How to Decrypt External Media Managed by Dell Data Security

Dell Technologies recommends decrypting protected external media devices managed by Dell Data Security (formerly Dell Data Protection) before uninstalling the software.

Affected Products:

• Dell Encryption Enterprise
• Dell Encryption Enterprise for Mac
• Dell Encryption Personal
• Dell Encryption External Media
• Dell Data Protection Enterprise Edition
• Dell Data Protection Enterprise Edition for Mac
• Dell Data Protection Personal Edition
• Dell Data Protection External Media Edition

Affected Versions:

• v8.0 and Later

Affected Operating Systems:

• Windows
• Mac

The process to decrypt external media differs depending on how the encryption is managed. Click Centrally-Managed or Locally-Managed for the appropriate steps.

Centrally-Managed

The process to decrypt centrally-managed external media differs depending on what version of the Dell Data Security (formerly Dell Data Protection) server manages the encryption. Select either v9.2.0 and Later or v8.0.0 to 9.1.0 for steps to decrypt protected external media devices. For more information, reference How to Identify the Dell Encryption Enterprise or Dell Encryption Personal Version.

v9.2.0 and Later

1. From a web browser, go to the Dell Data Security administration console at https://<SERVERNAME>.<COMPANY>.com:8443/webui.
   Note:

   • <SERVERNAME> = The Dell Data Security server DNS name in your environment
   • <COMPANY> = The company domain name in your environment
   • The port, 8443, may differ from the administration console port in your environment.
2. Sign in to the Dell Data Security administration console.
   
3. If decrypting a protected external media device from a:
   • Windows endpoint Go to Step 4.
   • Mac endpoint: Go to Step 8.
4. From the left menu pane, expand the Populations tab and then click Users.
   
5. Click the User Name of the user who must decrypt a device.
6. Click Windows Media Encryption.
   
7. Switch Windows Media Encryption to Off and then click Save. Go to Step 13.
   
   Note: If the protected external media device has been allowlisted, it must also be removed from the EMS Device Whitelist policy.
8. From the left menu pane, expand the Populations tab and then click Endpoints.
   
9. Click the endpoint to decrypt.
10. Click Security Policies.
    
11. Click Mac Media Encryption.
    
12. Switch Mac Media Encryption to Off and then click Save.
    
    Note: If the protected external media device has been allowlisted, it must also be removed from the EMS Device Whitelist policy.
13. Commit the policy change.
    Note: For more information about committing policies, reference How to Commit Policies for Dell Data Security Servers.
14. From the endpoint, check for policy updates.
    Note: For more information about checking for policy updates, reference How to Check for Policy Updates for Dell Data Security.
15. After the policy update is received, insert the protected external media device and allow the decryption sweep to complete.
    Note: WSScan may be used to confirm that decryption is complete. For more information, reference How to Use WSScan for Dell Data Security.

v8.0.0 to 9.1.0

1. In Windows Explorer, go to C:\Program Files\Dell\Enterprise Edition\Console\ and then double-click Credant.Console.exe.
   
2. Submit credentials to sign in to the administration console.
   
3. If decrypting a protected external media device from a:
   • Windows endpoint: Go to Step 4.
   • Mac endpoint: Go to Step 8.
4. From the left menu pane, click Users.
   
5. Locate the user who must decrypt a device, and then click the Policies icon.
   
6. Click Removable Storage.
   
7. Switch EMS Encrypt External Media to false and then click Save. Go to Step 12.
   
   Note: If the protected external media device has been allowlisted, it must also be removed from the EMS Device Whitelist policy.
8. From the left menu pane, click Endpoints.
   
9. Locate the endpoint to decrypt and then click the Details icon.
   
10. Click Security Policies.
    
11. From the security policies:
    1. Set the Policy Category to Mac Encryption.
    2. Click to expand Removable Storage.
    3. Use the Local Value column to set the EMS Encrypt External Media policy to false.
    4. Click Save.
    
    Note: If the protected external media device has been allowlisted, it must also be removed from the EMS Device Whitelist policy.
12. Commit the policy change.
    Note: For more information about committing policies, reference How to Commit Policies for Dell Data Security Servers.
13. From the endpoint, check for policy updates.
    Note: For more information about checking for policy updates, reference How to Check for Policy Updates for Dell Data Security.
14. After the policy update is received, insert the protected external media device and allow the decryption sweep to complete.
    Note: WSScan may be used to confirm that decryption is complete. For more information, reference How to Use WSScan for Dell Data Security.

Locally-Managed

The process to decrypt locally-managed external media differs depending on what version of Dell Encryption Enterprise or Dell Encryption Personal manages the encryption. Select either v8.15.0 and Later or v8.0.0 to 8.13.0 for steps to decrypt protected external media devices. For more information, reference How to Identify the Dell Encryption Enterprise or Dell Encryption Personal Version.

v8.15.0 and Later

1. Log in to the Windows computer.
2. In the Windows System Tray, right-click the Dell Encryption icon and then select Open Dell Encryption.
   
3. Click Advanced in the bottom right.
   
4. Click Customize Settings.
   
5. Populate the Encryption Administrator Password and then click OK.
   
6. From the Customize user interface (UI):
   1. Click to expand Removable Storage.
   2. Use the Customization column to set the EMS Encrypt External Media policy to False.
   3. Click Save.
   4. Click Back to configure.
   
   Note: If the protected external media device has been allowlisted, it must also be removed from the EMS Device Whitelist policy.
7. In the bottom-right, click Home.
   
8. Perform a backup of the encryption keys.
   
   Note: For more information, reference How to Manually Back Up Encryption Keys in Dell Encryption Personal.
9. Insert the protected external media device and allow the decryption sweep to complete.
   Note: WSScan may be used to confirm that decryption is complete. For more information, reference How to Use WSScan for Dell Data Security.

v8.0.0 to 8.13.0

1. Log in to the Windows computer.
2. In the Windows System Tray, right-click the Dell Data Protection | Encryption icon and then select Open Dell Data Protection | Encryption.
   
3. Click advanced in the bottom right.
   
4. Click Customize Settings.
   
5. Populate the Encryption Administrator Password and then click OK.
   
6. From the Customize user interface (UI):
   1. Click to expand Removable Storage.
   2. Use the Customization column to set the EMS Encrypt External Media policy to False.
   3. Click save.
   4. Click back to configure.
   
   Note: If the protected external media device has been allowlisted, it must also be removed from the EMS Device Whitelist policy.
7. In the bottom-right, click home.
8. Perform a backup of the encryption keys.
   
   Note: For more information, reference How to Manually Back Up Encryption Keys in Dell Encryption Personal.
9. Insert the protected external media device and allow the decryption sweep to complete.
   Note: WSScan may be used to confirm that decryption is complete. For more information, reference How to Use WSScan for Dell Data Security.

To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.