FAQ - DLP End-point Encryption for USB PSD

Click the button “FRP Sync” after select the “McAfee” icon and “Quick settings”.

1) Close the Initialize Removable Media window, then click the buttons "Check New Policies" and "Enforce Policies" in McAfee Agent Monitor.
2) Click the button “Initialize media” from the “File and Removable Media Protection” option available after select the “McAfee” icon and “Managed Features”.

The function for resetting forgotten password by using challenge and response codes on DLP software is not supported in the University.

You can access the USB PSD on the DLP PC client you initialized that USB PSD without using password. And you can reset the password by the following steps:
1. Plug-in the DLP initialized USB PSD that you want to change the protection password.
2. Select McAfee icon on Windows toolbar.
3. Right-click the mous and select Manage Features > File and Removable Media Protection.
4. Select Change credendial.
5. Input a new protection password and re-confirm to set up.

The new DLP software could not be installed on Mac OS X platforms but the USB PSD initialized by new DLP software are accessible, e.g., read, write, after authentication by password. The information of supported Mac OS X platform is as follows:
1. Sierra 10.12.x
2. El Capitan 10.11.x
3. Yosemite 10.10.x

They are:
1. Windows 10 Creators Update (32-bit/64-bit) (Pro, Enterprise)
2. Windows 10 Anniversary Update (32-bit/64-bit) (Pro, Enterprise)
3. Windows 10 (32-bit/64-bit) (Pro, Enterprise)
4. Windows 8.1 (32-bit/64-bit) (Professional, Enterprise)
5. Windows 7 (32-bit/64-bit) (Professional, Enterprise, Ultimate)

There is no impact. USB PSD initialized by old DLP software could be accessed normally on DLP PC client with new DLP software installed.

This is a new feature of the new DLP software. For USB PSDs initialized on a DLP PC, they will only prompt for setup of password during the initialization process of the USB PSD. The subsequent accesses will not require password authentication on the PC that initialized the USB PSD.

There is no change on the procedure for initializing USB PSD by the new DLP software.

1) Tap on the McAfee icon on Windows toolbar.
2) Right-click the mouse, select About...
3) For upgraded DLP PC clients, the version number of the McAfee File and Removable Media Protection is 5.0.3.105.

It takes about 10 minutes for the whole DLP software upgrade process after the new software is downloaded to the DLP PC client and the PC will pop up a message for you to choose restart of PC during the upgrade process to complete the software installation.

The new DLP software will be upgraded automatically to all HKU staff PC with DLP software installed when they are connected to HKU campus network (not including Wi-Fi.HK).

The current DLP software is not compatible with the latest Windows 10 software which is version 1703 (a.k.a. Creators Update). Therefore, DLP Team planned for DLP software upgrade to ensure DLP software is working on future release of Windows 10 software.

Please click the buttons "Check New Policies" and "Enforce Policies" in McAfee Agent Monitor to test.

Please use Windows Backup and Restoration tool which is available in the Windows Vista/7/8/8.1 platforms to back and restore the data files.

We have tested to encrypt a partition of 2TB over a 4TB USB PSD and write data into the encrypted partition, we found the result is we can read and write files in the encrypted partition with no problem. However, please be informed do not create 65,534 or over files or folders in any single level as there is a limitation which no more than 65,534 files or folders could be created.

Please check if there is Windows update process running on the PC for patch update and reboot the PC manually after the installation process of the patches is completed.

Please check the Windows taskbar, the DLP software is installed if you have the “File and Removable Media Protection” option available after select the “McAfee” icon and “Managed Features”.

HKU has adopted the data protection solution from McAfee which will mandate the encryption of USB flash drive before any write access to the device. After initialization by the software, access to the USB flash drive will be protected by password and data stored in the device will be encrypted. The software is available for download by all staff after logon into HKU portal under the DLP Project web site. Please click here to download.

Only DLP initialized USB flash drives should be used on the HKU staff PCs. Access to non-DLP ordinary USB flash drives will be limited to read-only access.

It could be caused by a file table index problem in the encrypted area of the USB flash drive. Please change the authentication password of the encrypted USB flash drive on a PC without DLP software and test to access the files again in the PC with DLP software installed. The change of password will re-write the file table index in the encrypted area of the USB flash drive. If the problem persists please copy all data from the concerned DLP encrypted USB PSD to another DLP encrypted PSD through a PC without DLP software. After proper data transfer and access using the new USB PSD are confirmed, the problematic USB PSD can be disposed of or recycled as appropriate.

Please check if your Mac PC OS is compatible with the DLP software on the encrypted USB flash drive. The current supporting versions (as of May 7, 2016) are OS X Mountain Lion 10.8.x, OS X Mavericks 10.9.x, Yosemite 10.10.x and EL Capitan 10.11.x.

Please temporary disable the anti-virus software of the PC and click the buttons "Collect and Send Props", "Send Events", "Check New Policies" and "Enforce Policies" in McAfee Agent Monitor, then re-enable the anti-virus software to test.

Please change the user name of your user account of the Windows PC to test. Username with apostrophe (') is not supported by DLP software to assign the personal key.

No. You should not notice any difference in the performance of your PC, but your data will be protected as it is saved to USB PSD.

Yes, it is mandatory for all PCs that are within scope of the DLP Project. Please refer to “Project Scope and Phases of Development” section of the DLP web page. For PCs that are either for student use or not owned by HKU, no installation is required.

After the first successful installation of the DLP software to the PC, it will become effective for any other staff members using the same PC without the need for installation by each of them. The recovery key will be unique to each login account.

No. Encryption is transparent and automatic after the USB PSD is initialized.

No. Applications won’t even notice the encryption process because it’s done automatically in memory.

Yes if data will be transferred from University PC to the external USB device. Exemption of any external PSD will have to be approved by department head and recorded.

To find out the step-by-step guide, see "DLP End-point Encryption for USB PSD procedure".

It is recommended to initialize USB PSD without any data so as to avoid any possible damages to the files it contains. However, under normal circumstances, the existing files would be kept in an unencrypted file folder of the PSD if it is initialized by the DLP software.

A DLP encrypted USB PSD works simply in the same way like any other USB PSD. The “Eject” function must be invoked and wait until the message of advising safe removal of the device appears before it is removed physically from the computer. Otherwise, data corruption could be possible.

This is a password you define for each USB PSD you encrypt. It is used to ensure the encrypted data can’t be accessed by anyone who does not know the password.

No. The password for your encrypted USB PSD is not the same as the password used to log into your Windows computer. A different password should be created for USB encryption.

The password should have minimum 10 characters which consists of at least one alphabetical character and one numerical character.

If you forget your password please follow the steps below for recovery:

1. Plug the encrypted media in your PC which you used to create the encrypted USB PSD.
2. When you get the password prompt (example shown below), simply click the "Recover" button.
3. You will be prompted again and simply click ‘Next’.
4. Once you are authenticated with your computer, you will be prompted again for password reset

Yes, it is possible if you have the correct password. Please see "DLP Data Encryption for USB PSD procedure".

Users can contact ITS through their departmental DLP project coordinator to see if encryption keys can be recovered from the central DLP server.

For iPhone and smart phones that does not connect itself as USB massive storage but using other connection protocols like Media Transport Protocol and Picture Transfer Protocol (PTP) to a Windows operating system. Therefore, DLP End-point Encryption for USB PSD will not attempt to encrypt the storage inside the device. If you find there is a pop-up to ask for encryption, don't click on "Next" button and cancel the operation according to the instruction.

Yes, installation of the software is required to ensure that there is data encryption using any other USB flash drives without any build-in encryption feature. For USB flash drive with hardware build-in encryption feature, it will not compatible with the DLP solution and can only be used in PCs without DLP solution installed. Password recovery for such USB flash drive may not be possible that Department should start to use the DLP solution for data encryption where password recovery is possible.

Creation will be possible by (1) using PC without the DLP software and (2) USB flash drive without being initialized. The USB flash drive can then be used for the boot up purposes.

No. The Windows ReadyBoost feature is not supported by the DLP software no matter the USB flash drive is initialized or not.

Any modern PC running Windows will be able to read the content on your USB device. You will be prompted to type your password. After authentication, you will be able to present your work as normal from a container.

If you encrypt your USB device then you will be able to read and write to the device as normal on Windows platforms and Mac system with OS X Mountain Lion 10.8.x. Marvericks 10.9.x, Yosemite 10.10.x and EL Capitan 10.11.x after input the correct password.

You will need to type the password to retrieve your files from the USB device..

No. It is not possible to grant exemption at individual device level due to the DLP solution design.

Departmental DLP project coordinators will be given an account for accessing the central DLP server for granting exemption to the USB PSD in case needed. They can make use of the DLP Departmental Management PC to change the password of the account on a regular basis. Also, coordinators can perform initialization of USB flash drives via the DLP Departmental Management PC for staff members that do not have their own PC or with system in-compatible for DLP software installation.

No. Uninstallation of the DLP software from staff PC is not allowed. If there are special or technical reasons that are justified and approved by the corresponding Department Head and Director of ITS, uninstallation is allowed and has to be performed by central ITS administrator.