Endpoint monitoring not compatible with upgraded encryption settings

Overview

Attempting to enable endpoint monitoring in an organization that uses upgraded archive encryption key security results in one of the following error messages:

• "Your changes cannot be applied because one or more organizations use upgraded encryption settings."
• "Your changes cannot be applied because this organization or child organizations use upgraded encryption settings."

Endpoint monitoring and upgraded archive security cannot be used at the same time. Upgraded archive security settings prevent access to a user's archives from any external source, including the Code42 cloud attempting to perform endpoint monitoring functions.

Considerations

• Upgraded archive security may be enabled by:
  • Administrators via the Code42 console
  • Users via the Code42 agent (unless an administrator locked the archive encryption key setting)

Recommended solution

Reconfigure the users and organizations in your Code42 environment so users with upgraded archive encryption are not in organizations that use endpoint monitoring. Endpoint monitoring and upgraded archive security cannot be used at the same time.

To enable endpoint monitoring for a user with upgraded archive security, follow the steps in the alternative solution below to restart the user's backup.

Alternative solution

Repeat the steps below for each affected user.

1. Sign in to the Code42 console as an administrator with permissions to manage the affected users.
2. Select Administration > Environment > Users.
3. Select the affected user.
   The User details screen appears.
4. Select Actions > Edit account details.
5. Change the Email Address to indicate this account is no longer in use. For example, change clyde.bailey@example.com to clyde.bailey-deactivated@example.com.
   This allows you to re-use the the user's actual email address for the new account.
6. Click Save.
7. Deauthorize the user's devices. Follow these steps for each device associated with the user:
   1. From the user's details, select the user's device.
   2. The device details screen appears.
   3. Select Actions > Deauthorize.
      The user is signed out of the Code42 agent on the device.
8. Select Administration > Environment > Users.
9. Click the Create user to create a new account for the user.
10. Lock the archive encryption key setting:
    1. Go to Administration > Environment > Organizations.
    2. Select the user's organization.
       The organization details screen appears.
    3. Select Actions > Device backup defaults.
    4. Select Security.
    5. From Archive Encryption Key, deselect Use default archive encryption key setting.
    6. Select Standard.
    7. Click the lock icon.
       This prevents users from changing this setting.
11. Instruct the user to sign in to the Code42 agent using the new account, and click Start Backup.
12. Wait for the new backup to be 100% complete.
13. Deactivate the user account with upgraded security. This account's username was updated in Step 5 above to indicate it's no longer in use.
    After deactivation, the files backed up by this account cannot be restored, so it is important to make sure the backup for the new user is complete.
14. Enable endpoint monitoring.

Related topics

• Archive encryption key security: Advice for users
• Organizations - Device Backup Defaults - Security settings reference
• Enable endpoint data collection for the legacy agent
• Create and manage alert rules