The main features of hard drive encryption

• The application encrypts hard drives sector-by-sector. The encryption is initiated when the Kaspersky Security Center policy is applied.
• The application encrypts all logical partitions of hard drives.
• When signing in to the operating system after hard drive encryption has been completed, you will need to authenticate in the Authentication Agent in order to access the hard drives and start the OS. To do so, enter the account username and password set by the network administrator using the Authentication Agent account management tasks. These accounts are based on the Microsoft Windows user accounts used for logging in to the operating system. 
• You can manage the Authentication Agent user accounts and use Single Sign-On (SSO) technology to enable users to sign in to the operating system automatically with the Authentication Agent account username and the password.
• The encrypted hard drives can be accessed only from computers with Kaspersky Endpoint Security installed and hard drive encryption available (see the table below). This minimizes the risk that information stored on the encrypted hard drive can be leaked when it is used outside the corporate LAN.

Requirements

Prior to configuring the encryption settings in the policy, make sure that the managed computer and the Administration Server meet the following conditions:

Encryption technology

The following technologies are available in Kaspersky Endpoint Security 10 for Windows: 

• Kaspersky Disk Encryption
• Bitlocker Drive Encryption 

To encrypt hard drives using Kaspersky Disk Encryption, do the following:

1. Open Kaspersky Security Center 10.
2. Go to the Policies node. Open the properties for the Kaspersky Endpoint Security 10 policy.
3. Go to Encryption of hard drives.
4. In the Encryption technology field, select Kaspersky Disk Encryption.

5. In the Encryption mode field, select Encrypt all hard drives.

6. Click Yes in the Apply hard drive encryption settings window.

7. Go to Common encryption settings and configure the Authentication Agent password settings.
8. Click OK and wait while the policy is applied on the work station.
   

Depending on the version of Kaspersky Endpoint Security 10 for Windows you are using, you can:

• For version SP1 MR4 (10.2.6.3733) and earlier:
  • Enter the username and password for the Authentication Agent account.
  • Create a new password to access the encrypted hard drive during the current user session. 
  • Create a temporary password to access the encrypted hard drive. 
• Version SP2 (10.3.0.6294) and later:
  • Enter the username and password for the Authentication Agent account.
  • Create a temporary password to access the encrypted hard drive.

To encrypt hard drives using BitLocker Drive Encryption:

1. Open Kaspersky Security Center 10.
2. Go to Managed devices and open Policies.
3. Open the Properties for the Kaspersky Endpoint Security 10 policy and go to Encryption of hard drives.
4. In the Encryption technology field, select Bitlocker Drive Encryption.

5. In the Encryption mode field, select Encrypt all hard drives.

6. Configure the encryption settings. 
7. Click OK and wait while the policy is applied on the work station. 

After the policy has been applied on the work station with Kaspersky Endpoint Security 10, the following requests will be made:

• If the encryption policy is applied to a system hard drive, then a window will appear requesting a PIN code.
• If FIPS compliance is enabled on the operating system, then a window will appear requesting you to connect a USB device for saving recovery key files. This request will happen on Windows 8 and later.

When you start the computer again after completing hard drive encryption, you will have to go through the authentication process in the Authentication Agent in order to load the operating system. 

User identification in the Authentication Agent is completed by:

• Entering the Authentication Agent account username and password that was created by the LAN administrator in Kaspersky Security Center 10.
• Entering the password for the token or smart-card connected to the computer.

If the Prompt active user for password option is enabled in the policy, the Request password for access to encrypted system hard drive window will appear on the computer after the policy is applied and the hard drive encryption task has been launched.

To request a password to access the encrypted hard drive during the current user session:

1. Set a password to access the encrypted hard drive. Click OK.

If the Use Single Sign-On (SSO) technology option is enabled in the policy, during the first reboot you will need to enter the password you set in Step 1. You should then enter your Windows user account password in the Windows welcome screen. After that, the password for the Agent and the Windows password are synchronized. From then on, the Authentication Agent will only request the Windows user account password to sign into the system automatically.

If the Use Single Sign-On (SSO) technology option is not enabled in the policy, you will need to enter the Authentication Agent password, and then your Windows user account password, when you start your computer.

2. If the password does not match the Windows account password, click Yes.

3. Wait until your password is saved.

4. Make sure the process has been completed successfully. Click OK.

5. Restart the computer.
6. Complete authentication in the agent.

Kaspersky Endpoint Security 10 for Windows will generate a temporary password for each user in accordance with the passwords policy for the Authentication Agent. The password is then relayed to the Administration Server.

To get a temporary password:

1. Request the password from the administrator to gain access to the encrypted hard drive.
2. Open Kaspersky Security Center 10. 
3. Go to Managed devices. 
4. Open the computer Properties and go to Tasks.
5. Select Encryption (account management) and open its Properties.
6. Go to Properties.
7. Open the required user account.

8. Enable the Show original password option. 

A temporary password for the Authentication Agent will be displayed in the field below. The administrator then informs the user of their temporary password.

9. Complete authentication in the Agent the next time the system restarts exits hibernation mode. Change the temporary password if necessary.

If the user did not log in to the operating system under their user account (for example, Kav4isa\user2) before the hard drive encryption, the an Authentication Agent password for their account will not be created. In this case, add the user account to the Encryption (account management) task and set a password for it.