Omnissa, LLC

Vmware, Inc.

Kevin B Sheehan

Neeraj Saluja

Shravan Shantharam

Muhammad Anadil Furqan

Chris Halstead

Jared Cook

Adarsh Subhash Chandra Jain

Kishore Krishnakumar

Evgeniy Sayapin

Senthil Parthasarathy

Joshua Spencer

Amruta Moghe

Haroon Barlas

Akhil Parasa

A management service manages recovery keys. The management service receives a removable drive recovery key, a recovery key identifier, and a removable drive identifier from a management agent executed on a client device. The management service stores the information, reads the removable drive recovery key from the removable drive recovery key escrow, and transmits this to the management agent as a verification of accurate storage of the removable drive recovery key within the removable drive recovery key escrow.

Secure recovery key management for removable drive encryption enforcement

Disclosed are various embodiments of a multiuser unified endpoint management (UEM) system. A device check-in can be received from a client device. The device check-in can include a device identifier that uniquely identifies the client device with respect to other client devices and a user identifier that uniquely identifies the user of the client device with respect to other users of the client device. In response, a device channel identifier associated with the device identifier and a user channel identifier associated with both the user identifier and the device identifier can be obtained. Then a first set of entitlements associated with the device channel identifier and a second set of entitlements associated with the user channel identifier can be selected. Both sets of entitlements can be provided to the client device in response to the device check-in.

Multiuser unified endpoint management

Enrollment management for virtual devices is described. In some examples, an enrollment agent of a virtual device retrieves a serial number using an operating system command that identifies the serial number locally to the virtual device. A request to identify device records with the management service is transmitted along with the serial number. A management identifier is received for a device record that is associated with the serial number. A local device management parameter of the virtual device is set to specify the management identifier. An enrollment request is transmitted to the management service.

Virtual device enrollment and management

Examples of enrollment of virtual devices for unprivileged users are described. In some examples, a virtual device includes an enrollment agent, encrypted enrollment credentials, and a user mode privilege elevation component that elevates privilege of the enrollment agent. A privilege elevated token is created to include an administrative privilege of a local security authority service, and a security context of an unprivileged user account logged in to the virtual device. The enrollment agent is launched using the privilege elevated token rather than a user token of a user that is logged in. The enrollment agent decrypts the encrypted enrollment credentials based on administrative privilege of the privilege elevated token, and enrolls the virtual device with a management service using decrypted enrollment credentials.

Enrolling a virtual device as an unprivileged user

Examples of scheduled and on-demand volume encryption suspension are described. A management service can identify multi-volume encryption rules for local volumes of a client device including the operating system volume as well as non-operating-system volumes. The encryption rules can be transmitted to the client device. Volume encryption samples for the client device can be received, and a console user interface can be generated to indicate compliance status information for the multi-volume encryption rules for local volumes of a client device.

Device data-at-rest security using extended volume encryption data

Examples of scheduled and on-demand volume encryption suspension are described. In some examples, volume encryption is to be suspended for a client device. A suspension limit is identified for a volume encryption suspension for the client device. A suspend encryption command is generated to include instructions for the client device to apply the volume encryption suspension according to the suspension limit. The suspend encryption command is transmitted to the client device for execution.

Growing community of inventors

Bloomfield, CT, United States of America

Kevin B Sheehan