Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Enforce Data Exchange (only) on USB Removable Media for all users of a PC

Hi there,

We're having some problems with a basic setup and wonder if more experienced users could point us in the right direction.

We have SafeGuard Management Center 7, but a mix of 6 and 7 clients, used previously to encrypt laptops so all working fine.

Our new objectives:

For most desktop Win 7 PCs we now wish to enforce encryption of USB removable media;

We want the policy to apply to any user of that PC, as almost any of our PCs can be used by any of our users;

We do not want POA, or volume encryption, only Data Exchange, and that to only apply to removable media, so file-based not volume-based;

We have enabled generation of Group Keys as we wish to use Group Keys so users in-house can seamlessly exchange USB devices and files;

SGPortable can be used for external recipients.

We have no problem getting the PreInstall, Client, and the Config onto the PCs.

The problem:

How to assign all our users to a PC or ideally to an OU?  It seems only possible to assign individual users to a PC.  If I create a group of users and assign that group, the users are individually enumerated in the assignment.

Then when attempting to save the configuration after adding the users, I get an error such as attached,

"You have already assigned a max of 0 user(s).  Please remove 110 object(s)"

We have 250 available DE licences, so even if the license is per user, this doesn't make sense.  (Although we thought the license was per device?). 

After going round in circles with this one for some days now, I'm getting confused between AD groups, Safeguard groups, group keys, OUs etc...

All we want to do is assign everybody to each configured PC in the simplest possible way (i.e. groups) all using the same group key.

If someone could point out where we are going wrong, this would be much appreciated.  Thanks in advance,

Dave T

:55823


This thread was automatically locked due to age.
Parents
  • Hi Dave,

    I am not sure I follow. If you only have Data Exchange installed then there will be no POA and the authentication is handled entirely by Windows.

    Whenever a new user logs onto a machine with Data Exchange a user account is automaticly created in the management center and assigned against that machine. If you want Data Exchange to work for all users of the machine you can always add the machine itself to the group you have the data exchange policy assigned to. That way any user who logs onto that machine will inherit the policy.

    Hopefully that helps a little - not sure what that error could be though.

    :55835
Reply
  • Hi Dave,

    I am not sure I follow. If you only have Data Exchange installed then there will be no POA and the authentication is handled entirely by Windows.

    Whenever a new user logs onto a machine with Data Exchange a user account is automaticly created in the management center and assigned against that machine. If you want Data Exchange to work for all users of the machine you can always add the machine itself to the group you have the data exchange policy assigned to. That way any user who logs onto that machine will inherit the policy.

    Hopefully that helps a little - not sure what that error could be though.

    :55835
Children
No Data