Using Email Enrollment for PGP Desktop Clients with the PGP Server (Symantec Encryption Management Server)

Products

• PGP Command Line
• PGP Encryption Suite
• PGP Key Management Server
• PGP Key Mgmt Client Access and CLI API
• PGP SDK
• Drive Encryption
• Desktop Email Encryption
• Endpoint Encryption
• Encryption Management Server
• File Share Encryption
• Gateway Email Encryption

Issue/Introduction

Enrollment is the binding of a computer with PGP Desktop client (Symantec Encryption Desktop) software installed to a PGP Server (Symantec Encryption Management Server).  After a PGP Desktop client is bound to a PGP Server, it receives feature policy information from the Server; for example, encryption keys, email policy, PGP File Share Encryption, or PGP Drive Encryption administration. 

There are several methods to enroll.  The most common method to enroll and the method recommended is called "LDAP Enrollment", which uses User Attributes and Values stored on the PGP server.  For more information about Directory Synchronization, see the following article:

180239 - HOW TO: Enable Directory Synchronization on the PGP Encryption Server (Symantec Encryption Management Server)

Once Directory Synchronization is configured, LDAP Enrollment can be used. 

Another method to enroll, and one that we will detail in this article, is "Email Enrollment", which makes it possible to enroll, even without the use of an LDAP/Active Directory Server. 

This article details the steps to use Email Enrollment to enroll PGP Desktop clients with a PGP Server.

Resolution

This method is available for all client installations, including PGP File Share Encryption-only, and PGP Whole Disk Encryption-only installations, as long as there is an email account on the installed computer.

Email enrollment is possible even if the PGP Server does not perform email encryption or is out of the mailflow. Email enrollment requires the PGP Server be able to send an SMTP message to the mail server.

The mailserver in turn, must accept email from the PGP Server.

Important Note: It is not necessary to fully "Trust" the PGP server on the mailserver, only allow an email to be sent TO the mailserver, so as to prevent a mail relay situation. 

Email Enrollment requires the following protocols be used:

*IMAP/Exchange
*POP
*IMAP

Exchange for macOS is not supported as it is technically a hybrid of HTTPS and our mail service does not handle that protocol.

 

If your email protocol can be proxied, then you can use email enrollment.  If you do not support one of the above, you can still enroll if you are using "LDAP enrollment" as mentioned previously.


If you do not select Enroll clients using directory authentication when you enable Directory Synchronization, clients enroll through email.

There are a few parts to client installation and enrollment:

Table of Contents

• Section 1 of 3: Server Configuration
• Section 2 of 3: Create a PGP Desktop client installer for email enrollment
• Section 3 of 3: Installation and Enrollment using the "Email Enrollment" Method

Section 1 of 3: Server Configuration

On the PGP server, login and click on the Consumers tab, then click Directory Synchronization:

As shown in the screenshot above, you can see the Directory Synchronization service is enabled. 
Click the "Disable" button to disable Directory Sync.

Next, Click on the "Settings..." button to open the settings and make sure "Enroll clients using directory authentication" is unchecked:

 

Next, click on the Consumers, Managed Domains to see the list of domains available.  In this example, the only domain is "example.com":

Make sure all the domains you will be enrolling with are added.  We will have two domains, so we will add the second:

Click Save and verify both domains are now added:

 

Because "Email Enrollment" needs to send an email to each users who will be enrolling, we need to make sure there is a mail route configured for the PGP Server to send to.

Click on "Mail", then "Mail Routes" to see what is listed.  If no mail routes are configured, the PGP server will do its own lookup on the domain for the MX record and try to send there.

In our example, we want the PGP server to bypass the MX lookup and send to a specific mailserver.  To do this, click on "Add Mail Route...":

In this example, will will add a mail route for "example.com" and add an IP address of the Mailserver, 192.168.1.100:

When the user gets the Email Enrollment prompt, they will be asked to enter their email address and then confirm.  When this happens, the PGP server will use these mail routes to send the enrollment email to the user.

In this example, this means the PGP server will send the enrollment email to 192.168.1.100.  To ensure the enrollment email is sent to the user, make sure the receiving mailserver will accept mail from the PGP server.

Important Note: Again, take special care to not "Trust" the PGP Server as a relay, or give it "Relay" capabilities, simply allow mail to be accepted, so as to prevent a mail relay situation.

Now the new mail route is configured:

 

Add any other domains you wish to apply the mail routes with.

After the user enters their email address, and the PGP server sends the email to that mailserver, it is important that the "Enrollment Email" destined for the user, is not modified.

There is an encryption cookie that must be authenticated once it arrives at the user's inbox.  If this cookie is modified, the enrollment process may fail.

Section 2 of 3: Create a PGP Desktop client installer for email enrollment

For more information on downloading the PGP Desktop client, see the following article:
180244 - HOW TO: Download Encryption Desktop Client Installers in Symantec Encryption Management Server

Section 3 of 3: Installation and Enrollment using the "Email Enrollment" Method

1. Upload the installer file to the client computer.
2. Install PGP Desktop client by double-clicking the installer file.
3. Follow the on-screen instructions to install.
4. Restart the client computer when instructed. The PGP Desktop Setup Assistant appears. Follow the instructions to enroll.
5. Type the user's email address.
6. Run the email client and check for new email.
7. The user should receive an enrollment email from the PGP Server within a few seconds. Click on the enrollment email, and within a few seconds, the enrollment process should continue.
   
   
   

   Note: If the user does not receive an enrollment email, make sure the email domain matches a managed domain, and make sure the correct ports are open.

8. From the Enrollment Assistant, continue with enrollment by following the instructions.

Additional Information

153668 - Enroll PGP Encryption Desktop client using Directory Authentication with PGP Encryption Server (Symantec Encryption Management Server)

180181 - Re-enrolling PGP Encryption Desktop for Windows clients (Symantec Encryption Desktop)
181366 - Re-enrolling PGP Encryption Desktop for Linux Clients (Symantec Encryption Desktop)
155714 - Re-enrolling PGP Encryption Desktop for macOS X clients (Symantec Encryption Desktop)

217682 - Enrolling a user on multiple machines with PGP Encryption Desktop with SCKM Keymode (Symantec Encryption Desktop) 

153688 - Enable Silent Enrollment for PGP Encryption Desktop (Symantec Encryption Desktop)
181069 - Configure Invisible Silent Enrollment for PGP Encryption Desktop (Symantec Encryption Desktop Clients)

153437 - Using Email Enrollment for PGP Desktop Clients with the PGP Server (Symantec Encryption Management Server)
153324 - PGP Email Proxy Fails or Next Button Grayed out during Enrollment to PGP Encryption Server (Symantec Encryption Management Server)