1. BitLocker Enterprise Deployment
21/04/2017
BitLocker Enterprise Deployment
Steve Lamb
IT Pro Evangelist, Microsoft Ltd
SEC316 1

2. Objectives Session Objectives Key Takeaways
4/21/2017 5:17 AM
Objectives
Session Objectives
To better plan your large scale deployment within your enterprise
To outline implementation decisions to consider and advanced features
To learn about key alternatives where deployment challenges arise
Key Takeaways
Successful BitLocker deployment is facilitated by careful preparation
Several deployment methods are available to facilitate the process
© 2005 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

3. Agenda Deployment Planning Infrastructure Preparation
4/21/2017 5:17 AM
Agenda
Deployment Planning
Informal Audit
Develop Hardware strategy
Develop Recovery strategy
Infrastructure Preparation
Group Policy
Active Directory
BitLocker Deployment
Vista Deployment Tools
MICROSOFT CONFIDENTIAL
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. 21/04/2017
Deployment Planning
SEC316

5. BitLocker Requirements
21/04/2017
BitLocker Requirements
Trusted Platform Module Hardware
The system must have a Trusted Platform Module (TPM) v1.2
The hardware platform must be Windows Vista logo certified
Non-TPM Hardware
The system BIOS must support the USB Mass Storage Device Class including reading files on a USB flash drive in the pre-operating system environment.
Hard Disk Configuration: The computer must have at least two NTFS volumes:
Operating System (OS) volume (or boot volume) – This volume contains the Windows operating system and its support files
System volume – This volume contains the hardware-specific files that are needed to load Windows after the BIOS has booted the platform. For BitLocker to work, the system volume must not be encrypted, must differ from the operating system volume, and must be the active partition. Your system volume should be at least 1.5 GB
Authentication modes
TPM only
TPM and PIN
TPM and Startup Key (USB)
Startup Key (USB) only
SEC316

6. Understand Your Environment
21/04/2017
Understand Your Environment
Conduct an informal audit focusing on
Current and Future Hardware Platform Considerations
What laptop/desktop platforms are in use?
On the non-TPM platforms, does the BIOS support reading of USB devices in the pre-OS environment?
Current Security Policies
Are there policies to address what computers will and will not use BitLocker?
What policies exist to control who in the organization has access to recovery data?
What policies exist to control recovery password and recovery key storage?
Current IT Department Structure
What part of your organization sets the standards for purchasing new computers?
Who in the organization builds and configures computers?
Current System Build Processes
Are computers shipped to you pre-configured from the OEM with a corporate build?
What tools and methods do you currently use for deployment?
Is there any user interaction during the deployment process?
Impact on Current Systems Management Tools
Do you reboot user computers without the user present?
SEC316

7. Evaluate Your Requirements
21/04/2017
Evaluate Your Requirements
Evaluate BitLocker Authentication Modes
Computers without TPM 1.2? What multifactor auth you require?
What areas of your organization need a baseline vs a more secure level of data protection?
Create a BitLocker Support Matrix
Computer or role-based groupings: what machines/platforms are supported for which auth methods?
Define Recovery Password and Key Management Policies
E.g. Always require backup of recovery passwords to Active Directory Domain Services.
FIPS mode?
Define Hardware Implementation Standards
TPM vs non-TPM configs (USB device service life, etc.)
OEM-specific requirements: tools provided for TPM management automation, EK-Credential generation, boot order, TPM enabled/disabled in BIOS, etc.
Define Support Processes
Document what recovery material is created by BitLocker and where it is stored
Determine who in your organization will have access BitLocker recovery material
Develop processes for remote and local recovery
Other
Inventory and tracking processes: track your BDE-enabled computers
User security privileges
Computer Retirement Process
SEC316

8. Develop a Hardware Strategy
21/04/2017
Develop a Hardware Strategy
Determine what platforms will use a TPM device
Will platforms without TPM devices be used?
Ensure TPMs can me easily deployed
What is the OEM default shipping state of the TPM?
Does the OEM require a BIOS password to use TPM?
Where is the Endorsement Key generated?
Ensure your hardware has the correct BIOS 
SEC316

9. Develop a Recovery Strategy
21/04/2017
Develop a Recovery Strategy
Define the process end-users will follow when recovery of a BitLocker system is needed
Anticipate the recovery scenarios:
How to handle lost or forgotten Key Protectors?
Reset PIN, Lost startup key
How are disk drive failures recovered?
How are TPM hardware failures treated?
Recover from core files or pre-OS file (BIOS upgrade, etc…) updates which are not planned
Recovering and diagnosing a deliberate attack
Modified or missing pre-OS files (Hacked BIOS, MBR, etc…)
SEC316

10. Recovery Key Points Recovery Keys: store the USB drives securely
21/04/2017
Recovery Key Points
Recovery Keys: store the USB drives securely
Recovery Passwords: store in AD
You need either Computer Name, Drive Label or Password ID to find recovery password for a machine
Presented on the recovery screen
Only recovery passwords are escrowed to AD (not recovery keys)
Recovery password escrow is only done upon creation and cannot be re-escrowed
Managing recovery passwords and keys can be done using WMI
By default, only domain admins can view recovery objects although you can delegate the permissions
SEC316

11. WinRE Set of tools for troubleshooting startup problems
21/04/2017
WinRE
Set of tools for troubleshooting startup problems
Contains the necessary drivers and tools to unlock a BDE-protected volume
WinRE boot image needs to reside on a non-encrypted volume
WinRE can share same partition with the System Volume and it must be type 0x7
In WinRE environment, you will be prompted for recovery credential on a BitLocker-enabled machine
SEC316

12. Disk Configuration Partitioning guidelines:
21/04/2017
Disk Configuration
Partitioning guidelines:
Disk Configuration
Partition 1
Partition 2
Partitions 3
Windows RE and BitLocker separate partitions
BitLocker
Type 0x7
1.5GB (Active)
Windows RE
Type 0x27
1GB
Windows Vista
Windows RE and BitLocker on same partition
Windows RE/BitLocker
Not needed
SEC316

13. Infrastructure Preparation
21/04/2017
Infrastructure Preparation
SEC316

14. Group Policy Preparation
4/21/2017 5:17 AM
BitLocker Group Policy settings allow you to:
Turn on BitLocker backup to Active Directory Domain Services
Control Panel Setup: enable advanced startup options, recovery options, configure recovery folder, etc.
Configure encryption method
Configure TPM platform validation profile
 TPM Services Group Policy settings allow you to:
Turn on TPM backup to Active Directory Domain Services
Configure the list of blocked TPM commands
Key Points
GP settings can tweak Control Panel UI experience for BitLocker setup
Note that you can also use GP to
Enable FIPS compliance
FIPS GP needs to be turned on before setting up BDE keys!
Hide drive letter in UI for system partition
Document Reference
- KB article: Using Group Policy Objects to hide specified drives (
MICROSOFT CONFIDENTIAL
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

15. Active Directory Preparation
4/21/2017 5:17 AM
Active Directory Preparation
By default, no recovery information is backed up to Active Directory
Admins can configure Group Policy settings to enable backup of BitLocker or TPM recovery info
Ensure schema has been extended with the necessary storage locations and that access permissions have been granted to perform the backup
All domain controllers in the domain must be at least Windows Server 2003 SP1
If you have a Windows Longhorn Server Beta 3 and above domain controller in your environment, the schema extensions are already in place and no update is needed
The account that is updating the schema should be a member of the Schema Admins group to have the proper credentials
Recovery data saved for each computer object:
Recovery passwords - A 48-digit recovery password
Key package data - With this key package and the recovery password you will be able decrypt portions of a BitLocker-protected volume if the disk is severely damaged
MICROSOFT CONFIDENTIAL
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. There is only one TPM owner password per computer
21/04/2017
Key Points
There is only one TPM owner password per computer
There can be more than one recovery password per computer
The name of the recovery object incorporates GUID as well as date and time. If a computer has multiple recovery passwords, use the date and time to find the most recent object
Document Reference
Configuring Active Directory to Back up Windows BDE and TPM Recovery Information (
SEC316

17. Determine Your Config Options
21/04/2017
Determine Your Config Options
Pre-build configuration (Could be a service provided by the OEM)
You may choose to make BIOS setting changes to enable and activate the TPM, meet the physical presence requirement, and set BIOS passwords
Configuration during build process
You may choose to enable & configure BitLocker
Enabling and activating a TPM during this process will require user interaction to meet the physical presence requirement
If you require backup of recovery info to your Active Directory, BDE must be enabled after the computer has joined your AD domain
SEC316

18. Config Options (cont'd)
21/04/2017
Config Options (cont'd)
If you are starting encryption during the build process be aware of the impact to system performance especially if there are additional tasks to be performed on the machines such as installation of applications etc….
Consider starting encryption at the very end of the build process.
Post-build configuration
This configuration process might occur immediately after the system build process completes or at a later time after the computer is delivered to the end user
Using another software distribution tool, group policy scripting, or logon scripts
Very flexible and can be accomplished using numerous methods.
SEC316

19. User initiated configuration
21/04/2017
User initiated configuration
You may choose to provide BitLocker as a service to individual internal organizations or to the end users themselves
Could allow users to selectively enroll and configure their machines to use BitLocker
SEC316

20. Configuration Methods
21/04/2017
Configuration Methods
manage-bde.wsf command-line tool
Tool designed for one off configuration of individual BitLocker machines, or administration once BitLocker is enabled in the environment
Located on BitLocker capable Windows Vista platforms in the following location: %systemdrive%\Windows\system32
Recommendation:
Use this deployment method for small scale deployments of 25 computers or less
SEC316

21. WMI Scripting for BDE Config
21/04/2017
Enable and activate TPM, take ownership and generate random owner password
Enable BitLocker protection using
TPM only
TPM and PIN
TPM and Startup Key
USB only
Create additional recovery key and of recovery password
Specify specific encryption method
Reset TPM owner information
Create SMS status MIF
Key points
Use and modify existing sample script
Scripts can generate a rich log file that can be reviewed for status. WMI specific exit codes are logged
Microsoft recommends
Using BitLocker and TPM WMI providers for enterprise deployment
Using manage-bde for administration of BitLocker enabled machines
Document Reference
- BitLocker Drive Encryption-WMI script.zip (
SEC316

22. 21/04/2017
Deployment
SEC316

23. Vista Deployment Tools
21/04/2017
Vista Deployment Tools
Deploying BitLocker ready machines with the following deployment tools:
Windows Deployment Services (WDS)
Unattended Installation
Imaging with ImageX
SMS 2003 OSD
BDD 2007
SEC316

24. Use scripts with BitLocker and TPM WMI providers
21/04/2017
Use scripts with BitLocker and TPM WMI providers
Useful when integrating support of BitLocker machines into your help desk environment, or user initiated configuration type of deployment
Recommendation:
Use this deployment method for large enterprise deployments
SEC316

25. 4/21/2017 5:17 AM
WDS
Build reference configuration on a single partition machine
Sysprep machine and capture image using the ImageX
Create WDS client unattend file
Specify drive configuration to BitLocker requirements
Create image unattend file with any optional settings for BDE config
Add automation scripts for enabling and configuring BDE post-install
Upload images and configure unattend files on WDS server
Deploy Vista (net-boot the target computer) & enable BDE with method of choice
Key Points
WDS client unattend files are applied per server and per architecture (i.e. x86, amd64, ia64)
Disk layout and partitioning can only be done in WDS client unattend file not image unattend files
MICROSOFT CONFIDENTIAL
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

26. Unattend Installation
Build reference configuration on a single partition machine
Sysprep machine and capture image using the ImageX
Create unattend answer file with any additional settings
Specify drive configuration to BitLocker requirements
Add automation scripts for enabling and configuring BDE post-install
Create bootable DVD
Deploy Vista (DVD-boot the target computer) & enable BDE with method of choice
Key Points
Very straight forward build process with the least complications
Vista setup requires RW access to image file during expansion - consider not storing WIM on CD or DVD where possible to improve speed
Setup has to copy the entire install.wim to the local disk and then expand the contents 26

27. 21/04/2017
Imaging using ImageX
Build reference configuration on a correctly partitioned machine
Create unattend answer file with any additional settings
Add automation scripts for enabling and configuring BDE post-install
Sysprep machine and capture both SYSTEM and OS partitions using ImageX
Create bootable DVD
Deploy Vista (DVD-boot the target computer in WinPE) & enable BDE with method of choice
Configure the disk with Diskpart
Apply SYSTEM and OS partition images to the appropriate partitions on target machine
Use a script to establish correct drive letter references
SEC316

28. Key Points Drive letters need to be adjusted after images are applied
21/04/2017
Key Points
Drive letters need to be adjusted after images are applied
Preparing the initial reference image is slightly more complex with multiple partitions
You can build one DVD ISO that does all the partitioning, installation, and drive letter fixing automatically
SEC316

29. SMS 2003 OSD
Build reference configuration on a single partition machine
Sysprep machine and capture image using standard OSD process
Configure SMS to distribute the image however is required
Configure pre-installation task to create single partition 1.5GB smaller than the total drive size (optional)
Use the BitLocker Drive Preparation Tool to convert one partition machine to two partition machine ready for BitLocker
Enable BitLocker with method of choice
Key Points
SMS 2003 OSD doesn’t support multiple partition deployments
The Drive Preparation Tool only runs in Vista and will be released as part of OS OOB tools
BitLocker deployment is fully integrated with SCCM 2007 29

30. 21/04/2017
BDD 2007
The Microsoft Solution Accelerator for Business Desktop Deployment (BDD)
Provides the guidance/best practice and tools required to efficiently manage the deployment of Microsoft Windows Vista and the 2007 Microsoft Office system
BDD 2007 integration with BitLocker
BitLocker Drive EncryptionTM support for Lite Touch Install scenarios
Integrates with the Drive Preparation Tool via a self-updating mechanism built into the solution
UI dialogs that let you choose configuration settings like where on the network to save .TXT files containing BitLocker recovery passwords
Document reference
SEC316

31. Other BitLocker Tools BitLocker Drive Preparation Tool
21/04/2017
Other BitLocker Tools
BitLocker Drive Preparation Tool
Correctly partitions an existing Vista installation for BitLocker without reimaging
Automatically repartitions any existing MBR partition layout through the Wizard
Scriptable command line interface allows for customized deployment
Allows an admin to remotely configure systems
Event log support enables full auditing of tool operation
Available as an Ultimate “extra” to Enterprise customers
SEC316

32. Other BitLocker Tools (cont'd)
21/04/2017
Other BitLocker Tools (cont'd)
BitLocker Recovery Password Viewer for Active Directory
Allows to locate and view recovery passwords that are stored in AD
You can use this tool to help recover data that is stored on a volume that has been encrypted by using BitLocker
Extension for the AD Users and Computers MMC snap-in
After you install this tool, you can examine a computer object's Properties dialog box to view the corresponding BitLocker recovery passwords
Additionally, you can right-click a domain container and then search for a BitLocker recovery password across all the domains in the Active Directory forest
BitLocker Repair Tool
Helps recover data from an encrypted volume in Windows Vista if the hard disk has been severely damaged
This tool can reconstruct critical parts of the drive and salvage recoverable data
Uses the recovery package escrowed in AD
A recovery password or recovery key is required to decrypt the data
SEC316

33. What is IT Pro Momentum? A program to recruit early adopters
MGB 2005
4/21/2017 5:17 AM
What is IT Pro Momentum?
A program to recruit early adopters
Provides you with free support and training
Share your story and influence the next wave of early adopters
Rewards you with a free TechNet Direct subscription
©2005 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

34. MGB 2005
4/21/2017 5:17 AM
More information?
For more information on the IT Pro Momentum Program or to nominate someone
Steve Lamb
©2005 Microsoft Corporation. All rights reserved.
This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

35. 21/04/2017
Q&A
SEC316

36. 4/21/2017 5:17 AM
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
MICROSOFT CONFIDENTIAL
© 2006 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.