Incredibly slow boot speeds using Sophos Encyrption

Hi TriNet,

we've tested the DELL E6410 internally with SafeGuard Enterprise (last test was based on SafeGuard Enterprise 6.0) and it did not show any issues during the test cycle. Which version of SafeGuard Enterprise do you use?

Could you give me a bit more detail on the box and its configuration please (specific model number, BIOS version, is PXE/Network boot enabled, is the disk controller setup to use AHCI or IDE/Compatibility mode?)

Regards,

Chris

In my personal experience, the system remaining on a black screen for an extended amount of time during boot up is indicative of a bad driver; our Lenovo e520s (similar machine, i5 with 4gb ram) take more than 5 minutes to boot when an incorrect graphics driver is installed. But when the drivers are correct, it takes about a minute and twenty seconds to boot with Safeguard 6 installed. I would make sure that you have the correct chipset driver, the correct IME (Intel Management Engine) driver, and the correct graphics driver (should be intel hd 2000/3000) installed, and it should boot in a good amount of time.

Ok... so a few things.

For one, we are using version 5.6 which I personally see as a problem. But, I'll ask you guys because you're the experts. In your opinion is 5.6 more prone to slowness issues? We are trying to convince the powers that be to upgrade to version 6 because it seems to me that it will solve a lot of our issues.

The issue is that after encryption with Sophos Safeguard the laptop boot time is brought to a crippling hault and may take 15 or more minutes to get to a useable point. After Windows has loaded the computer seems to function as normal for the most part but certain applications are extremely slow.

Here is some more information on our client setup provided by SGNState:

Operating system       : Windows 7

Product version        : 5.60.1.7

POA type               : SGN

Power On Authentication: No

WOL                    : No

Server name            : Not available

Logon mode             : SGN UID

Client activation state: OFFLINE

Last data replication  : ─)

Last policy received   : 2012-06-08 13:08:34

Return code            : 1

Volume info            :

Name Type       Status                             Algorithm

------------------------------------------------------------

C:   HDPART     encrypted                          AES 256

Hi Indiefantv,

15 minute boot time is quite unexpected. On a plain E6410 with only SafeGuard Enterprise 5.6 / 6.0 encryption installed, I'd say that the boot time should be about two to max(!) five minutes - depending on the hardware used (i3/i5/i7, SSD vs HDD etc..).

Like mentioned before I'd check if the machine is equipped with the correct and up to date drivers. Also can you determine where the machine consumes the most of the 15 minutes boot up time (pre-POA, post-POA boot, Windows Boot up, actual Windows Login or on the Desktop when loadin the rest of the installed applications)?

SafeGuard version 6 compared to version 5.x has major performance improvements. Most of those can be noticed if the machine is equipped with hardware/CPUs that supports AES-NI. Here's a c&p from one of my other post regarding SGN 6 vs 5.60 speed and SSD recommendations:

"SafeGuard Device Encryption, as of version 6, uses hardware-accelerated AES on computers equipped with a CPU that supports Intel AES-NI (AES - New Instructions) to improve performance and user experience. This option is automatically checked and enabled by default - which might be the reason for the performance improvements you see compared to version 5.60.x.  

Please note that the full disk encryption of solid-state drives should always be accomplished using SafeGuard Enterprise' Fast Initial Encryption feature. 
Please see KBA 11334 "How to protect data on a solid-state drive (SSD) with SafeGuard Device Encryption" for more details  -- http://www.sophos.com/en-us/support/knowledgebase/113334.aspx"

Chris,

I have some done some testing and am trying to identify drivers and issues with the software that we have on our systems.

We are also trying to upgrade from 5.6 to 6. The question was asked, "If we upgrade do the systems need to be reimaged or is it just a matter of patching them to 6?"

So - I'll ask you that question. If we want to upgrade to 6 can we simply run a patch on the client? I know we need to have a server running 6 as well but my concern is about the client-side.

Hi Indiefantv,

there is no need to re-image your existing machines when upgrading from 5..x to 6.0. Upgrading the systems can be done in a quick way - no need of de-crypting and re-encrypting the drives.

Please note that the SafeGuard Enterprise Backend (Server / Database) need to be migrated to 6.0 before any Clients will be migrated.

Please see the SafeGuard Enterprise 6 manual for more information on migration.

Cheers,

Chris