Kstainton

Hi @tkrombach, Good idea, I would be interested to see what error you get when attempting to boot it, however, I am curious, did you disable Secure Boot when attempting to boot via the EFI USB, the WIN RE USB does not require this but the EFI USB will require Secure Boot to be disabled in order to boot from it? As it sounds like its skipping the USB and attempting to boot normally and an error. Thank you.

HI @YanaComsecure, We use VMWare Workstation for Development/Testing successfully, VMWare allows you to connect a Physical USB, going by some research you cannot do this with Hyper-V which may be the cause of the issue here. As I cannot see that it allows USB to be bootable. Are you able to test on a physical computer and report back? Thank you, Kieran

Hi @YanaComsecure, May I ask what the use case is here? Why are you encrypting a Hyper-V Workstation, what is the attack vector here? Are you simply testing attempting to decrypt the Hyper-V Workstation or are you in a situation that requires recovery? Just trying to understand, I am currently talking to the team about this, but would like to know what exactly is the requirement here Thank you, Kieran

Hi, Whilst using the ESET Recovery Utility in ISO Mode you will need to insert a FAT32 USB in order for it to be functional and create logs of the events that occurred in case anything goes wrong Its a requirement, because if anything failed without logs it would be difficult to determine what the issue is and this prevents that. Thank you, Kieran

Hi @SaintKev, No worries at all Let me know if you need anything else. Thank you, Kieran

Hi @SaintKev, How many machines are you looking to alter? The number of 'Password Attempts' cannot be changed once the FDE User has been added to a Workstation. Only when new users are added can they have the 'Password Attempts' re-configured. If you change the Workstation Policy (https://support.eset.com/en/kb7409-modify-workstation-policy-on-the-eset-endpoint-encryption-server) and apply to all machines, the default will be altered for any future additions of FDE Users or future Workstations you FDE. But the only real way to change it for your current users, would be to delete their FDE Login, Proxy Sync on the EEE Client and Re-add their FDE Login, all within a single session that they are logged in else they will not have a FDE User to login as (Unless they know the Admin FDE User Credentials). However, this falls back on my earlier question, as it really depends on how many machines you have as to if this is worth it. Thank you, Kieran

Hi @SaintKev Hmm can you message me directly with a screenshot and your other details. Going by the fact the fault does in fact occur after the EEE Pre-boot and its at the stage whereby it has reached the Windows Logon albeit with issues, I believe Authpoint are the only ones that will be able to advise you on this as it seems to be an issue at the MFA/Windows Logon point. Have you tried contacting them via their Online Support: https://watchguard.force.com/customers/WGMyCases ? It never hurts to be on the latest EEE Client, as you will be ensuring that you do not encounter other unrelated issues. I have to admit I doubt it will resolve your issue as it seems to not be related to any stage in which EEE has involvement. But trying certainly does not hurt if you are able to test on another machine that has had Windows reinstalled and possibly attempt to replicate the issue in the same way. Thank you.

I see! Thank you for the update. I will leave you in the hands of my colleague handling your ticket.

Hi @SaintKev, Sounds like a very strange and niche issue I have not seen reported before. If you are happy doing so I would report this via ESET Support here: https://www.eset.com/uk/about/contact/ and we will take a look and see if there is anything we are able to do to assist in resolving this. However in all honesty, it sounds like an issue you may need to bring up with Watchguard Authpoint support You are able to boot into Windows via Safe Mode and the only solution you have found it via a full reinstall, is that a full reinstall of Windows? What happens if you simply uninstall Authpoint instead (As it seems by what you are saying you have only started experiencing these issues since installation of this 3rd party product)? Have their been any other changes to the machines, Windows Updates etc, or just the installation of Authpoint? Thank you. Kieran

Hi @Vedran, Honestly, I would submit a support case like you did for your SSO issue with a screenshot of the Event Viewer error that occurs upon attempting to start the DESlockHTTP service. Possibly something not configured as expected. Thank you.

Thank you @Vedran

Hi @Vedran, Would you mind submitting a ticket via the following for me: https://www.eset.com/int/support/contact/ When you do this, could you send us the following from the machine affected by this issue please: ESET Encryption Diagnostic Log: https://support.eset.com/en/kb7123-eset-encryption-diagnostics-tool Workstation Log: https://support.eset.com/en/kb7195-obtain-a-workstation-log-in-eset-endpoint-encryption Video of the user entering their SSO Password and not being able to complete the process? Thank you.

Hi @Lockbits, So just to confirm are these machines Encrypted with Filevault already, before EFDE was in the picture? If so, the message is correct, it cannot be Encrypted again by EFDE, you will need to decrypt them via FileVault if you wish for EFDE to take over the management of Filevault and Encrypt them again. EFDE cannot take over the management of Filevault whilst its already in place. Thank you, Kieran

Hi, You can acquire the required logs via the ESET Recovery USB in the following folder: USB:\\efi\boot\logfiles\ Then submit a ticket via https://www.eset.com/int/support/contact/. Thank you.

Hi @hari.senen, You followed what we would suggest if you had submitted a case with us. If Windows has gone into Automatic Repair, you need to decrypt the Workstation in order to allow Windows access to the data and repair where required. I am afraid I couldn't tell you why the machine had gone into Windows Automatic Repair, there are a few things that could cause this. I understand you have now reinstalled from a backup and we would no longer be able to collect any useful logs from the machine to provide you with more context. I would have to advise you submit a ticket with us if this happens again: https://www.eset.com/int/support/contact/ as hopefully then we can shed more light on this for you. Thank you, Kieran

Hi Adam, Problems like this can have various causes and solutions. I cannot suggest any without looking into this further, please may you submit a support case to the ESET UK Team via the following link: https://www.eset.com/uk/about/contact/ Thank you very much, Kieran

Hi @Muhammad_Faisal, Although I work with the Encryption Team and could not directly answer anything specifically about the ESET Agent and Bitlocker/Filevault detection. I think you might be better to ask your question here: https://forum.eset.com/forum/38-remote-management/ as ESET Agents will be looking through this daily and it will have more reach to the people you require assistance from. Thank you, Kieran

Hi @Hugh Letheren, Good to know, I am sure we will be able to ask the right questions and sort it via the ticket very soon, will be much easier to provide you accurate and concise support this way. Thank you very much. Kieran

Hi @Hugh Letheren, To best support you, please would you be able to submit a support ticket via: https://www.eset.com/uk/about/contact/ we will then do our best to work this out for you. One suggestion in the meantime however, has the disk you are decrypting the folder on got enough disk space? Thank you, Kieran

Hi @Trooper, Thank you, please may you submit a support case via https://www.eset.com/us/about/contact/ so we can assist further on this as this will require additional logs and information. Kieran

Hi @Trooper, Looking at this screenshot, it looks as though it is ESET Endpoint Security that requires the reboot, not ESET Full Disk Encryption (EFDE). Any chance you are also pushing an update to ESET Endpoint Security too that is causing this? Thank you, Kieran

Hi @meakins, Is EEE already installed? If so, please uninstall it temporarily and attempt to decrypt the disk via Elevated Command Prompt with the following command: 'manage-bde -off c:' Change 'c:' to the appropriate drive letter. Let me know how you get on with this. Thank you, Kieran

Hi @PrzemekFr, Unfortunately this "Push Install" command cannot be cancelled or deleted as it has processed onto the Cloud Proxy, you can only delete commands if they have not processed onto the Cloud Proxy yet. EEE will need uninstalling from the Workstation once it has installed. Thank you, Kieran

I am afraid you cannot export the information, I will discuss it with the team to see if that can be a future addition to allow the 'Exportation of Users who have logged into the EEE Server'. By what I can see this isn't on the EEE Server Roadmap, I can, much like the above discuss it with the team and see if this is something we can look at for a future addition to the EEE Server. Thank you, Kieran

Hi @Lockbits, However, to add to this, I wonder if the Category 'Console Authentication Event' within the EEE Server->Control Panel->Organization->Events would help do what you are looking for, it logs EEE Server Logins as well as which user it was? Just click 'Filter' and select 'Console Authentication Event' under Categories. Thank you, Kieran