topic Re: fde control.exe get - status result in Endpoint

fde control.exe get - status result

Valerio5286 — Thu, 13 Jun 2024 17:31:20 GMT

Hello community.
I would like to know if there is documentation on the response statuses of the get-status command with the fde control tool for endpoints. I have tried to search but I can't find it, I attached an image as an example:

It's the same result for registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\EndPoint Security\Full Disk Encryption\Status\Current Boot\encryptionState = 3

Re: fde control.exe get - status result

PhoneBoy — Thu, 13 Jun 2024 19:29:15 GMT

I’ll ask internally.
I would also open a TAC case, however.

Re: fde control.exe get - status result

Valerio5286 — Thu, 13 Jun 2024 19:36:58 GMT

Hi phone boy.

Thank you for your support, today I opened a new TAC request.

Keep in touch.

Re: fde control.exe get - status result

JonnyRabinowitz — Sun, 16 Jun 2024 06:20:01 GMT

Per the following thread:
https://community.checkpoint.com/t5/Endpoint/Detecting-Check-Point-Disk-Encryption-with-NAC/m-p/212280#M8569

encryptionState value which will contain 3 when the disk is encrypted.

Trying to see if can clarify meaning of other values

Re: fde control.exe get - status result

Valerio5286 — Thu, 11 Jul 2024 15:59:14 GMT

HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\EndPoint Security\Full Disk Encryption\Status\Current Boot\encryptionState = 3 refers to drive being encrypted with fde (note: in case of using a recovery media it doesnt update this registry key - This is an expected behavior - sk109933 -The decryption process is performed in the preboot environment, thus the registry value in Windows will not be changed)

You may also refer to following:

sk54740: FDE Registry Values

sk110264: How to determine that FDE installation is completed from the registry

Encryption State
0   Not encrypted
1   Partially encrypted
2 Encryption on all volumes

Encryption_X (Where X is a drive letter)
0 - 100 Percent Encrypted

Encryption Progress
0 Stable
1 Encrypting
2   Decrypting

Note: The Encryption_X key is only updated at reboot, and when reaching 25, 50, 75, and 100% of encryption for that drive.

Example: A machine that have just been installed and have drives undergoing encryption will have State 1 and Progress 1. During the initial encryption these will stay the same, but Encryption_X will change over time.
One that is not selected for encryption (f ex boot protection only) will be 0 and 0.
Example: A fully encrypted machine it will have State 2 and Progress 0, while Encryption_X keys will have value 100.
Example: A machine that is being decrypted (uninstalled) will have State 1 and Progress 2.
NB: All values above are listed as hexadecimal values, but are repesented by DWORDS in registry (binary). Encryption_X value of 100 is actually 0x64 (100).

Re: fde control.exe get - status result

JonnyRabinowitz — Fri, 12 Jul 2024 08:56:56 GMT

Many thanks for the great post. Also, driven off feedback from this post there is a corresponding update on user documentation that is in progress

Re: fde control.exe get - status result

JonnyRabinowitz — Tue, 23 Jul 2024 15:46:50 GMT

Following up with a copy of the section that will be updated in the user documentation and describes the fde control command and output

HTH

Re: fde control.exe get - status result

Valerio5286 — Wed, 24 Jul 2024 18:21:14 GMT

Thanks for the information, Jonny, it is very valuable.

Greetings. 🙂