Overview
When you run the SWDE installer, the first step is Stanford's Device Enrollment app, a brief questionnaire which gathers basic information about your computer. If you already have responded to these questions, your previous answers are displayed.
After you complete the questionnaire SWDE steps you through the process of encrypting your hard drive. It checks your computer to make sure certain requirements are met, such as having BigFix software installed. You will need to fix, or let the installer fix, any items that are flagged before continuing.
Once your computer has been authorized to install encryption, the installer attempts to enable BitLocker, Windows built-in encryption technology, to encrypt the whole disk. If BitLocker cannot be enabled automatically, a browser opens and displays the instructions for manually enabling BitLocker.
Download software
System requirements
- Operating System: Windows 7 (Enterprise or Ultimate), Windows 8/8.1 (Professional or Enterprise), Windows 10 (Professional, Enterprise, or Education)
- Windows 8.0 and below: The Trusted Platform Module (TPM) version 1.2 or higher must be installed. It must also be enabled and activated (or turned on).
You are strongly encouraged to back up your files before starting to encrypt. CrashPlan PROe provided by University IT is the recommended backup service, but your local IT group may provide other options. CrashPlan encrypts your backups for secure storage and also provides the option of setting a secondary password to ensure that only you can restore the files.
- Before starting the encryption, make sure your computer is on AC power and has an active network connection.
- Depending on the size and speed of your hard drive and how many files are stored there, encryption can take from 45 minutes to two days.
- You may want to install the the software at the end of the day and let the encryption run over night. You can use your computer during the encryption process, but certain activities may be noticeably slower.
Device enrollment questionnaire
- Run the installer. A setup wizard guides you through the steps necessary to install the software.
- First, the Device Enrollment app runs, asking a series of questions regarding the use of this computer for Stanford business. If you have already answered these questions, please review the answers and make any necessary corrections. Click Proceed Now.
- Next, choose whether or not you have a valid SUNet ID and then click Continue.
- If you have a valid SUNet ID:
- Enter your SUNet ID and password on the WebLogin screen.
- You will be asked to answer some questions about this device and the types of data that is accessed and stored on it.
- If BigFix, Stanford's patch management software, is not present on your computer, it will be installed for you.
- Enter your SUNet ID and password on the WebLogin screen.
- If you do not have a valid SUNet ID:
- If you are no longer affiliated with Stanford, the questionnaire is terminated.
- If this computer is used for Stanford work, the questionnaire is terminated. Someone with a valid SUNet ID needs to complete the questionnaire.
Encrypt
After the questionnaire is completed, SWDE steps you through the process of encrypting your hard drive.
Run the encryption installer
- First, your computer's Windows Update status is checked. If your computer is missing any Windows updates, a list of the missing updates displays. Click Update Windows Before Continuing.
- Next, the Welcome window displays. Browse through the instructions and then click Next.
- Read the policy agreement and then click Next.
- The installer runs a test on your computer to ensure that certain requirements are met before encrypting. For example, anti-virus software must be installed and some network services need to be disabled.
- Click Fix Items to fix these problems.
- Click Next if the Test Results show that no items need to be fixed.
- Click Configure to enable BitLocker.
- The next screen describes what to expect. If you are ready to encrypt your hard drive, check I have a backup and understand the risks involved and wish to continue and then click Continue.
- A Bitlocker recovery partition is created but your computer must be restarted to enable it. Click OK to restart your computer.
If the installer cannot enable BitLocker, an error message displays. Your default browser launches and navigates to the instruction page for manually enabling BitLocker. Follow these instructions to encrypt your computer.
- After your computer restarts a User Account Control dialog box displays. Click Yes to let the Stanford Security Compliance program make changes to this computer.
- If a window displays asking if you have a TPM owner password, click Clear the TPM.
-
The screen describing what to expect displays again. Check I have a backup and understand the risks involved and wish to continue and then click Continue.
- Create a Bitlocker password and then click OK. You will need to enter this password whenever you restart your computer once BitLocker is enabled.
Note: The red ball changes to green when your BitLocker password meets Stanford's security standards.
- An encryption recovery key is generated and displayed. You will need this to unlock your encrypted drive if you forget your BitLocker password. You can use the My Devices service to recover your encryption key. Click Close.
- Click Restart Computer Now to restart your computer. Encryption will begin when your computer restarts.
Note: Click Let me see my password to see your password in clear text before continuing. Remember this password.
- From this point on, you will need to enter your BitLocker password whenever you restart your computer.
Enable BitLocker manually
If the installer could not enable BitLocker, use the step-by-step instructions to enable BitLocker.
If you need help
- If you encounter problems, please call (650) 725-4357 or submit a HelpSU request. This service is provided 24 X 7 by University IT.
- Removal of McAfee Whole Disk Encryption is a service that is available upon request. Please submit a HelpSU request to contact your local support representative who can initiate these actions from the server.