Install Guide

Rules" in AdminHelp. When Encryption is processing a policy update that includes an active SDE policy, the current user
profile directory is encrypted by default with the SDUser key (a User key) rather than the SDE key (a Device key). The
SDUser key is also used to encrypt files or folders that are copied (not moved) into a user directory that is not a encrypted
with SDE.
To disable the SDUser key and use the SDE key to encrypt these user directories, create the registry on the computer:
[HKEY_LOCAL_MACHINE\SOFTWARE\Credant\CMGShield]
"EnableSDUserKeyUsage"=DWORD:00000000
If this registry key is not present or is set to anything other than 0, the SDUser key will be used to encrypt these user
directories.
For more information about SDUser, see KB article 131035
● Setting the registry entry, EnableNGMetadata, if issues occur related with Microsoft updates on computers with Common
key-encrypted data or with encrypting, decrypting, or unzipping large numbers of files within a folder.
Set the EnableNGMetadata registry entry in the following location:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CmgShieldFFE]
"EnableNGMetadata" = DWORD:1
0=Disabled (default)
1=Enabled
●
The non-domain activation feature can be enabled by contacting Dell ProSupport and requesting instructions.
● The Encryption Management Agent no longer outputs policies by default. To output future consumed policies, create the
following registry key:
HKLM\Software\Dell\Dell Data Protection\
" DumpPolicies" = DWORD
Value=1
Note: Logs are written to C:\ProgramData\Dell\Dell Data Protection\Policy .
● To disable or enable the Encrypt for Sharing option in the right-click menu use the following registry key.
HKEY_LOCAL_MACHINE\SOFTWARE\Dell\Dell Data Protection\Encryption
"DisplaySharing"=DWORD
0 = disable the Encrypt for Sharing option in the right-click context menu
1 = enable the Encrypt for Sharing option in the right-click context menu
Full Disk Encryption
● This section details all Dell ProSupport approved registry settings for local computers, regardless of the reason for the
registry setting. If a registry setting overlaps two products, it is listed in each category.
● These registry changes should be done by administrators only and may not be appropriate or function in all scenarios.
● To set the retry interval when the Dell Server is unavailable to communicate with Full Disk Encryption, add the following
registry value.
[HKLM\System\CurrentControlSet\Services\DellMgmtAgent\Parameters]
"CommErrorSleepSecs"=DWORD:300
This value is the number of seconds Full Disk Encryption waits to attempt to contact the Dell Server if it is unavailable to
communicate with Full Disk Encryption. The default is 300 seconds (5 minutes).
● If a self-signed certificate is used on the Dell Server for Full Disk Encryption, SSL/TLS trust validation must remain disabled
on the client computer (SSL/TLS trust validation is disabled by default with Full Disk Encryption). Before enabling SSL/TLS
trust validation on the client computer, the following requirements must be met.
○ A certificate signed by a root authority, such as EnTrust or Verisign, must be imported into Dell Server.
○ The full chain of trust of the certificate must be stored in the Microsoft keystore on the client computer.
○ To enable SSL/TLS trust validation for Dell Encryption management, change the value of the following registry entry to 0
on the client computer.
Registry Settings
29