GravityZone Full Disk Encryption FAQ

GravityZone Full Disk Encryption is available for the most Windows endpoints and Macs that can run BitLocker, FileVault and diskutil. In the Windows space, this feature is not accessible for users with "Home" editions of the OS.

For more information, refer to Full Disk Encryption.

GravityZone Full Disk Encryption works with both systems with or without TPM. For most systems TPM is optional, except for Windows 7 and Windows Server 2008 R2, where TPM is required. TPM must be version 1.2 or higher.

GravityZone encrypts boot and non-boot volumes, on fixed disks, on desktop computers and laptops. Removable drives are not encrypted.

GravityZone uses:

GravityZone leverages the native applications for encryption available on the Windows and macOS platforms.

When applying a GravityZone policy with the Full Disk Encryption module enabled:

Endpoint users can operate BitLocker, FileVault and diskutil on their own as long as the Full Disk Encryption module in the security agent is disabled.

Encryption on Windows

To encrypt volumes on Windows endpoints, you need to apply a policy with the Full Disk Encryption module enabled and the Encrypt option selected. On the endpoint, the encryption flow depends whether the machine has a functioning Trusted Platform Module (TPM) or not.

Endpoints with TPM

When the policy is applied:

1. The security agent prompts the users to configure a PIN. For details, refer to Encryption.

   

   If the TPM does not work or GravityZone does not detect it, the user will be prompted to configure an encryption password. For details, see the section below referring to the encryption process on endpoints without TPM.

2. After clicking the Save button, the security agent sends a recovery key associated with the encryption PIN to the GravityZone console.

   Once the GravityZone console returns a confirmation response to the security agent, the encryption process starts on the boot disk (C:) and continues with the other disks.

   If clicking the Dismiss option, the encryption window disappears and reappears after a while, as long the policy is active on the endpoint.

On endpoints with TPM, the encryption process starts without requiring a PIN from users when the GravityZone policy has the option If Trusted Platform Module (TPM) is active, do not ask for pre-boot password enabled. For details, refer to Encryption.

When starting an encrypted machine, the users first have to enter the PIN in the pre-boot environment to unlock the boot volume, then the system credentials. The non-boot volumes are automatically unlocked.

Users do not need to enter any PIN in the pre-boot environment when the option If Trusted Platform Module (TPM) is active, do not ask for pre-boot password is enabled in the GravityZone policy. For details, refer to Encryption.

Note

You can control the PIN complexity requirements and the users’ privileges to change their PIN by enabling the following BitLocker Group Policy (GPO) settings:

• Configure minimum PIN length for startup

• Configure use of passwords for operating system drives, with Require password complexity

• Configure use of passwords on fixed data drives, with Require password complexity

• Disallow standard users from changing the PIN or password.

Endpoints without TPM

When the policy is applied:

1. The security agent prompts the users to configure a password. For details, refer to Encryption.

   

2. After clicking the Save button, the security agent sends a recovery key associated with the encryption password to the GravityZone console.

   Once the GravityZone console returns a confirmation response to the security agent, the encryption process starts on the boot disk (C:) and continues with the other disks.

   If clicking the Dismiss option, the encryption window disappears and reappears after a while, as long the policy is active on the endpoint.

When starting an encrypted Windows machine, the users first have to enter the encryption password in the pre-boot environment to unlock the boot volume, then the system credentials. Non-boot volumes are automatically unlocked.

In case the users have forgotten their encryption passwords, they can ask their security administrator for the recovery key to unlock the boot volume.

Encryption on macOS

To encrypt volumes on macOS endpoints, you need to apply a policy with the Full Disk Encryption module enabled and the Encrypt option selected. When the policy is applied:

When starting encrypted macOS machines, users have to enter their system credentials. Only users having local accounts with administrative privileges can enable encryption. If those Macs have non-boot volumes, the users also have to enter the passwords they have configured to encrypt those volumes.

If users have forgotten their passwords, they can ask their security administrator for the recovery key.

• For the boot volume:

  1. The security agent prompts the users to enter their system credentials to start encryption with FileVault.

     

  2. After clicking the OK button, the security agent sends a recovery key to the GravityZone console and the encryption process starts.

     If clicking the Not now option, the encryption window will disappear and reappear after a while, as long as the policy is active on the endpoint.

     Note

     In case of dual-boot systems, the other boot volume will not be encrypted.

• For any non-boot volume:

  1. The security agent prompts the users to configure a password to start encryption with diskutil.

     

  2. After clicking the Save button, the security agent sends a recovery key to the GravityZone console and the encryption process starts.

     If clicking the Dismiss option, the encryption window will disappear and reappear after a while, as long as the policy is active on the endpoint.

     Users have to configure a separate password for each non-boot volume connected to the Mac.

Decryption on macOS

To decrypt volumes on Mac, you need to apply the Full Disk Encryption module enabled and the Decrypt option selected. When the policy is applied:

• For the boot volume, the users have to enter their system credentials.

  

• For the non-boot volumes, the users have to enter the disk password they have configured to encrypt those volumes.

  

Users can change, at any time, the recovery key for the boot volumes encrypted with FileVault in the security agent interface, by providing the system credentials.

Users can also change the encryption password for the non-boot volumes encrypted with diskutil, by providing the existing encryption password.

Changing the system password on the endpoint does not affect the recovery key stored in GravityZone.

If trying to encrypt or decrypt independently with FileVault or diskutil while a policy with adverse action is enabled, GravityZone will not interfere with the ongoing process. Once the encryption or decryption completes, GravityZone will check the volume status and it will take an action (encrypt or decrypt) in accordance with the policy.

When a security policy with Encrypt is applying on the endpoint, the user must configure a password that starts the encryption process.

As GravityZone manages encryption through BitLocker, FileVault and diskutil, the workflow and the limitations of password configuration are related to these tools.

GravityZone Full Disk Encryption supports pre-boot authentication. When configuring the encryption password, make sure you met the conditions at the previous step to avoid password entry failure in the pre-boot environment, if you use a non EN-US keyboard layout.

No, GravityZone Full Disk Encryption is not compliant with the Federal Information Processing Standard (FIPS).

If a volume has already been encrypted with BitLocker, FileVault or diskutil, when enabling encryption on the endpoint through GravityZone, the security agent will generate a new recovery key for that volume and will send it to Control Center.

In other cases, the volumes must be decrypted before applying a GravityZone encryption policy.

No, but Bitdefender has plans to support it in the future.

They first must decrypt data using their current solution, then they can safely use GravityZone Full Disk Encryption.

The average time for encryption depends on multiple factors: disk type and size, the CPU speed, the number of processes and applications running at that time. However, this does not impact the end user because the encryption occurs in the background, while he can work as usual on his computer.

Full Disk Encryption requires BitLocker to be installed on the computer and, in most cases, it is. Only Windows Server systems don’t have BitLocker by default, so the administrator must add it.

On Windows, the users need first to enter the encryption password in the pre-boot environment, then their user account password to log in to OS.

Encryption occurs in the background and the user can continue his work as usual. There are chances that he would not even notice that the process is going on because GravityZone only manages native BitLocker, FileVault and diskutil, without supplementary burden on the system. However, if you encrypt very large drives it is better to set this process when you are not using them.

The access on a computer is not limited by the number of users. On multi-user computers, the user that is logged in when the encryption policy is applied is the one who sets the encryption password.

Yes. Full Disk Encryption is available as an add-on for all GravityZone cloud and on-premises editions and out-of-the-box for MSP. Find out here the availability of Full Disk Encryption across the GravityZone editions.

To get a free trial, create an account here. If you already have a GravityZone Cloud account, use another email address to set up a trial account.

The encryption password can only be changed by the user from the Bitdefender security agent GUI.

Yes, you can disable the encryption management from Control Center to allow local control of BitLocker (on Windows) and FileVault and diskutil (on Mac). Also, you can decrypt data by applying a GravityZone policy.

Yes, that is the standard behavior on Windows machines: the encryption password, then the user's account password. On macOS, you have to enter your user's account password.

Yes, but only on Windows systems with a Trusted Platform Module (TPM) chip. In GravityZone Control Center, go to the Policies > Encryption and select the check box If Trusted Platform Module (TPM) is active, do not ask for pre-boot password.

This way, the endpoints will be encrypted without a password and the users will not need to enter it every time the computers start, before their account password.

This option is supported only on machines with TPM and Unified Extensible Firmware Interface (UEFI).

A user will still have to provide a password, whether the check box is selected or not, when:

For other details, refer to Encryption.