Dell Encryption Enterprise Requires System32 .EXE’s to be Excluded

1. Log in to the Dell Data Protection Remote Management Console (RMC).
2. In the left-menu pane, click Populations.

Figure 1: (English Only) Populations

3. Click Enterprise, Endpoint Groups, or Endpoints. This option depends on where SDE policies are modified in your organization.

Figure 2: (English Only) Choose Enterprise, Endpoint Group, or Endpoints

4. Click File/Folder Encryption (FFE).

Figure 3: (English Only) File/Folder Encryption (FFE)

5. Confirm SDE Encrypted Enabled is checked.

Figure 4: (English Only) Verify SDE Encrypted Enabled

6. Under SDE Encryption Rules, look for %ENV:SYSTEMROOT%\SYSTEM32\;exe or C:\Windows\System32\;exe without a - symbol.

Example of a policy with the issue:

C:\Windows\System32\;exe
@C:\Windows\System32\;exe
%ENV:SYSTEMROOT%\System32\;exe
@%ENV:SYSTEMROOT%\System32\;exe

If you are unable to find syntax similar to the above examples, this issue does not affect you. If you find syntax similar to the above example, go to: How do I fix the issue?

1. Log in to the Dell Data Protection Remote Management Console (RMC).
2. In the left-menu pane, select Enterprise, Endpoint Groups, or Endpoints. This option depends on where SDE policies are modified in your organization.

Figure 5: (English Only) Choose Enterprise, Endpoint Groups, Endpoints

Example of a policy with the issue:

If you are unable to find syntax similar to the above examples, then you this issue does not affect you. If you find syntax similar to the above example, go to: How do I fix the issue?

3. Select the Security Policies tab.

Figure 6: (English Only) Security Policies

4. If the template menu appears, click Override and then go to step 5.

Figure 7: (English Only) Override

5. From the Policy Category drop-down, select Windows Encryption.

Figure 8: (English Only) Select Windows Encryption

6. Expand Fixed Storage.

Figure 9: (English Only) Fixed Storage

7. Confirm SDE Encryption Enabled is set to true. If SDE Encryption Enabled is False, then this issue does not affect you.
8. Under SDE Encryption Rules, look for %ENV:SYSTEMROOT%\SYSTEM32\;exe or C:\Windows\System32\;exe without a - symbol.

C:\Windows\System32\;exe
@C:\Windows\System32\;exe
%ENV:SYSTEMROOT%\System32\;exe
@%ENV:SYSTEMROOT%\System32\;exe

1. Log back into the RMC and go to the SDE Encryption Rules section (covered in How do I know if I am affected?).
2. Add a "-" (minus) symbol to the syntax in question.
   Example of change:

Figure 10: (English Only) Before

Figure 11: (English Only) After

3. In the upper right menu, click Save.

Figure 12: (English Only) Save

4. In the left-menu pane, click Management.

Figure 13: (English Only) Management

5. Click Commit.

Figure 14: (English Only) Commit

6. Under the Commit menu, optionally enter comments about the policy change, and then press Commit Policy.
7. Endpoints using Dell Encryption Enterprise will pick up the new policy change on the next policy poll and begin decrypting .exe’s within the System32 folder.

This may result in a blue screen if .exe extensions are encrypted with System Data Encryption (SDE), Common, or User.

1. Log back into the RMC and go to the SDE Encryption Rules section (covered in How do I know if I am affected?).
2. Add a - (minus) symbol to the syntax in question.

Example of change:

Figure 15: (English Only) Before

Figure 16: (English Only) After

3. In the bottom-right corner, click Save.

Figure 17: (English Only) Save

4. In the left menu pane, click Commit Policies (under Actions).

Figure 18: (English Only) Commit Policies

5. Optionally enter a comment about the policy change and then click Apply Changes.
6. Endpoints using Dell Data Protection | Enterprise Edition will pick up the new policy change on the next policy poll and begin decrypting .exe’s within the System32 folder.