_-Trust-Net — Wed, 09 Feb 2022 03:29:40 GMT

Hi Everyone.

This link was solved by disabling the pre-boot option of the FDE blade.
https://community.checkpoint.com/t5/Endpoint/Cannot-access-the-remote-PC-after-i-tried-to-deploy-FDE/m-p/140948/highlight/true#M5103

i was successfully can log to Dan-PC yet the problem is that i cant check if the FDE is pushing to the PC.
i cant see the padlock icon on the system tray (taskbar)
https://sc1.checkpoint.com/documents/R80.40/SmartEndpoint_OLH/EN/Topics-EPSG/FDE-CPEncryptionPolicy-configuring.htm?tocpath=Full%20Disk%20Encryption%7CCheck%20Point%20Full%20Disk%20Encryption%7CConfiguring%20a%20Check%20Point%20Full%20Disk%20Encryption%20Policy%7C_____0

i tried to check and update the magnifying glass icon in system tray but it seems that the blades that i disable in the deployment tab of Dan-PC in the smartEndpoint still looks updated and working.. is this a system limitation of the checkpoint demo environment?? if not, how could i make fde works in Dan-PC??

Re: How to check if FDE now works on Test PC?

PhoneBoy — Wed, 09 Feb 2022 05:02:03 GMT

I believe FDE isn't supported in virtual environments.

Re: How to check if FDE now works on Test PC?

K-R_-Trust-Net — Wed, 09 Feb 2022 05:25:22 GMT

How can i test it out if that would be the case??

Re: How to check if FDE now works on Test PC?

Chris_Atkinson — Wed, 09 Feb 2022 12:58:02 GMT

Provision a eval instance of Harmony Endpoint @ portal.checkpoont.com and enroll a non-production test PC that you don't mind reimaging etc

Re: How to check if FDE now works on Test PC?

K-R_-Trust-Net — Thu, 10 Feb 2022 04:50:02 GMT

may i know how i can do this suggestion?? do you mean to test it in infinity portal??

Re: How to check if FDE now works on Test PC?

Chris_Atkinson — Thu, 10 Feb 2022 07:55:07 GMT

Correct register for the Infinity Portal and commence a trial of Harmony Endpoint.

Alternately if you have the means you could install a cloud or on-prem hosted management if you have a lab?

Re: How to check if FDE now works on Test PC?

K-R_-Trust-Net — Thu, 10 Feb 2022 08:39:50 GMT

seems like i will need to install a vmware worstation environment that i will use to connect to infinity portal to play with FDE. (i hope this one would work or else the option below would be the most viable one.)

yet, i think its a hard pass, though if i would really want to implement it into the smartEndpoint, it would be painful since i will need to install GAIA on a vmware environment, set it up and download the smartEndpoint and deploy it to another vmware environment.. am i right??

Re: How to check if FDE now works on Test PC?

Chris_Atkinson — Thu, 10 Feb 2022 10:40:07 GMT

No all you need is the Infinity portal - harmony endpoint and test PC.

VMware workstation isn't required here unless you choose not to use the Infinity portal hosted Harmony Endpoint.

Re: How to check if FDE now works on Test PC?

K-R_-Trust-Net — Thu, 10 Feb 2022 23:38:30 GMT

Hi Chris, Maybe i try to do this suggestion then ill get back to you what results would i get.

Re: How to check if FDE now works on Test PC?

jcortez — Thu, 17 Feb 2022 14:26:30 GMT

@K-R_-Trust-Net

What @PhoneBoy mentioned, FDE not being supported on VM, is very accurate. It is only meant for testing and does not always work. As others have suggested you should always be testing FDE on physical machines to get a true testing scenario.

Re: How to check if FDE now works on Test PC?

jcortez — Thu, 17 Feb 2022 14:32:08 GMT

@K-R_-Trust-Net

Also when using/enabling FDE the is a FDE Preboot that is enabled for logging into the machine securely. There is no network connectivity when at preboot. The FDE Preboot login is meant for a user to be directly at the machine and not accessing the machine remotely.

If you are trying to access machine remotely that have our FDE solution on them and Preboot is enabled, the user(s) would first need to login through preboot in order for you to remote into the machine/Windows. This is expected behavior and how the product is designed.

If you do not want to use preboot it can be disabled. However, this is not recommended as this would decrease the level of security being offered by FDE.