The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Product Settings policy — Log On tab

Published on Sep 12, 2026

9 minute(s) read

The Log On tab under the Product Settings policy allows you to define the logon settings for the Product Settings policy of Drive Encryption.

Log On (Drive Encryption)

Option	Definition
Enable automatic booting	When enabled, the client system boots automatically without prompting for a Pre-Boot Authentication. The expiration date for auto-booting can also be set. If required, the user can select the UTC time standard option. Important If you enable this option without requiring the use of TPM for automatic booting, the Drive Encryption product does not protect the data on the drive when it is not in use. Disable and restart system after 3 (1-10) failed logons or unlocks (Windows only, Vista onwards) — This feature is an enhancement of the primary Enable automatic booting feature. Select this option to disable the autoboot after a specific number (defaulted to 3 or specify from 1-10) of failed Windows logons. On the Windows authentication screen, if the user fails to authenticate the defined number of times, a message appears indicating that the maximum number of failed operating system logons was reached, and that Pre-Boot Authentication is enabled on the machine. Upon clicking OK, the client system restarts and PBA screen appears. Once the user authenticates through PBA and Windows successfully, autoboot is enabled. Note This feature is available for password, smart cards, and biometric tokens, and only for Windows Vista or later operating systems.
Allow temporary automatic booting	Allows you to turn (on or off) the PBA screen, with a client-side utility. This eliminates the need to modify the policy in ePO - On-prem, and fully automates patching and other client management scenarios.
Use of TPM for automatic booting	Select one of these options: Never — The encryption key is written to a plain-text file, which is unencrypted. The system is not secure. If available — If the TPM is available, the encryption key is written to a plain-text file, which is encrypted. The system is secure. If the TPM is not available, the encryption key is written to a plain-text file, which is unencrypted. The system is not secure. Required (Note: if TPM is not available on the system, automatic booting will not be enabled) — If the required TPM is available, the encryption key is written to a plain-text file, which is encrypted. The system is secure. If the required TPM is not available, automatic booting will not be enabled and the user will see the PBA screen to authenticate. The system is secure. Note This option is applicable only for systems installed with Drive Encryption 7.2.0 or later. If you apply a policy to the earlier versions of Drive Encryption with automatic booting enabled and use of TPM set to 'Required', it will leave the client system in an unprotected state since autoboot will be enabled with no protection of the disk encryption key.
prevent automatic booting when the disk moves system (UEFI only)	This prevents autoboot from functioning when a disk is moved between the systems.
Log on message	Type a message that appears to the client user.
Do not display previous user name at log on	Prevents the client system from automatically displaying the user name of the last logged on user on all Drive Encryption logon dialog boxes.
Enable on screen keyboard	Enables the Pre-Boot On-Screen Keyboard (OSK) and the associated Wacom serial pen driver. When this option is enabled, the pen driver finds supported pen hardware (Panasonic CF-H1 and Samsung Slate 7) and displays the OSK. Note If you do not select this option, the BIOS uses mouse emulation. In such a situation, the BIOS treats the digitizer as a standard mouse, which might lead to the cursor being out of sync with the stylus on USB-connected Wacom pen digitizers. Always display on screen keyboard — Forces the Pre-Boot to always display a clickable on-screen keyboard, whether the pen driver finds suitable hardware or not. Note When the option Enable on screen keyboard is turned on, if there is a serial digitizer device for which we have support on BIOS systems, then the OSK is displayed. Otherwise, on both BIOS and UEFI systems, if there is a requirement to display the OSK, then you must also select the option Always display on screen keyboard. This forces the OSK to be displayed without looking for any serial digitizer devices under BIOS.
Add local domain users (and tag with 'TDE:ALDU')	Disabled — Selecting this option does not add any local domain users to the client system. Add all previous and current local domain users of the system —Domain users who have previously and are currently logged on to the system can authenticate through the Pre-Boot, even if the administrator has not explicitly assigned the user to the client system. Only add currently logged on local domain user(s); activation is dependent on a successful user assignment — Only the domain users who are logged on to the current Windows session are added to the system and hence Drive Encryption is activated, even if the administrator has not explicitly assigned the user to the client system. Note If you select this option, at least one user should be added to the client system for a successful Drive Encryption activation on the client. The activation doesn't happen until a user logs on to Windows.
Enable accessibility	Select this option to sound a beep as a signal when the user moves the focus from one field to the next using mouse or keyboard in the Pre-Boot environment. This option is helpful to visually challenged users. The USB audio functionality allows visually impaired users to hear an audio signal (spoken word) as guidance when the user moves the cursor from one field to the next in the Pre-Boot environment. The USB speakers and headphones can be used to listen to the audio signal. For more details, see Enable Accessibility (USB audio devices) in the Pre-Boot environment.
Disable pre-boot authentication when not synchronized	Blocks a user from logging on to PBA in the client system, if the client system is not synchronized with the ePO - On-prem server for the set number of days. The user is blocked from logging on to PBA, and can then request the administrator to perform Administrator Recovery to unlock the client system. This allows the client system to boot and communicate with the ePO - On-prem server. Note The client system continues to block the user from logging on to the system until synchronization with ePO - On-prem.
Read username from smartcard	Automatically retrieves the available user information on the client system from the inserted smartcard; hence the Authentication window does not prompt for a user name. The user can then authenticate by typing the correct PIN. You need to enable the matching rules that are required for matching smartcard user principle name (UPN) names with Drive Encryption user names. Disable pre-boot authentication when not synchronized Match certificate user name field up to @ sign — Matches the certificate user name up to the @ sign of the user name. For example, if the UPN is SomeUser@SomeDomain.com and the Drive Encryption user name is SomeUser, a match is found. Hide user name during authentication — The Drive Encryption user name does not appear in the Authentication window. Note This feature is supported on the Gemalto .Net V2+ tokens, and PIV and CAC tokens.

Log On (Windows)

Option	Definition
V7.2 Onwards	Third-party credential providers: Allow integrated third-party credential providers to override the Drive Encryption credential provider — Enable this option to make sure that the Drive Encryption credential provider does not load and allow a compatible third-party credential provider to override the existing credential provider.
	Single sign-on (SSO): Provide a single sign-on experience for Drive Encryption users (SSO) — Enable this option to allow the user to log on to the system with a single authentication process. It allows automatic logon to the operating system once the user authenticates through the Pre-Boot Authentication page. Allow the capturing of smart card PINs for SSO replay — Enable this option to allow Drive Encryption to capture the smart card PIN for SSO.
	Password synchronization: Update the Drive Encryption user password to match the Windows user password (during Windows logon, or password changes) — Enable this option to synchronize the Drive Encryption password to match the Windows password when the Windows password is changed on the client system. For example, if users change their password on the client, the Drive Encryption password is also changed to the same value. Ignore Drive Encryption password rules and history when updating the Drive Encryption password — Enabling this option allows you to ignore Drive Encryption password rules and history when synchronizing the Drive Encryption password. Warning This may result in a reduction of password strength for Drive Encryption users. Periodically check domain credentials for changes and ask the user to re-capture the Drive Encryption password if required — Enabling this option allows you to periodically check the domain credentials for any changes and also inform the user to re-capture the Drive Encryption password, if required. Warning This will result in an increased load on the domain server that manages the endpoint. Polling interval (minutes) __ (5-480) — Enter the time in minutes within the set limit to periodically check the domain credentials for any changes.
	Preboot user options Allow user to cancel SSO and password synchronization — Enable this option to allow the user to cancel SSO and password synchronization.
	Windows username matching The Windows username must match the username of the Drive Encryption user before capturing SSO or synchronizing passwords — Ensures the SSO details are captured only when the user’s Drive Encryption and Windows user names match. This ensures that the SSO data captured is replayed for the user for which it was captured.
	Credential provider bitmap Do not display Trellix shield on Windows logon tiles — Enabling this option allows you to hide the Trellix shield on Windows logon titles.
Require Drive Encryption logon (only supported on V6 clients) — This requires you to mandatorily log on to PBA for EEPC 6.x.x systems, thereby disabling the SSO functionality. Require log on when token is removed — This requires you to mandatorily log on when the token is removed. Note This option is available for selection only if the Require Drive Encryption logon (only supported on V6 clients) option is enabled.
Lock workstation when inactive — The client system is locked when it is inactive for the set time.
Duplicate	Duplicates or copies the policy with a different name and this can be assigned to a different user.
Save	Saves the Product Settings Policy of Drive Encryption.
Cancel	Exits the current page.

:

Was this article helpful?