Configuring a BitLocker Encryption Policy
R81 Harmony Endpoint Server Administration Guide|209
Configuring a BitLocker Encryption Policy
To manage BitLocker encryption on Endpoint Security clients on Windows, configure the Full
Disk Encryption Policy. You can use the default Full Disk Encryption rule Default Full Disk
Encryption settings for the entire organization, change the action of the rule to Use
BitLocker Management, and install the policy.
Alternatively, you can create a new rule and configure actions for a specific organizational unit.
Best Practices -
1. When you change the encryption policy for clients from Check Point Full Disk
Encryption to BitLocker Management, the disk on the client is decrypted and
then encrypted. This causes the disk to be in an unencrypted state for some
time during the process. We recommend that you do not change the encryption
policy for entire organization in one operation. Make the change for one group
of users at a time.
2. Define the BitLocker policy before installing the Endpoint Security package on
the client computers. This ensures that encryption will happen just one time,
with BitLocker. It avoids Check Point FDE encryption followed by FDE
decryption and BitLocker encryption.
Configuring the BitLocker encryption policy for a specific organizational unit
1. Open SmartEndpoint and go to the Policy tab.
2. In the toolbar of the Policy tab, click Create a Rule .
The Create Rule Wizard opens.
3. Click Full Disk Encryption.
4. Click Next.
5. In the Select Entities page, select the computers for which you want to configure
BitLocker encryption.
6. Click Next.
7. In the Change rule action settings page, click Encryption Engine, and select Use
BitLocker Management.
A warning message shows. Read it carefully.
To Next Page