Hello Alexsander, By default when the shield sees a SED (self-encrypting drive) it will not deploy our SDE (System Data Encryption) protection.  You can force this level of protection by adding the below registry key to your systems and rebooting.   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\CMGShield]  AlwaysApplySDE=REG_DWORD:1 If you are running the Enterprise Edition or Virtual Edition server management for your agents in the latest 9.6 server version along with a 8.12 or newer DDP|E agent you can automate this via new policy additions in that server version as well.
Hello I'm trying to troubleshoot an issue with PCs coming up as not-protected and I have noticed the entry which seems common among these not-protected devices: DeviceEngine.cp: 3729 W]   ...One of the disks is SED If this is coming up, the workstation doesn't come up as protected even after a month after having shield installed. Is this the right assumption? How do I fix that with policies?   Thanks in advance!  
DDP | EE Shield status as "Not protected" for policy-based encryption when SED 
drive is detected