WIXLIB

Symantec Encryption ManagementServerAdministrator's Guide3.4

The software described in this book is furnished under a license agreement and may be used only inaccordance with the terms of the agreement.Version 3.4.2. Last updated: March 2018.Legal NoticeCopyright (c) 2018 Symantec Corporation. All rights reserved.Symantec, the Symantec Logo, the Checkmark Logo,PGP, Pretty Good Privacy, and the PGP logo aretrademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries.Java is a registered trademark of Oracle and/or its affiliates. Other names may be trademarks of theirrespective owners.This Symantec product may contain third party software for which Symantec is required to provideattribution to the third party ("Third Party Programs"). Some of the Third Party Programs are available underopen source or free software licenses. The License Agreement accompanying the Licensed Software does notalter any rights or obligations you may have under those open source or free software licenses. For moreinformation on the Third Party Programs, please see the Third Party Notice document for this Symantecproduct that may be available at as/, the Third PartyLegal Notice Appendix that may be included with this Documentation and/or Third Party Legal NoticeReadMe File that may accompany this Symantec product.The product described in this document is distributed under licenses restricting its use, copying, distribution,and decompilation/reverse engineering. No part of this document may be reproduced in any form by anymeans without prior written authorization of Symantec Corporation and its licensors, if any.THE DOCUMENTATION IS PROVIDED"AS IS"AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONSAND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR APARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCHDISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FORINCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, ORUSE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TOCHANGE WITHOUT NOTICE.The Licensed Software and Documentation are deemed to be commercial computer software as defined inFAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 "Commercial ComputerSoftware - Restricted Rights" and DFARS 227.7202, et seq. “Commercial Computer Software and CommercialComputer Software Documentation”, as applicable, and any successor regulations. Any use, modification,reproduction release, performance, display or disclosure of the Licensed Software and Documentation by theU.S. Government shall be solely in accordance with the terms of this Agreement.Symantec Corporation350 Ellis StreetMountain View, CA 94043Symantec Home Page (https://support.symantec.com/en US/dpl.62369.html)

ContentsIntroductionWhat is Symantec Encryption Management Server?Symantec Encryption Management Server Product FamilyWho Should Read This GuideCommon Criteria EnvironmentsUsing the Symantec Encryption Management Server with the Command LineSymbolsGetting AssistanceGetting product informationTechnical SupportContacting Technical SupportLicensing and RegistrationCustomer SupportSupport Agreement ResourcesThe Big PictureImportant TermsRelated ProductsSymantec Encryption Management Server ConceptsSymantec Encryption Management Server FeaturesSymantec Encryption Management Server User TypesInstallation OverviewAbout Open PortsTCP PortsUDP Ports11122233344555777891112171718About Naming your Symantec Encryption Management Server21How to Name Your Symantec Encryption Management ServerNaming Methods2122Understanding the Administrative InterfaceSystem RequirementsLogging InThe System Overview PageManaging AlertsLogging In For the First TimeLicensing Your SoftwareOverviewLicensing a Symantec Encryption Management ServerLicense Authorization23232325262629292929

iiContentsLicensing the Mail Proxy FeatureLicensing Symantec Encryption Desktop3030Operating in Learn Mode31Purpose of Learn ModeChecking the LogsManaging Learn Mode313232Managed DomainsAbout Managed DomainsAdding Managed DomainsDeleting Managed DomainsUnderstanding KeysChoosing a Key Mode for Key ManagementChanging Key ModesHow Symantec Encryption Management Server Uses Certificate Revocation ListsKey Reconstruction BlocksManaged Key PermissionsManaging Organization KeysAbout Organization KeysOrganization KeyInspecting the Organization KeyRegenerating the Organization KeyImporting an Organization KeyOrganization CertificateInspecting the Organization CertificateExporting the Organization CertificateDeleting the Organization CertificateGenerating the Organization CertificateImporting the Organization CertificateRenewing the Organization CertificateAdditional Decryption Key (ADK)Importing the ADKInspecting the ADKDeleting the ADKExternal User Root KeyGenerating the External User Root KeyImporting the External User Root KeyDeleting the External User Root KeyExternal User Root CertificateGenerating the External User Root CertificateImporting the External User Root CertificateDeleting the External User Root CertificateVerified Directory KeyImporting the Verified Directory KeyInspecting the Verified Directory 74848494949495050515152525253

ContentsDeleting the Verified Directory KeyAdministering Managed KeysViewing Managed KeysManaged Key InformationEmail ymmetric Key SeriesSymmetric KeysCustom Data ObjectsExporting Consumer KeysExporting the Managed Key of an Internal UserExporting the Managed Key of an External UserExporting Symantec Encryption Verified Directory User KeysExporting the Managed Key of a Managed DeviceDeleting Consumer KeysDeleting the Managed Key of an Internal UserDeleting the Managed Key of an External UserDeleting the Key of a Symantec Encryption Verified Directory UserDeleting the Managed Key of a Managed DeviceApproving Pending KeysRevoking Managed KeysManaging Trusted Keys and CertificatesOverviewTrusted KeysTrusted CertificatesAdding a Trusted Key or CertificateInspecting and Changing Trusted Key PropertiesDeleting Trusted Keys and CertificatesSearching for Trusted Keys and CertificatesManaging Group KeysOverviewEstablishing Default Group Key SettingsAdding a Group Key to an Existing GroupCreating a New Group with a Group KeyRemoving a Group Key from a GroupDeleting a Group KeyRevoking a Group KeyExporting a Group KeySetting Mail PolicyOverviewHow Policy Chains 697171717172727373757575767677777878797980iii

ivContentsMail Policy and DictionariesMail Policy and Key SearchesMail Policy and Cached KeysUnderstanding the Pre-Installed Policy ChainsHow Upgrading and Updating Affect Mail Policy SettingsMail Policy Outside the MailflowUsing the Rule InterfaceThe Conditions CardThe Actions CardBuilding Valid Chains and RulesUsing Valid Processing OrderCreating Valid GroupsCreating a Valid RuleManaging Policy ChainsMail Policy Best PracticesRestoring Mail Policy to Default SettingsAdding Policy ChainsDeleting Policy ChainsExporting Policy ChainsPrinting Policy ChainsManaging RulesAdding Rules to Policy ChainsDeleting Rules from Policy ChainsEnabling and Disabling RulesChanging the Processing Order of the RulesAdding Key SearchesChoosing Condition Statements, Conditions, and ActionsCondition StatementsConditionsActionsWorking with Common Access CardsApplying Key Not Found Settings to External UsersOverviewBounce the MessageSymantec PDF Email ProtectionSymantec PDF Email Protection Secure ReplyWorking with PassphrasesCertified Delivery with Symantec PDF Email ProtectionSend UnencryptedSmart TrailerSymantec Encryption Web Email ProtectionChanging Policy SettingsChanging User Delivery Method PreferenceUsing Dictionaries with PolicyOverviewDefault DictionariesEditing Default DictionariesUser-Defined DictionariesAdding a User-Defined 8120121121123123124125126126

ContentsEditing a User-Defined DictionaryDeleting a DictionaryExporting a DictionarySearching the DictionariesKeyservers, SMTP Archive Servers, and Mail PolicyOverviewKeyserversAdding or Editing a KeyserverDeleting a KeyserverSMTP ServersAdding or Editing an Archive ServerDeleting an Archive ServerManaging Keys in the Key CacheOverviewChanging Cached Key TimeoutPurging Keys from the CacheTrusting Cached KeysViewing Cached KeysSearching the Key CacheConfiguring Mail ProxiesOverviewSymantec Encryption Management Server and Mail ProxiesMail Proxies in an Internal PlacementMail Proxies in a Gateway PlacementMail Proxies PageCreating New or Editing Existing ProxiesCreating or Editing a POP/IMAP ProxyCreating or Editing an Outbound SMTP ProxyCreating or Editing an Inbound SMTP ProxyCreating or Editing a Unified SMTP ProxyEmail in the Mail QueueOverviewDeleting Messages from the Mail QueueSpecifying Mail RoutesOverviewManaging Mail RoutesAdding a Mail RouteEditing a Mail RouteDeleting a Mail 3153155155156156156157v

viContentsCustomizing System Message TemplatesOverviewTemplates and Message SizeSymantec PDF Email Protection TemplatesSymantec Encryption Web Email Protection TemplatesEditing a Message TemplateIntegrating with Symantec Data Loss PreventionEnabling Integration with DLPDisabling Integration with DLPChanging the DLP Integration Authentication InformationManaging GroupsUnderstanding GroupsSorting Consumers into GroupsEveryone GroupExcluded GroupPolicy Group OrderSetting Policy Group OrderCreating a New GroupDeleting a GroupViewing Group MembersManually Adding Group MembersManually Removing Members from a GroupGroup PermissionsAdding Group PermissionsDeleting Group PermissionsSetting Group MembershipSearching GroupsCreating Group Client InstallationsHow Group Policy is Assigned to Symantec Encryption Desktop InstallersWhen to Bind a Client InstallationCreating Symantec Encryption Desktop InstallersManaging DevicesManaged DevicesAdding and Deleting Managed DevicesAdding Managed Devices to GroupsManaged Device InformationDeleting Devices from Symantec Encryption Management ServerDeleting Managed Devices from GroupsDrive Encryption Devices (Computers and Disks)Drive Encryption ComputersDrive Encryption DisksFileVault Devices (Computers and Disks)FileVault Computer InformationFileVault Disk 4175181182182183184187188189189191192193193