When you run the VLRE installer, you are presented with Stanford's Device Enrollment app, a brief questionnaire that gathers basic information about your computer. If you previously responded to these questions, your answers are displayed and you can change them if you wish.

After you complete the questionnaire:

• If your computer was encrypted using the Stanford Whole Disk Encryption service (SWDE) no further action is required.
• If your computer is not encrypted, VLRE steps you through the process of encrypting your hard drive. You are prompted to enable FileVault 2, Apple's built-in encryption technology, to encrypt the whole disk.
• If you self-encrypted your computer by turning on FileVault 2,  you are presented with an option to have your recovery key escrowed in a secure database. This option is highly recommended because it allows you to use the MyDevices service to recover your encryption key. If you forget your password you need your recovery key to access your computer. If you don't have your recovery key, your data is permanently lost.

Download software

Download software for Mac OS X 10.9 and above:

• Download the latest VLRE for Mac

If BigFix is installed on your computer it must removed before you can install VLRE. At the prompt, click Yes to remove BigFix now.

Device enrollment questionnaire

1. Run the VLRE  installer.
2. When the Install VLRE screen displays, click Continue. A setup wizard guides you through the steps necessary to install the software.
   
    
3. First, the Device Enrollment app runs, asking a series of questions regarding the use of this computer for Stanford business. If you have already answered these questions, please review the answers and make any necessary corrections. Click Proceed Now.
   
    
4. Next, choose whether or not you have a valid SUNet ID and then click Continue.
   
    
5. If you have a valid SUNet ID:
   • Enter your SUNet ID and password on the Login screen.
     
     ​
   • You will be asked to answer some questions about this device and the types of data that is accessed and stored on it.
6. If you do not have a valid SUNet ID:
   • If you are no longer affiliated with Stanford, the questionnaire is terminated.
   • If  this computer is used for Stanford work, the questionnaire is terminated. Someone with a valid SUNet ID needs to complete the questionnaire.

Encrypt with VLRE

If you need to encrypt your computer, VLRE steps you through the encryption process after the questionnaire is completed.

Before you begin

Note: You are encouraged to contact your local support organization to make sure your system is being routinely backed up prior to encrypting.

• Before starting the encryption, make sure your computer is on AC power and has an active network connection.
• Depending on the size and speed of your hard drive and how many files are stored there, encryption can take from 45 minutes to two days. You may want to install the the software at the end of the day and let the encryption run over night. You can use your computer during the encryption process, but certain activities may be noticeably slower.
• Note regarding Boot Camp: FileVault 2 does not encrypt the Windows partition on systems running Boot Camp.  Therefore,  to be compliant machines cannot run Boot Camp.  OS X users needing to run Windows need to use VMware Fusion or Parallels.

VLRE can log the program activity to a local file that technical support staff can use for troubleshooting. Click Yes to enable logging (recommended) or No to not enable logging.

Click OK to begin whole disk encryption.

Encrypt

1. You  are given the option to escrow your encryption recovery key in a secure database. Selecting Yes is highly recommended because it allows you to use the MyDevices service to recover your encryption key. Click Next to continue.
   
   
2. The next screen describes what to expect. If you are ready to encrypt your hard drive, check I have a backup and understand the risks involved and wish to continue and then click Continue. (If your computer is already encrypted this screen does not display.)
   
   
3. When the Welcome screen is displayed, click Continue.
   
   
4. Next, a policy agreement is displayed. Read it and click Agree to accept the terms of the policy agreement and continue with the installation.
   
   
5. Click Configure to enable FielVault2.
   
   
6. If your are running macOS 10.12 and below, you will see a message saying that you need to restart your computer after FileVault2 is installed. Click Yes.
   
   
7. Enter your administrator account name and password and then click Unlock.
   
   
8. Your recovery key is displayed. You will need this to unlock your FileVault 2 encryption if you forget your computer password. Make a copy of the recovery key and store it in a safe place. Then, click Close.
   
   
9. macOS 10.13 and above users: Click OK to start encrypting.
   
   
   
   macOS 10.12 and below users: You need to restart your computer and complete the FileVault2 configuration.
   
   
   
   After your computer restarts, enter your account password.
   
   
10. A window displays the encryption status.
    Note: You can use your computer while it is being encrypted.
    
    

Self encryption

If you encrypted your computer using FileVault 2 without using Stanford Whole Disk Encryption (SWDE), you are responsible for managing the recovery key.

After completing the questionnaire you are presented with an option to have the recovery key escrowed in a secure database. This option is highly recommended because if you lose or forget your recovery key, your encrypted data will be irretrievable.

If you opt to have your recovery key escrowed:

• Mac OS X 10.9.5 and above: a new recovery key is generated and then escrowed.
• Below Mac OS X 10.9.5: a dialog box prompts you to enter your recovery key.

Update notice

A message will pop up on your computer screen when a new version of VLRE is available. You should install the latest version of VLRE to maintain device compliance.

If you need help

• If you encounter problems, please call (650) 725-4357 or submit a Help ticket.