Dell Encryption Personal Installation Guide v11.9

• IPv6 is not supported.
• Be prepared to shut down and restart the computer after you apply policies and are ready to begin enforcing them.
• Computers equipped with self-encrypting drives cannot be used with HCA cards. Incompatibilities exist that prevent the provisioning of the HCA. Dell does not sell computers with self-encrypting drives that support the HCA module. This unsupported configuration would be an after-market configuration.
• If the computer targeted for encryption is equipped with a self-encrypting drive, ensure that the Active Directory option, User Must Change Password at Next Logon, is disabled. Preboot Authentication does not support this Active Directory option.
• SED Manager is not supported with multi-drive configurations.
• NOTE:

  Due to the nature of RAID and SEDs, SED Manager does not support RAID. The issue with RAID=On with SEDs is that RAID requires access to the disk to read and write RAID-related data at a high sector not available on a locked SED from start and cannot wait to read this data until after the user is logged on. Change the SATA operation in the BIOS from RAID=On to AHCI to resolve the issue. If the operating system does not have the AHCI controller drivers pre-installed, the operating system will crash when switched from RAID=On to AHCI.

• The master installer installs the following prerequisites if not already installed on the computer. When using the child installer, you must install this component before installing SED Manager.

  Prerequisite
  Visual C++ 2017 Update 3 or later Redistributable Package (x86 or x64) Applications and installation packages signed with SHA1 certificates will function but an error will display on the endpoint during installation or execution of the application without these updates installed

• Configuration of self-encrypting drives for SED Manager differ between NVMe and non-NVMe (SATA) drives, as follows.

  • Any NVMe drive that is being leveraged for PBA:
    • If the Dell device was manufactured in 2018 or later: Either RAID ON or AHCI may be leveraged with NVMe drives.
    • The BIOS boot mode must be set to Unified Extensible Firmware Interface (UEFI). Legacy operation ROMs must be disabled.
  • Any non-NVMe drive that is being leveraged for PBA:

    • BIOS SATA operation can be set to either AHCI or RAID ON.

    • The operating system will crash when switched from RAID ON > AHCI if the AHCI controller drivers are not pre-installed. For instructions on how to switch from RAID > AHCI (or vice versa), see KB article 124714.

  Supported OPAL compliant SEDs require updated Intel Rapid Storage Technology Drivers, located at www.dell.com/support. Dell recommends the latest Intel Rapid Storage Technology Driver with NVMe drives.

  NOTE:The Intel Rapid Storage Technology Drivers are platform dependent. You can find your system's driver at the link above based on your computer model.
• Multi-disk encryption configurations with SED Manager require the following:
  • All disks in the target system must be SEDs.
  • All disks in the target system must be configured in the same boot mode.
  • In UEFI boot mode, the operating system can be installed on any target disk.

  • In Legacy boot mode, the operating system must be installed on the first disk (Disk #0). If the operating system is not installed on the first disk, Multi-disk encryption is disabled.

• Some BIOS versions may enable Block SID by default, which can inhibit SED Manager. For more information, see KB article 126083.
• Direct Feature Updates from Windows 10 v1607 (Anniversary Update/Redstone 1), to the Windows 10 v1903 (May 2019 Update/19H1) are not supported with Dell Encryption. Dell recommends updating the operating system to a newer Feature Update if updating to Windows 10 v1903. Any attempts to update directly from Windows 10 v1607 to v1903 results in an error message and the update is prevented.
• NOTE:A password is required with Pre-boot Authentication. Dell recommends setting a minimum password of 9 or more characters.
• NOTE: A password is required for all users added in the Add User panel. Zero-length password users will be locked out of the computer following activation.
• NOTE:Computers protected by SED Manager must be updated to Windows 10 v1703 (Creators Update/Redstone 2) or later before updating to Windows 10 v1903 (May 2019 Update/19H1) or later. If this upgrade path is attempted, an error message displays.
• SED Manager requires the use of the Dell custom Credential Provider to synchronize Windows password changes and data encryption keys. If you require use of third-party applications that use custom Credential Providers running on computers protected SED Manager, you must initiate Windows password changes through the Data Security Console. For information about changing your password in the Data Security Console, see the Password chapter in the Data Security Console User Guide.

Hardware

• For the most up-to-date list of Opal compliant SEDs supported with the SED Manager, see KB article 126855.

• For the most up-to-date list of platforms supported with the SED Manager, see KB article 126855.

• For a list of docking stations and adapters supported with SED Manager, see KB article 124241.

International Keyboards

The following table lists international keyboards supported with Pre-boot Authentication on UEFI and non-UEFI computers.

Operating Systems

• The following table details the supported operating systems.

  Windows Operating Systems (32- and 64-bit)

  Windows 10: Education, Enterprise, Pro v1909-v22H2 (November 2019 Update/19H2 - November 2022 Update/22H2) Note: OEMs and ODMs do not ship Windows 10 v2004 (May 2020 Update/20H1 and later) with 32-bit architecture. For more information, see https://docs.microsoft.com/windows-hardware/design/minimum/minimum-hardware-requirements-overview. Windows 10 2019 LTSC Windows 10 2021 LTSC Windows 11: Enterprise, Pro v21H2 - 22H2

  Authentication features are available only when Pre-boot Authentication is enabled.

Localization