Network password sync for offline users

[JKdc]

We're looking to rollout DE w/preboot to a department that uses a lot of 'float' laptops that are shared throughout. I know that upon installation, DE will add profiles for users who have signed into that device before. I'm wondering how the password sync portion works for those users whose profile is on a device from the original install, but may not have logged in for a long time and had since changed their password.

-Will it only accept their old password from the last time they logged in?

-If another user was using that device regularly, when DE syncs their network  and preboot password, does it also update all the other profiles on the device or does it just sync the user that signs in when it's online?

I looked around for a KB article, but couldn't find an answer exactly.

[cross]

I should start by saying that we do not recommend the use of MDE with regular/simple automatic booting as that significantly decreases the security provided by MDE.

To get to your questions, as far as a KB article, https://kc.mcafee.com/corporate/index?page=content&id=KB93173 probably covers the situation the best. There are some examples listed in there. The last one listed covers the subject of user passwords with automatic booting in use.

[JKdc]

We are using drive encryption with preboot authentication. We are also using single signon with it matching windows usernames.

Thank you for the link, it did answer my question about how it syncs the other user profiles on a machine and - it does not unless those users would log past the preboot authentication screen.

In this case - if user1 cannot sign in to preboot authentication because they haven't used a particular device in a long time and they don't remember their password from back then; how to they get into the device and get their passwords to resync?

[cross]

 There are a multiple options if a user is at preboot and does not recall their MDE password.  There is a user recovery methods that can be configured with password recovery questions, they could use challenge\response recovery that involves either another person who has access to ePO or the use of the Data Protection self-service portal (DPSSP), this challenge\response option could also be used with the McAfee Endpoint Assistant app for smart phones so that the user does not need to contact another person for ePO access, or in more involved situations the use of the DETech standalone recovery utility could be used for an emergency boot.

Another, less simplistic approach would also be an option in which someone with proper ePO access could issue a token reset from ePO and then another authorized user logs in the client system to allow the system to get online and sync up to get that reset as well.

The options like the use of the Endpoint Assistant application and the recovery questions require that they be set up before they need to be used but the other options like challenge\response recovery are enabled by default.

[JKdc]

If they recover access via their security questions and are able to sign in, will this update and sync their password after signing in to Windows. I assume in this case that single signon will not work as the preboot has an old password, correct?

Thank you,

[cross · Accepted solution]

After using the recovery questions they should be able to set a new MDE password.  At this point, they can authenticate at preboot with that.  Then, MDE will attempt to pass through the existing SSO data that it has to Windows.  Assuming that the password that MDE has is no longer accepted by Windows, the user will need to log in to Windows and the MDE credential provider should pick it up there to set new SSO data and MDE password.  If, however, Windows accepts the logon data, then MDE will not synchronize it since what MDE had\has is acceptable to the OS.  

Such a case should be unlikely since the passwords should ultimately be the same with SSO and password synchronization enabled so if they don't remember their password to get in to MDE, what MDE has for the OS logon is likely to be "old" and not the current Windows password.