User manual NOVELL ZENWORKS ENDPOINT SECURITY MANAGEMENT 4.0 03-31-2009

[. . . ] novdocx (en) 13 May 2009 AUTHORIZED DOCUMENTATION Endpoint Security Client 4. 0 User Guide Novell® 4. 0 March 31, 2009 ZENworks® Endpoint Security Management www. novell. com ZENworks Endpoint Security Client 4. 0 User Guide novdocx (en) 13 May 2009 Legal Notices Novell, Inc. , makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, Novell, Inc. , makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes. [. . . ] When the user enters a new network environment, the client compares the detected network environment to any stored and preset values in the security policy. If a match is found, the Endpoint Security Client 4. 0 activates the assigned location. When the detected environment cannot be identified as a stored or preset environment, the client activates the default Unknown location. The Unknown location has the following presets: Change Locations = Permitted Update Policy = Permitted Default Firewall settings = All Open By default, all adapter types (wired, Wi-Fi, and modem) are permitted in the Unknown location. This allows the computer to interface peripherally with its network environment, and attempt to associate a location policy as described above. Using the Endpoint Security Client 4. 0 15 novdocx (en) 13 May 2009 3. 2 Changing Locations At startup, the Endpoint Security Client 4. 0 switches to the Unknown location. It then attempts to detect the current network environment and to change the location automatically. If the network environment is either unrecognized, or has not been preset, the location must be changed manually. If you cannot perform the following steps, your ZENworks Endpoint Security administrator might have prevented you from changing locations manually. To change a location: 1 Right-click the Endpoint Security Client 4. 0 icon in the taskbar to display a menu of choices. 2 Click the appropriate location. 3. 3 Data Encryption When activated by policy, the Endpoint Security Client 4. 0 manages the encryption of files placed in a specific directory on the endpoint and placed in removable storage devices. The following instructions will assist you in using ZENworks Endpoint Security on the endpoint. Section 3. 3. 1, "Managing Files on Non-System Volumes, " on page 16 Section 3. 3. 2, "Managing Files on Removable Storage, " on page 16 3. 3. 1 Managing Files on Non-System Volumes Fixed disks are defined as all non-system volume drives installed on the computer, as well as any partitions of a hard-disk drive. Each fixed disk on the endpoint has a "Safe Harbor" folder (by default the folder is called Encrypted Files) and exists on each non-system volume or drive off the root directory. All files placed in this folder are encrypted, using the current encryption key. When saving a file, select the Safe Harbor folder from the available folders on the desired drive. 3. 3. 2 Managing Files on Removable Storage Removable storage is defined as any storage device that is "connected" to a computer. This includes (but is not limited to) USB thumb drives, flash memory cards, and PCMCIA memory cards, along with traditional Zip, floppy, and external CDR drives, digital cameras with storage capacity, and MP3 players. 16 ZENworks Endpoint Security Client 4. 0 User Guide novdocx (en) 13 May 2009 When you are running ZENworks Endpoint Security, files stored on these devices are encrypted as they are accessed by the operating system or the user. When the removable storage device is connected to a computer not managed by the ZENworks Endpoint Security system, the files remain encrypted and cannot be decrypted. Encryption of removable storage occurs at the insertion of the device (see "What If I Don't Want the Device Encrypted?" on page 18). However, files added to an encrypted removable storage device on another machine are not encrypted, and must be encrypted manually. The following sections contain more information: "Encrypting Files" on page 17 "What If I Don't Want the Device Encrypted?" on page 18 "Password Encrypting Files" on page 19 "Changing the Password to Files in the Shared Files Folder" on page 19 "Using the File Decryption Utility" on page 20 Encrypting Files To encrypt added files on a removable storage device: 1 Plug the storage device into the appropriate port on your computer. This encrypts all files on the removable storage device with the current encryption key. Using the Endpoint Security Client 4. 0 17 novdocx (en) 13 May 2009 The amount of time needed to encrypt the files depends upon the amount of data stored on the device. When you insert a removable storage device, the Endpoint Security Client prompts, asking if you want the drive encrypted, or if you prefer to remove it and not encrypt all files. Figure 3-1 Encryption Warning when a New Device is Inserted 18 ZENworks Endpoint Security Client 4. 0 User Guide novdocx (en) 13 May 2009 WARNING: To prevent encryption, remove the drive before clicking Continue. Click Continue to either encrypt the drive or to close the window after removing the device. [. . . ] 1 Right-click the Endpoint Security Client icon in the taskbar to display the menu, then click About, or double-click the Endpoint Security Client icon. 2 Click Check In. Using the Endpoint Security Client 4. 0 21 novdocx (en) 13 May 2009 If you do not have rights to perform a check in, the Check In button is greyed out. The Check In window displays the current state of the check in process. It shows the management and distribution servers if this is a managed client, the policy type, the last time a check in was attempted and the last time it succeeded, and the check in status. [. . . ]