How to upgrade the operating system to Windows 10 with File and Removable Media Protection installed

Technical Articles ID: KB87550
Last Modified: 12/23/2021

Environment

McAfee File and Removable Media Protection (FRP) 5.x

Microsoft Windows 10 (all supported releases)

For supported environments, see KB81149 - Supported platforms for File and Removable Media Protection.

Summary

This article helps customers to upgrade their operating system to Windows 10, when FRP is installed. The following upgrade information is included:

Windows 7, 8, 8.1 to Windows 10.
Windows 10 (version 1511) to Windows 10 Anniversary Update or a later release.

IMPORTANT:

Failure to follow the instructions outlined in this article causes the Windows 10 upgrade to fail and roll back. The failure can occur when FRP is installed, and encrypted files are on the system.
You must follow this process because encryption keys are not available during the upgrade, so authentication to FRP is not possible. FRP typically blocks open and read operations on encrypted files, which in turn blocks the Windows upgrade. The operating system must be able to open and read encrypted files, and back up and restore them for the Windows upgrade to succeed.

Known Issues

Reference: FRP–4767
Description: A known issue exists which prevents Windows 10 upgrades on systems that have FRP installed.
Resolution: Fixed in FRP 5.2.0.

For details, see KB85807 - File and Removable Media Protection 5.x Known Issues.

McAfee Enterprise product software, upgrades, maintenance releases, and documentation are available from the Product Downloads site.

NOTE: You need a valid Grant Number for access. See KB56057 - How to download Enterprise product updates and documentation for more information about the Product Downloads site, and alternate locations for some products.

Solution 1

IMPORTANT:

Upgrade to a supported version of FRP before you upgrade the operating system to Windows 10, or from one Windows 10 version to a later version.
Supported FRP versions are available in the FRP supported environments article, referenced in the Environment field of this article.

NOTES:

All encrypted files must be treated as simple binary files to allow a file open or read operation to succeed without a key being present. The binary files are files that FRP does not intercept or decrypt.
To configure FRP to treat all encrypted files as simple binary files, specify a sequence of Advanced Debug Options. These options instruct FRP to treat files on all drives as simple binary files.
When the options are set, FRP does not decrypt or encrypt any files, and FRP appears to stop working. For details, see KB83461 - Advanced debug and configuration options for File and Removable Media Protection.
FRP must be configured to treat all encrypted files as simple binary files. You must complete this task before the upgrade process to Windows 10 starts.
You must then reconfigure FRP to explicitly remove these options after the upgrade is successful.

Before the upgrade process:
1. Record which Encryption Options policy is assigned to the system (Original Policy). You must reapply this policy when the upgrade is complete.
2. Create an Encryption Options policy, Policy A.
3. Enter the following string in the Advanced Debug Options field of the policy:
  
  ESD:1#ENW:1#ENR:1#ENS:1#ENF:1#ERD:1
4. Assign Policy A to the system being upgraded, and enforce it.
5. To apply these options to the driver, restart the system.
6. Upgrade to Windows 10, or from one Windows 10 version to a later version.
After the upgrade process is successful:
1. Create an Encryption Options policy, Policy B.
2. Edit the string in the Advanced Debug Options field in the policy, as below:
  
  ESD:-#ENW:-#ENR:-#ENS:-#ENF:-#ERD:-
3. To remove the exclusions, apply Policy B to the upgraded system.
  
  NOTE: If you simply leave the Advanced Debug Options string empty, it does not remove these exclusions; they must be explicitly removed as described.
4. To apply these settings to the driver, restart the system.
5. Reassign the Original Policy to the system and enforce.

IMPORTANT: If you are changing an existing policy, make sure that you note any Advanced Debug Options that are currently defined. Also, reapply them when you have completed step 2 above.

Solution 2

An alternative method is to remove the FRP product before an upgrade, and reinstall it when the upgrade is complete. Because FRP is not installed on the system during the upgrade process, all encrypted data on the system is preserved. Use the following steps:

Uninstall FRP from the system being upgraded.
Upgrade to Windows 10, or from one Windows 10 version to a later version.
Install FRP.
IMPORTANT: Install a version of FRP that is compatible with the new Windows 10 version. Supported FRP versions are available in the FRP supported environments article, referenced in the Environment field of this article.
Enforce policies.

Affected Products

File and Removable Media Protection 5.4.x
File and Removable Media Protection 5.3.x
File and Removable Media Protection 5.2.x
File and Removable Media Protection 5.1.x
Install/Uninstall

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Knowledge Center

How to upgrade the operating system to Windows 10 with File and Removable Media Protection installed

Environment

Summary

Solution 1

Solution 2

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Knowledge Center

How to upgrade the operating system to Windows 10 with File and Removable Media Protection installed

Environment

Summary

Solution 1

Solution 2

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title