> Source: [sk95466](https://support.checkpoint.com/results/sk/sk95466)

# sk95466 - Legacy Token User upgrade from FDE EW to E80.x

| Property | Value |
|----------|-------|
| Solution ID | sk95466 |
| Date Created | 2013-10-15 |
| Last Modified | 2025-06-24 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | E89.X, E88.X |
| OS | Windows |

## Solution

Upgrade of FDE EW to E80.x where local token users are to be retained
=====================================================================

This article describes how to enable upgrade of token users and how the users will function.

*Enabling upgrade*
------------------

Upgrade of legacy token users to E80.x is enabled by setting a registry value "AllowTokenUpgrade" to non-zero in the Full Disk Encryption key. If the value does not exist or exists with a value of "0" (zero) no upgrade will take place.  

**The full registry setting on 64-bit machines to allow token upgrade:**

\[HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\CheckPoint\\EndPoint Security\\Full Disk Encryption\]

"AllowTokenUpgrade"=dword:00000001

**The full registry setting on 32-bit machines to allow token upgrade:**

\[HKEY_LOCAL_MACHINE\\SOFTWARE\\CheckPoint\\EndPoint Security\\Full Disk Encryption\]

"AllowTokenUpgrade"=dword:00000001

*Upgraded user behavior*
------------------------

### Remote Help and recovery

An upgraded legacy token user will not be sent back to the server and will stay local forever. Being a local user imposes the following limitations:

\<!--\[if !supportLists\]--\>- \<!--\[endif\]--\>No remote help to this user will be possible

\<!--\[if !supportLists\]--\>- \<!--\[endif\]--\>The user can't be assigned to other machines

\<!--\[if !supportLists\]--\>- \<!--\[endif\]--\>The user can't be assigned to recovery media

\<!--\[if !supportLists\]--\>- \<!--\[endif\]--\>The user can't be assigned any policies.

In order to alleviate the no remote help limitation it is suggested that a new user is created and this user is assigned one time login remote help permissions only. One time login is the only viable remote help option for token users since FDE is not able to change the token password/pin.

Moreover, allowing one time logon only removes the possibility of errors where the password of the user is changed and the new password gets synchronized with the server and, in turn, possibly other machines that have the same user assigned.

### Pre-boot and Single Sign On

To be able to Single Sign On a converted token user into Windows, after the upgrade, the following conditions apply:

\<!--\[if !supportLists\]--\>- \<!--\[endif\]--\>The legacy user must have SSO enabled

\<!--\[if !supportLists\]--\>- \<!--\[endif\]--\>There must exist a Windows user with the same user name as the legacy FDE user.

\<!--\[if !supportLists\]--\>o \<!--\[endif\]--\>The upgrade will attempt to lookup the Windows user to SSO into, first using the domain that the machine is part of. Secondly, a local user using the local machine name.

Pre-boot logon will require that the correct domain is selected in the UI. The domain name will be the one that the machine is part of, or if no domain, the local machine name.

### User Acquisition

Converted token users will be counted as acquired. This makes it possible to start enforcement immediately following an upgrade. If there is a need to acquire additional users this can be handled by policy setting in the SmartEndpoint Administration UI.

### Deleting local converted token users

In order to delete local converted token users there is a separate delete tool.

The delete tool can be downloaded here: [Local Token User Delete Tool](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=27998)

The delete tool can list or delete local converted token users. The tool requires that the delete operation be authenticated using an FDE *password* user that exist locally on the same machine. The tool requires that the Check Point Full Disk Encryption service is up and running.

Below are some examples of how to use the deletion tool.

#### Usage

C:\\\>delete_token_user.exe -h

Delete Legacy Token User Tool (Build: Aug 20 2013 10:11:15)

Options:

-h \[ --help \] Print help message

-v \[ --validation_user \] arg Validation user to authenticate towards

-l \[ --list \] List users

-d \[ --delete_user \] arg Delete user

-n \[ --no_confirm \] Do not prompt for confirm

#### List local converted token users

C:\\\>delete_token_user.exe -v administrator -l

Delete Legacy Token User Tool (Build: Aug 20 2013 10:11:15)

Enter password of validation user:

List of converted token users

user@domain

----------------------------------------

TOKEN1@fredrikg-w7-vm

USER2@eldo

#### Delete a user

C:\\\>delete_token_user.exe -v administrator -d token1@fredrikg-w7-vm

Delete Legacy Token User Tool (Build: Aug 20 2013 10:11:15)

Enter password of validation user:

Confirm delete of user TOKEN1@fredrikg-w7-vm (y/n): y

Deleted user TOKEN1@fredrikg-w7-vm

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content