There are multiple methods to successfully decrypt and remove the Dell Encryption suite of products. This article helps offer insight, guidance, and best practices to the overall removal process of all Dell Encryption Solutions.
Encryption solutions are complex and not tested or supported to co-exist with each other. This can leave a gap in protection of deployed devices as customers are migrating away from one encryption solution to another.
As Dell Encryption begins its path to End of Support and End of Life, customers may find it easier to let their current deployment of devices age out using hardware attrition or operating system failure. When a device is refreshed, or the operating system is reloaded onto an existing device the customer can start fresh at that point with their replacement Encryption solution.
All Dell Encryption solutions are targeted to protect the Data-at-Rest (DAR) which means if you were to boot the machine with a Windows PE disk or attempt to access the drive as a secondary drive on a second computer you would not be able to open or view any of the data that was protected using Dell Encryption as of the last operating system user session.
A common misconception of Dell Encryption is that the data is encrypted even if it moved off the device say to a network or cloud share. When the operating system has loaded all the Windows system files, they are in an accessible state. In this state as files are moved from the device to a network or cloud share, they leave the computer in their plaintext state and are saved at their destination in that plaintext state. If a device refresh is not an option, having the user backup all their files to a network our cloud share and then placing a fresh operating system image on the device is a fast and quick way to migrate away from Dell Encryption.
One of the first steps of the removal process of any Dell Encryption solution is to begin decryption. The below topics are broken down per encryption solution for ease of understanding the differences, recommendations, and risks.
Figure 1: (English Only) Dell Data Security Sign in
Figure 2: (English Only) Go to Populations > Endpoint Groups
Figure 3: (English Only) Click Add
Figure 4: (English Only) Select ADMIN-DEFINED Group and click Add Group
Figure 5: (English Only) Adding endpoint group: Device Targeted Decryption message
Figure 6: (English Only) Select newly created Endpoint Group
Figure 7: (English Only) Select the Members Tab
Figure 8: (English Only) Add Endpoint to Group or Upload Multiple Endpoints from File (CSV)
Figure 9: (English Only) Click the Security Polices tab
Figure 10: (English Only) Click Policy-Based Encryption
Figure 11: (English Only) SDE Encryption Enabled Box is Checked
Policy Name | Policy Value |
---|---|
SDE Encryption Rules | -^3F#:\ |
Common Encrypted Folders | -^3F#:\ |
SDE Encryption Algorithm | Customer Choice |
Common Encryption Algorithm | Customer Choice |
Encrypt Windows Paging File | Cleared |
Secure Windows Credentials | Cleared |
Block Unmanaged Access to Domain Credentials | Cleared |
Secure Windows Hibernation File | Cleared |
Prevent Unsecured Hibernation | Cleared |
Policy Proxy Connections | Customer Choice |
Policy Proxy Polling Interval | Customer Choice |
Length of Each Reboot Delay | 15 |
Number of Reboot Delays Allowed | 3 |
Temporary File Encryption key type | Off |
Figure 12: (English Only) Go to Management > Commit
Figure 13: (English Only) Add in a comment and select Commit Policies
Figure 14: (English Only) Dell Data Security Sign in
Figure 15: (English Only) Go to Populations > User Groups
Figure 16: (English Only) Click Add
Figure 17: (English Only) Select ADMIN-DEFINED Group and click Add Group
Figure 18: (English Only) Adding Admin-Defined User group: Admin Defined message
Figure 19: (English Only) Select the newly created User Group
Figure 20: (English Only) Select the Members Tab
Figure 21: (English Only) Add Users to Group or Upload Multiple Users from File (CSV)
Figure 22: (English Only) Click the Security Polices tab
Figure 23: (English Only) Click Policy-Based Encryption
Figure 24: (English Only) Policy-Based Encryption policy is switched to On
Application Data Encryption Key | Current Customer Value |
---|---|
User Encrypted Folders | -^3F#:\ |
Application Data Encryption List | Blank |
User Encryption Algorithm | Customer Choice |
Encrypt Outlook Personal Folders | Cleared |
Encrypt Temporary Files | Cleared |
Encrypt Temporary Internet Files | Cleared |
Encrypt User Profile Documents | Cleared |
Managed Services | Blank |
Secure Post-Encryption Cleanup | Checked |
Workstation Scan Priority | Customer Choice |
User Data Encryption Key | Customer Choice |
Current Shield State | Activate |
Allow Activations | Checked |
Number of Policy Update Delays Allowed | 3 |
Force Logoff/Reboot on Policy Updates | Checked |
Policy Viewer Enabled | Customer Choice |
Display Local Encryption Processing Control | Cleared |
Suppress File Contention Notification | Checked |
Number of Encryption Processing Delays Allowed | 0 |
Length of Each Encryption Processing Delay | 5 |
Length of Each Policy Update Delay | 15 |
Allow Encryption Processing Only When Screen is Locked | False |
Hide Overlay Icons | Customer Choice |
Figure 25: (English Only) Go to Management > Commit
Figure 26: (English Only) Add comments and select Commit Policies
Figure 27: (English Only) Sign in to Dell Data Security Console
Figure 28: (English Only) Go to Populations > User Groups
Figure 29: (English Only) Click Add
Figure 30: (English Only) Select ADMIN-DEFINED Group and click Add Group
Figure 31: (English Only) Adding Admin-Defined User group: Admin Defined message
Figure 32: (English Only) Select the newly created User Group
Figure 33: (English Only) Select the Members Tab
Figure 34: (English Only) Add Users to Group or Upload Multiple Users from File (CSV)
Figure 35: (English Only) click the Security Polices tab
Figure 36: (English Only) Click Policy-Windows Media Encryption
Figure 37: (English Only) Set the Windows Media Encryption policy to switch off
Figure 38: (English Only) Go to Management > Commit
Figure 39: (English Only) Add comments and select Commit Policies
Figure 40: (English Only) Open Dell Encryption
Figure 41: (English Only) Click advanced
Figure 42: (English Only) Click default settings
Figure 43: (English Only) Enter your encryption administrator password
Figure 44: (English Only) Select the Encryption Disabled template and click save
Figure 45: (English Only) Decrypting, sweep in progress
Figure 46: (English Only) Sign in to the Dell Data Security Console
Figure 47: (English Only) Go to Populations > Endpoint Groups
Figure 48: (English Only) Click Add
Figure 49: (English Only) Select ADMIN-DEFINED Group and click Add Group
Figure 50: (English Only) Select newly created Endpoint Group
Figure 51: (English Only) Select the Members Tab
Figure 52: (English Only) Add Endpoint to Group or Upload Multiple Endpoints from File (CSV)
Figure 53: (English Only) Select Security Policies
Figure 54: (English Only) Select Self-Encrypting Drive (SED)
Figure 55: (English Only) Switch Self-Encrypting Drive (SED) to Off and click Save
Figure 56: (English Only) Go to Management > Commit
Figure 57: (English Only) Select Commit Policies
Figure 58: (English Only) Sign in to Dell Data Security Console
Figure 59: (English Only) Go to Populations > Endpoint Groups
Figure 60: (English Only) Click Add
Figure 61: (English Only) Enter a Group Name and click Add Group
Figure 62: (English Only) Select the newly created Endpoint Group
Figure 63: (English Only) Select the Members Tab
Figure 64: (English Only) Add Endpoint to Group or Upload Multiple Endpoints from File (CSV)
Figure 65: (English Only) Click BitLocker encryption
Figure 66: (English Only) Switch BitLocker encryption to not managed
Back To Top
Figure 67: (English Only) Change the selection to turn off encryption
Figure 68: (English Only) Go to Management > Commit
Figure 69: (English Only) Add a comment and click Commit Policies
Figure 70: (English Only) Sign in to Dell Data Security Console
Figure 71: (English Only) Go to Populations > Endpoint Groups
Figure 72: (English Only) Click Add
Figure 73: (English Only) Select ADMIN-DEFINED Group and click Add Group
Figure 74: (English Only) Select newly created Endpoint Group
Figure 75: (English Only) Select the Members Tab
Figure 76: (English Only) Add Endpoint to Group or Upload Multiple Endpoints from File (CSV)
Figure 77: (English Only) Select Security Policies
Figure 78: (English Only) Select Full Disk Encryption (FDE)
Figure 79: (English Only) Switch Full Disk Encryption (FDE) to off and click Save
Figure 80: (English Only) Go to Management > Commit
Figure 81: (English Only) Add a comment and click Commit Polices
How to Run the Dell Data Security Uninstaller
It is recommended that you download and keep the Dell Security Management Server Enterprise installation files and store them along with your database backup, server_config.xml, and secretKeyStore
files in the event you must fully restore your previous environment. Following the steps below ensures you can recover your deployment if needed.
Figure 82: (English Only) Download Dell Security Management Server
Path: <boot drive>:\Program Files\Dell\Enterprise Edition\Compatibility Server\conf
Path: <boot drive>:\ Program Files\Dell\Enterprise Edition\Compatibility Server\conf
How to Uninstall Dell Security Management Server / Dell Data Protection Enterprise Edition Server
The Dell Security Management Server Virtual is an appliance-based management server for Dell Encryption products. The self-contained nature of this option makes it incredibly simple to back up your current deployment it and store files as needed on cold storage or offline storage.
It is recommended that you download and keep an appliance OVA or VMDK to store along with your database backup in the event you must fully restore your previous environment.
Figure 83: (English Only) Download Dell Security Management Server Virtual (Hyper-V) or Dell Security Management Server Virtual (VMware)
Dell Data Security support is available for ProSupport customers. Customers can use the Dell Data Security International Support Phone Numbers article to locate an in-country support number and extension to get assistance.
Effective January 31, 2023, Dell Personal Encryption and Dell Enterprise Encryption will no longer be supported for versions of Microsoft Windows 7, Windows 8, and Windows 8.1. This action follows the Microsoft decisions to end support of Windows 7 (effective January 14, 2020) and Windows 8 and 8.1 (effective January 10, 2023). It is recommended to uninstall Dell Encryption from these devices or continue usage under your own risk. For more information about the Dell Encryption software life cycle, reference the Product Life Cycle (End of Support / End of Life) Policy for Dell Data Security.
You are entitled to Dell Encryption support through your most recent contract purchase. From our records, we intend to finalize Dell Encryption support in the calendar year 2026.
All Dell Encryption licenses are perpetual. Your deployed devices and servers can continue to run if they are healthy enough to do so.
It is possible there could be pending legal litigation going on with your encrypted devices. It is recommended that you communicate with your legal team and save a copy of your enterprise or virtual edition server configurations so that they are available if a hard drive or removable device is located several years later after you have moved away from Dell Data Security solutions. More information about how to backup and store copies of your server configurations can be found above in the Dell Security Management Server section or Dell Security Management Server Virtual section above.
To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.