DC-B312

BitLocker Improvements in Windows 8 MBAM 2.0 Investment Areas and Key New Features Deploying MBAM 2.0MBAM 2.0 End User Experience

What is Microsoft BitLocker Administration and Monitoring? MBAM 1.0 objectives: MBAM 2.0 improved 1.0 functionality and adds additional focus on: “ We can use MBAM v1.0 to get greater value from BitLocker. We can ensure that BitLocker is enabled and that we are compliant with corporate encryption mandates without taxing our employees or IT staff.” Bob Johnson Director of IT, BT U.S. and Canada Improving compliance and security Integrating with existing systems ( e.g.: SCCM ) Reducing costs ( e.g.: Self Service, Simplified Deployment ) Simplify provisioning and deployment Provide reporting ( e.g.: compliance & audit ) Reduce costs ( e.g.: Simplified Recovery )

Configuration Manager Integration Compliance reporting integrated to CM environment Hardware compatibility & targeting via CM collections Offload MBAM client reporting workload to CM client Windows 8 Support Windows 8 Enterprise support Non-TPM / Windows To Go Support Bitlocker Pre-Provisioning support Self Service Information Worker able to retrieve Recovery Key via Portal Recovery Keys protected with Access Control Auditing of all Recovery Key access Customer Feedback More pre-req flexibility (TDE, SPNs, SQL Server) Improved encryption flow & Smarter compliance calculation Improved scalability and performance

Active Directory Domain Services & Group Policy Infrastructure GPO Recovery Web Service Reporting Web Service Web Services Audit & Compliance SQL Database Reporting Web Site SSRS Compliance Reports HelpDesk Portal Client Computer Self-service Portal Portals Self-service Web Service Recovery MBAM Client and BitLocker Admin Web Service Portals Web Services SQL Database Compliance Reports

Configuration Manager Active Directory Domain Services & Group Policy Infrastructure GPO Recovery Web Service Web Services Audit SQL Database Management Console SSRS HelpDesk Portal Client Computer Self-service Portal Portals Self-service Web Service Recovery MBAM Client and BitLocker Admin Web Service ConfigMgr Database Compliance ConfigMgr Agent

MBAM 2.0 improvements Server configurations recommended for 1.0 ranged from single to five server Performance and scalability improvements allows simpler configurations Improved performance: A 2 box set up with recommended specs can support a 200k+ environment without issues. MSIT is using that configuration for all Microsoft SQL Standard Support : TDE is not a requirement anymore so SQL Standard can be used Improved VSSWriter: New implementation supports backups without impacting availability

Hardware ComponentMinimum RequirementRecommended Requirement Processor2.33 GHz2.33 GHz or greater RAM8 GB12 GB Free disk space1 GB2 GB Hardware ComponentMinimum RequirementRecommended Requirement Processor2.33 GHz2.33 GHz or greater RAM8 GB12 GB Free disk space5 GB5 GB or greater 2-server standalone topology to support at least 200,000 clients: Web server: SQL Server: 3-server CM integrated topology to support at least 200,000 clients: Web server: SQL Server : Hardware ComponentMinimum RequirementRecommended Requirement Processor2.33 GHz2.33 GHz or greater RAM4 GB8 GB Free disk space5 GB5 GB or greater Hardware ComponentMinimum RequirementRecommended Requirement Processor2.33 GHz2.33 GHz or greater RAM4 GB8 GB Free disk space1 GB2 GB Hardware ComponentMinimum RequirementRecommended Requirement Processor2.33 GHz2.33 GHz or greater RAM4 GB8 GB Free disk space5 GB5 GB or greater One Box (standalone and CM) topology for Lab Testing only:

Two deployment modes available Stand Alone Configuration Manager Integrated Stand alone mode Similar to MBAM v1 model – SQL Server Database contains databases for Recovery Keys and Audit/Compliance Configuration manager integrated mode Compliance DB and Reporting are integrated to CM infrastructure Compliance information is reported via CM Agent/DCM Agent distribution is facilitated via out of the box collection Key Recovery and Audit DB remain in SQL similar to Stand Alone

Update Servers Uninstall server bits and keep databases Install new server bits pointing to existing databases For CM mode this includes importing MOF file and verifying that agent collection meets your environment Update group policy Choose protectors and related options using MBAM templates Define server locations, intervals and exemption policy Deploy new Agent For CM mode this includes deploying DCM Compliance will use 2.0 logic

Standard Users Can: Encrypt Computers Change PIN Change Passwords Control Panel Applet: PINs and Passwords Consider hiding original BitLocker Control Panel to make it difficult to: Decrypt devices Suspend encryption

Enhanced Compliance and Security MBAM prevents reuse of BitLocker recovery keys Recovery keys are marked for reset after they’re exposed Client periodically checks to see if key reset is required Recovery keys reset after client obtains network connectivity

Who and when recovery keys have been accessed and by whom? Need to know how effective your rollout is, or how compliant your company is? Need to know the last known state of a lost computer?

Complete your session evaluations today and enter to win prizes daily. Provide your feedback at a CommNet kiosk or log on at Upon submission you will receive instant notification if you have won a prize. Prize pickup is at the Information Desk located in Attendee Services in the Mandalay Bay Foyer. Entry details can be found on the MMS website.