About Full Encryption

Applies To: WatchGuard Full Encryption

WatchGuard Full Encryption (available in WatchGuard Advanced EPDR, WatchGuard EPDR, WatchGuard EDR, and WatchGuard EPP) encrypts and decrypts computer drives and removable storage devices (Windows only), without any impact to users. Full Encryption monitors the encryption status of network computers and also manages recovery keys for managed drives (Windows) or computers (Windows and Mac).

To help minimize the exposure of corporate data in the event of data loss or theft, Full Encryption takes advantage of hardware resources, such as a Trusted Platform Module (TPM) chip and Microsoft BitLocker technology, or FileVault for macOS, to encrypt and decrypt drives. It also supports authentication methods for different computer configurations.

You can use Full Encryption to:

Encrypt Devices
Decrypt Devices

When you apply Full Encryption settings to manage a computer, the computer might need user interaction to continue. For more information, go to Full Encryption and Computer User Interactions — Windows Computers.

Encrypt Devices

Encryption of Unencrypted Drives

Encryption begins when the WatchGuard Endpoint Agent, installed on a computer, downloads encryption settings. A wizard on the endpoint guides the user through the encryption process and encrypts all hard disks found on the computer. Any previously encrypted drive receives the encryption settings specified by Full Encryption.

The number of encryption steps to take depends on the type of authentication chosen by the network administrator and the previous status of the computer.

If you create a new drive entry after the encryption process is complete, Full Encryption encrypts the drive immediately and according to the encryption settings.

You cannot use Full Encryption to encrypt computers from a remote desktop session. You must restart the computer and enter a password before you can install Full Encryption.

When Previous Encryption Exists

To manage a computer with Full Encryption, the computer must successfully receive settings from WatchGuard Endpoint Security at least once. The settings establish the encryption of drives.

If a computer already has encrypted drives, but Full Encryption does not send the computer settings to encrypt the drives, Full Encryption does not manage the computer. This means that the computer administrator cannot access recovery keys or monitor the status of the computer. However, if Full Encryption does send settings to encrypt drives, regardless of any previous drive status (encrypted or not), Full Encryption manages the computer.

When you attempt to encrypt a previously encrypted drive, consider these points:

After Full Encryption successfully encrypts a computer, Full Encryption is able to manage it.
If a computer user selects an authentication method that differs from the method specified in Full Encryption, a prompt shows on the user's computer that asks for passwords or other hardware resources.
If it is not possible to use an authentication method compatible with the operating system, and specified by the network administrator, the existing encryption method remains in place. Full Encryption does not manage the computer.
If the encryption algorithm is not AES-256, Full Encryption makes no encryption changes to the computer drive. Full Encryption manages the computer.
If both encrypted and unencrypted drives exist, Full Encryption uses the same authentication method to encrypt all drives.
To unify authentication methods, if a previous authentication method requires a password, and the method is compatible with the authentication methods supported by Full Encryption, a prompt shows on the user computer that requests the password.
If computer user encryption settings differ from those reflected in the Full Encryption dashboard, to minimize the encryption process, Full Encryption does not make any encryption changes.
When you manage a drive with Full Encryption, at the end of the process, Full Encryption generates a recovery key and sends it to the WatchGuard server.

For information about how to encrypt drives from the Full Encryption management UI, go to Encryption Settings.

Full Encryption and Computer User Interactions — Windows Computers

When Full Encryption applies encryption settings, a user might have to interact with managed computers to address these issues.

If a computer does not have BitLocker installed, Full Encryption downloads and installs the tool. The computer user must restart the computer to complete the installation.
If a computer has no previous encryption, Full Encryption creates a system partition. The computer user must restart the computer to complete the creation of the partition.
If a group policy exists that conflicts with the settings in Full Encryption, an error message shows and the process stops. Encryption does not start until the error is corrected by the computer user.
If a computer has a TPM chip installed, the computer user might have to enable the TPM chip from the BIOS for the computer. The computer must restart for the user to access the BIOS.
If a computer uses a USB device for authentication, the computer user must insert the USB device when the computer boots.
If a computer uses a PIN or password for authentication, the computer user must type the PIN or password.
If a computer fails the boot process hardware test, the computer does not start encryption until the error is corrected by the computer user.

System Partitions — Windows Computers

If a system partition does not exist, Full Encryption automatically creates a system partition on a hard drive. A system partition is a small, unencrypted area of the drive (approximately 1.5 GB). The computer uses this required area to complete the boot process.

When Full Encryption encrypts a USB drive, it does not create a system partition. (Windows computers only)

Full Encryption and Computer User Interactions — Mac Devices

Mac users receive a prompt to enter administrator credentials:

When Full Encryption applies an encryption policy to a non-encrypted Mac device, the Mac user receives a prompt to enter administrator credentials to start encryption. If the user does not enter the credentials, they receive a prompt every hour to enter the credentials.
When a Mac device was previously encrypted by another product, Full Encryption re-establishes the recovery key and prompts the user for administrator credentials.
If the user enables or disables FileVault manually on their computer, Full Encryption prompts the user again for administrator credentials to restore the settings configured in the management UI. If required, Full Encryption generates the recovery key again.
If the user modifies or deletes the recovery key, Full Encryption prompts the user again for administrator credentials and generates a new recovery key that replaces the original key on the WatchGuard Cloud servers.

Decrypt Devices

For information about how to decrypt drives from the Full Encryption management UI, go to Decrypt Devices.