Removable disk encryption doesn't work [KES for Windows]

[Antipova Anna]

Advice and Solutions (Forum Knowledgebase) Disclaimer. Read before using materials.

This article is about Kaspersky Endpoint Security for Windows (KES for Windows)

Problem

"Removable disk" Encryption is enabled and the policy applied to the machines, but nothing happens when the client connects USB drive. 

Solution

Encryption of the removable drives supports two modes:

• Encrypt entire removable drive: based on Kaspersky Full Disk Encryption (FDE), the entire disk including the file system is encrypted using klfde.sys.
• Encrypt all files or new files only: based on Kaspersky File Level Encryption (FLE), files on a removable drive are encrypted using klfle.sys and file system remains unchanged Encryption of removable drives (kaspersky.com).

If you have collected GSI from an affected device, check file KL_Drivers_Versions_****.txt:

• If klfde.sys module is installed on the machine → there should be klfde.sys in KL_Drivers_Versions_****.txt file in GSI.
• If klfle.sys module is installed on the machine → there should be klfle.sys in KL_Drivers_Versions_****.txt file in GSI.

If there's no GSI from an affected device, check:

1. klfde.sys module is installed on the machine (in case of Encrypt entire removable hard drive) → path C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security for Windows\klfde_x64
2. klfle.sys module is installed on the machine (in case of Encrypt all files or new files only on removable hard drive) → C:\Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security for Windows\klfle_x64
3. If none of the above exists, the related component as per Change application components (kaspersky.com) should be installed.

Portable mode (which allows access to data outside the corporate network and allows encrypted data to be accessed on computers that do not have KES installed) is only available for File Level Encryption (FLE). It is not possible to enable portable mode support for Full Disk Encryption (FDE).