Creating a CTE-LDT GuardPoint for DFSR

Before you can create a CTE-LDT GuardPoint, you must set CTE-LDT to ignore the DFSR private directory that Microsoft automatically creates when you create a DFSR replication point. The private directory should not be encrypted by CTE-LDT.

1. Log into one of the DFSR servers in your network as an administrator.

2. For each GuardPoint you intend to set up on the server, exclude the matching DfsrPrivate directory from the CTE-LDT process using the voradmin ldt exlist add <guard path> command.

   For example, if you are going to guard D:\data, G:\HR Files, and the entire F: drive, you would use the following commands:

   voradmin ldt exlist add D:\data\DfsrPrivate
   voradmin ldt exlist add G:\HR Files\DfsrPrivate
   voradmin ldt exlist add F:\DfsrPrivate
   

   To make sure CTE-LDT is ignoring the proper directories, use the voradmin ldt exlist get command:

    voradmin ldt exlist get
   
   Live Data Transformation exclusion list. Following GuardPoints will be excluded from the Live Data Transformation.
   
   G:\HR Files\DfsrPrivate
   D:\data\DfsrPrivate
   F:\DfsrPrivate
   

3. Reboot all of the CTE-LDT agent hosts before you create any CTE-LDT GuardPoints.

4. Repeat the previous step on each server in your configuration before you create any CTE-LDT GuardPoints.

5. After you have excluded all DfsrPrivate directories on all servers from CTE-LDT processing, log into your key manager and set your CTE-LDT properties. When you begin the initial encryption, Thales recommends that you throttle the CTE-LDT processing speed with a CPU cap of 20%. You can increase this cap as more of the data is encrypted and there are fewer deltas between the DFS staging area and the production area.

   How you set the cap depends on the key manager that you are using:

   For CipherTrust Manager, launch the CTE application and create a Profile with the appropriate Quality of Service configuration parameters. Then make sure that all clients in the DFSR configuration use that profile.

6. Create the required CTE-LDT GuardPoints using the Live Data Transformation policy you created.

   You need to create the same set of GuardPoints, using the same Live Data Transformation policies, on each server in the configuration. For example, let's say you set up the following GuardPoints for the first server:

   Guard Path	CTE-LDT Policy Name
   D:\data	LDT-Policy-Main
   D:\data\DfsrPrivate	LDT-Policy-Main
   F:\	LDT-Policy-Main
   F:\DfsrPrivate	LDT-Policy-Main
   G:\HR Files	LDT-Policy-HR
   G:\HR Files\DfsrPrivate	LDT-Policy-HR

   You must then set up the same six GuardPoints using the same two CTE-LDT policies on each server in the configuration.