Emergency Recovery with DETech bootable CD

Overview

If an encrypted computer is not booting properly or you cannot get past pre-boot authentication, you may need to use the DETech CD to remove disk encryption.

If the computer can boot into Windows, use the following process to disable/remove drive encryption: Disabling McAfee Drive Encryption

Process

1. Tag the computer in ePO Console with the Remove_MDE tag.
   1. Find the computer under System Tree
   2. "Action" tab at the bottom>Tag>Apply Tag>Remote_MDE>Ok
2. Burn the following iso to a CD: \\titan\software$\FSP\Disk Encryption\DETech72.iso
3. Boot from the CD

4. Under Authentication, select Token. Authenticate using your UTLN and encryption password (usually the same as your Tufts password)

   If Token authentication fails you must authenticate using a recovery File.

   To obtain the recovery file, in ePO Console, select the system you are trying to Decrypt under System Tree

   Actions> Drive Encryption> Export Recovery File Information, OK (If you don't have option for Drive Encryption, your account does not have privileges to export recovery keys. Please contact it@tufts.edu).

   Place exported XML file on a USB memory stick. Authenticate using this file (under Authentication select File, and browse to XML).

5. Authorize using the Code of the Day. Run the following .exe to retrieve the code of the day: \\titan\software$\FSP\Disk Encryption\EETechCode.exe
6. Click Remove DE