Installing/Upgrading Symantec Endpoint Encryption Management Server (SEE Management Server)

Products

Desktop Email Encryption Drive Encryption Encryption Management Server Endpoint Encryption File Share Encryption Gateway Email Encryption PGP Command Line PGP Key Management Server PGP Key Mgmt Client Access and CLI API PGP SDK PGP Encryption Suite

Issue/Introduction

Symantec Endpoint Encryption provides a robust solution to Drive Encryption (AKA Full Disk Encryption) for laptops and desktop and as well as Removable Media Encryption needs, such as USB drives, Blue ray and similar media.

This article will help cover the basics of this setup and helpful utilities to make your life easier during installation.

For information on how to install the SEE Client, see the following article:

252118 - Installing the Symantec Endpoint Encryption Client (SEE Client)

Resolution

The SEE Management Server can be installed on Windows Server platforms as specified in the System Requirements.
The System Requirements page provides a wealth of information that is always useful to review, such as SQL Server version requirements and the like.

Important Note: Only US English Operating Systems are supported. All other Windows Server languages are untested and are not supported.
EPG-29439

Before you upgrade:

Attempting to upgrade your SEE Management Server, it's a good idea to take a backup of your SQL SEEMS Database.

TIP: f you can take a snapshot of the system before doing so, this will make it easy to revert back if needed.
161187 - Best Practices for Disaster Recovery with Symantec Endpoint Encryption Management Server (SEE Management Server)

SQL Permissions: First-Time Installations of SEE Management Server (Database creation):

In order to install Symantec Endpoint Encryption for the first time, you will need the sysadmin and public permissions to create a new database.
Once the database is installed and created, you will not longer need to be sysadmin. Future upgrades require only DB Owner (db_owner) permissions.

Once the installation has been completed, for the database user that will be used for the Symantec Endpoint Encryption day-to-day operations, you need only the following permissions:

• db_datareader
• db_datawriter
• public

Also provide access to the following directory (for proper logging to be performed):
C:\Program Files(x86)\Symantec\Symantec Endpoint Encryption Management Server\Services\Logs

SQL Permissions: Database Permissions and SQL Groups (Ongoing operation):

*SQL permissions must be provided to individual users, and those individuals can then be used for the database accounts configured for the SEE Management Server.
In other words, SQL users will not be granted DB access if they are part of only a security group that was provided DB access--the user itself must be provided DB access.

*The database user performing the installation must also be granted permissions to the specific SEEMS Database.
Even if someone is sysadmin, but not granted the permission on the SEEMS database, the SEE install will fail (EPG-26441).

Note for SEE 11.4 MP1HF1 and above: Database Access and Active Directory Hardening:
While installing or upgrading the SEE Management Server, domain user credentials provided on the Database Access screen are successfully validated against the hardened Active Directory (with LDAP signing policy enabled). [EPG-27643]

The SQL Server requires the two following downloads:
• The Microsoft SQL Server Feature Pack
• The MSOLEDBSQL driver

Three Server Feature Bundles: OLEDB Driver, CLR Types and Management Objects

1. Microsoft System CLR Types for SQL Server 2012 (32-bit version)
2. Microsoft SQL Server 2012 (32-bit) Management Objects
https://www.microsoft.com/en-us/download/details.aspx?id=56041

3. For the MSOLEDBSQL driver (OLE DB\OLEDB Driver), download the driver from the following URL (64-bit version):
https://docs.microsoft.com/en-us/sql/connect/oledb/download-oledb-driver-for-sql-server?view=sql-server-ver15

Important Note 1: If you have installed the Version 19.0 OLE DB driver and the installer still provides a message stating it is not installed, you can install version 18.6 as a workaround.
Important Note 2: Be sure to use the entire FQDN for the database server itself.
EPG-36640

Symantec Endpoint Encryption 12.0.0 through 12.0.1 installations or upgrades
Additional packages are required compared to SEE 11, however, this section will show you which packages are needed to help streamline the rest of the process.

Consideration 1: If you are on Symantec Endpoint Encryption 11.3.1 or higher, upgrade directly to SEE version 12.5 using the steps below.

Consideration 2: If you are on Symantec Endpoint Encryption 11.0.x through 11.3.0, you must first upgrade to SEE 11.4 MP2, and then upgrade to SEE 12 from there.
In other words, first update to 11.4 MP2 the server side (from 11.0.x through 11.3.0), and then upgrade the server to SEE 12 using the steps below.

Consideration 3: If you are using SQL Server 2012, before performing the upgrade to SEE version 12, update to a newer version.

SEE 12 now supports SQL Server 2022. SQL Server 2012 may produce an error if you attempt to upgrade:

"1: Incorrect syntax near 'OFFSET'.
Invalid usage of the option NEXT in the FETCH statement"

SEE Management Server "Prerequisite Verifier" Utility

An excellent tool is available with the SEE Management Server Suite download that will both check if the features are enabled and tell you what is missing.
Check out the "SEEMS_Install_PreRequisites_Verifier" directory for the readme and tools for more information:

Once the utility is run, and all the roles/features are available, the tool will confirm this:

Contact Symantec Encryption Support for more information on this utility.

For information on "What's New" with SEE 12, see the following article:
205088 -What's New with Symantec Endpoint Encryption version 12 (and 11.4 and 11.3.1)

Installation or Upgrade Steps

Step 1: First, there are four .Net packages you will need to download for installation:

Note: SEE 12.0 uses Net 6.0. However; SEE 12.5 uses .Net 8, which is recommended to take advantage of .Net 8 functionality.

Prerequisites Item 1: .Net Desktop Runtime 8
https://dotnet.microsoft.com/en-us/download/dotnet/8.0

Prerequisites Items 2 and 3: ASP.Net Core Runtime 6 (64-bit Installer) & ASP.Net Core Runtime 6 Hosting Bundle:

https://dotnet.microsoft.com/en-us/download/dotnet/8.0

Note: If you are upgrading from SEE 12.0.x to SEE 12.5, you do not need to uninstall the .Net version 6 bundles.
If you are not using .Net 6 for anything else, it is recommended to remove these bundles once upgraded to SEE 12.5, which uses .Net 8.

Prerequisites Item 4: NET Framework 4.8 Runtime

https://dotnet.microsoft.com/en-us/download/dotnet-framework

NOTE: If you get an unsupported platform error when installing .NET Framework 4.8.1, you can use .NET Framework 4.8.

Once you click on the above ".NET Framework 4.8.1", you will then be able to download an "online" or "Offline" version.
For this example, we will get the offline version for a lab that is disconnected from the internet.

You will then be taken to the below screen:

Step 2: Once you have all of these available, install them and reboot the Windows Server.

Step 3: In the SEE Management Server Download that you downloaded via the download portal, there is a new utility called "SEEMS_Install_PreRequisites_Verifier.exe":

Run this .exe as administrator and it will check to make sure any missing packages are then installed:

If any of the needed packages or roles are needed, a pop-up will appear, such as the following:

These packages must be downloaded and installed manually, similar to the OLEDB and SQL Management Objects. Once these are installed, reboot the system and run the "SEEMS_Install_PreRequisites_Verifier.exe" tool again.

Step 4: Keep running the tool until you have all the prerequisites installed and receive the following message:

Step 5: Once you receive the above, you are ready to install the SEE Management Server version 12.5.

Step 6: Once you have installed the server, and finished the SEEMS Configuration Wizard's Post Install Configuration, you will then be able to login to the new SEE 12 Web Portal.

The new SEE 12 Web Portal includes Client Creation, Groups, and Policies management, as well as significantly improved reporting.

To access the new portal, click on the Start Menu, and select Symantec Endpoint Encryption and then "SEE Management Console":

For more information on the SEE Management Console web portal and licensing, see the following articles:
276507 - Entering your License information for Symantec Endpoint Encryption version 12 and above

240649 - Symantec Endpoint Encryption Web Dashboard and Reports

Manual Method (This method is not recommended as the utilities mentioned above will help you get all these installed)

Prerequisite Roles Server 2019:

On Microsoft Windows Server 2019

To enable the Web service (IIS) role on a Microsoft Windows 2019 Server

Go to Start > Programs > Administrative Tools > Server Manager.
In the Dashboard, click Add roles and features.
In the Add Roles and Features Wizard, click Next.
In the Installation Type page, click Role-based or feature-based installation and then click Next.
In the Server Selection page, make the selection that matches your environment and then choose your server and click Next.
In the Server Roles page, select Web Server (IIS).
In the Add Roles and Features Wizard window, click Include management tools and then click Add Features.
Click Next.
In the Features page, expand .NET Framework 4.7 Features and check .NET Framework 4.7 and ASP.NET 4.7.
In the Features page, check Group Policy Management.
In the Features page, expand Remote Server Administration Tools > Role Administration Tools and check AD DS and AD LDS Tools.
Click Next.
In the Web Server Role (IIS) page, click Next.
In the Role Services page, expand Web Server > Security and select Basic Authentication and Windows Authentication.
In the Role Services page, expand Web Server > Application Development and check the following:

.NET Extensibility 4.7
ASP .NET 4.7
ISAPI Extensions
ISAPI Filters

In the Role Services page, expand Management Tools and check the following:

IIS Management Console
IIS 6 Management Compatibility (check all four entries)
IIS Management Scripts and Tools

Click Next.
In the Confirmation page, click Install.
In the Results page, click Close.

You will also need to install the IIS role on the server in order to be able to use the Web Service for communications as well as some additional roles.

For a comprehensive list of all these items needed for the installation, see our help page and Installation/Admin Guide.

If you need any assistance installing the Symantec Endpoint Encryption Server, please feel free to reach out to our Encryption Support team and we are happy to assist.

Troubleshooting

Scenario 1: Unable to access SEE Webconsole after upgrading to Symantec Endpoint Encryption version 12

For more information on this topic, see the following article:

366858 - Unable to access SEE Webconsole after upgrading to Symantec Endpoint Encryption version 12

Scenario 2: Can't get passed the SEE Database Account page on the installer.

There have been some instances where the SEE Management Server install will not proceed beyond the database page even though the proper database permissions have been configured.
As mentioned, you will need at least db_owner permissions, but if that requirement is met, and the installer fails, you can install the SEE Management Server in msiexec verbose mode to output a log file.

To do this, use the following syntax:

msiexec /i SEEServerSuite.msi /l*vx c:\SEEMS-install.log

Start the installer and then check this log when you encounter the error and see if this will provide additional insight.

As test, instead of using the "Create New Database" option, if that is failing, try using the option "Create a new login"

In some database environments, this may actually work out better and during this portion, you will then be able to install.

If you have an existing database and you are not sure if you are making any connections, check the MS SQL logging to see if a logging event has been made.
Even if the database screen page fails, if you see logging, then you know the ports should be open.

If there is no logging, ensure the ports are not blocked.

Sometimes it's useful to enter in port 1433 under the custom port, even if this is the standard port being used.

Scenario 3: Not sure if the connection is getting to the MS SQL server from the SEE Management Server during install

If you are running into issues, you can create a test file to help with the validation of connectivity. For more information on this, see the following article:

If you are unable to open the SEE Configuration Manager properly, or Symantec Encryption Management Server, see the following article:

220948 - Symantec Endpoint Encryption Management Server OR Symantec Endpoint Encryption Configuration Manager does not open properly

Scenario 4: Unable to upgrade Symantec Encryption Management Server with error "Execution Timeout Expired" The Timeout period elapsed prior to completion of the operation or the server is not responding"

If you are doing the installation of SEE Management Server, there is a timeout value configured of 10 minutes for all operations to complete.
If you are running into this condition, please reach out to Symantec Encryption Support for further guidance.

EPG-28774

Scenario 5: Can't get passed the SEE Management Server install with Smart Card popup.

If this is seen, you may need to login to the Windows Server with a password (unplug any smartcards) to perform the install.

This may be due to Windows Security GPOs requiring Smartcards. The SEE Management Server does not require PIV cards to be used for installation.
If you continue running into this issue, please reach out to Symantec Encryption Support for Further Guidance.

Scenario 6: Unable to install the Symantec Endpoint Encryption Error "Please Verify that the machine is in the domain, and try again".

One of the prerequisites for installing Symantec Endpoint Encryption Management Server (SEEMS) is that the server must be joined to an Active Directory domain. The SEEM server requires at least one Active Directory domain to function properly, as it relies on domain-based authentication and policy integration.

Additional Information

ISFR-1692, EPG-22805, EPG-26441, EPG-26443, EPG-26453

SEE Management Server:

240649 - Symantec Endpoint Encryption 11.4 Dashboard and Reports

227219 - Making Symantec Endpoint Encryption Management Server Public Facing

152737 - Minimum Database Permissions for Symantec Endpoint Encryption Administrators

161258 - User and System Accounts Required by Endpoint Encryption

178363 - Setting up Database Access Account Rights for Symantec Endpoint Encryption

179347 - Installing/Upgrading Symantec Endpoint Encryption Management Server ( SEE Management Server)

174725 - Grant Additional Administrators Access to Endpoint Encryption Manager Server Console

220948 - Symantec Endpoint Encryption Management Server OR Symantec Endpoint Encryption Configuration Manager does not open properly

227509 - Migrating from Symantec Encryption Desktop to Symantec Endpoint Encryption (Drive Encryption components)

178589 - Including Symantec Endpoint Encryption 11 in a System Image - Provisioning the SEE Client for new Machines

150384 - Feature Request: Add Support to SEE Management Server to support non-English Operating Systems

SEE Client:

252118 - Installing the Symantec Endpoint Encryption Client (SEE Client)