Bitlocker deployment and reporting.

… the Altiris way, however, the concept would be pretty much the same for any other CMS systems. I’m currently working on such project so I decided to write down the entire process here onto my notepad (who knows, maybe there’s someone out there in the intertubes that is now sitting and scratching his head thinking where to start with Altiris Bitlocker depoloyment?)

First things first, what do we need ?

1. We need to make sure our machines have TPM chip as what we’re going to do is to enable and activate it using simple script, then take ownership of it by securing it with the password. This will allow us to start encryption.
I am aware there are ways to enable Bitlocker without TPM, but its not the case here. If you want to find out more about it, google it.

2. You need to have a GPO configured to use Bitlocker and applied to computers prior to do any of the bellow tasks.

3. Once the GPO is configured and applied, the following command sequence must be run on the destination computers:

–  manage-bde.exe -tpm -turnon – this command enables and activates TPM chip

Reboot – you need to restart PC and confirm configuration change by pressing F1 at boot.

– manage-bde -tpm -o yourtpmpasswordhere – this command takes TPM ownership

– manage-bde -on c: -rp -em aes256 – assuming we’re encrypting C: with aes256

4. Now, as a side note, whats the easiest way to check if the first command worked and the TPM is enabled and activated (assuming you want to check this remotely) . Use WMI. You can do so directly from WMI console or by command prompt by addming wmic.exe before the command.

– To check if TPM is enabled: /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get IsEnabled_InitialValue

– To check if TPM is activated: /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get IsActivated_InitialValue

5. Creating Software Packages with simple .bat scripts that will execute above commands. Software Packages must be set within the Managed Software Delivery Policy in the exact order listed above (3.)

TPM enable and activate – also creates “Bitlocker” folder on systemdrive and the .txt files, that you can use for detection rules. If you prefer more fancy way, you can play with vbs detection rules, but honestly, there’s no need to do so.

md "C:\Windows\System32\Bitlocker"
echo.>"C:\Windows\System32\Bitlocker\TPMenabled.txt"
Manage-bde.exe -tpm -turnon

REBOOT! – You must reboot PC at this point and get user to press F1!

echo.>"C:\Windows\System32\Bitlocker\TPMownershipset.txt"
manage-bde -tpm -o yourpasswordhere
echo.>"C:\Windows\System32\Bitlocker\encryptionstarted.txt"
manage-bde -on c: -rp -em aes256

Bellow notification popup will appear on user’s screen :

 

6. Reporting:

6.1 – Creating Custom Data Classes in Altiris.

Altiris Console: Settings\All settings\Discovery and Inventory\Inventory Solution\Manage Custom Data Classes

Add new Data Classes:
Expanded Bitlocker Status – this will collect encryption status info such as conversion status, percentage encrypted, encryption method etc.
Bitlocker Recovery info – encrypted drive letter and your recovery ID
TPM Status – TPM status.

Add bellow attributes for each:

 

 


6.2 Create Custom Tasks:

Altiris Console: \Manage\Jobs / Tasks\Samples\Discovery and Inventory\Inventory Samples\Custom

Clone Custom Inventory – Processor and create the following:

Custom Inventory – Bitlocker Status

Script type: VBScript – copy and paste bellow script then Save changes

NOTE: Altiris 7.6 likes data class name more than GUID as the previours Altiris versions so its recommended to use data class name in the script!

'Following is a sample custom inventory script gathering information about processor of a machine and posting data
'to NS using Altiris NSE Component
'===================================================================================================================
'      On Error Resume Next

'Create instance of Wbem service object and connect to namespace
strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root/CIMv2/Security/MicrosoftVolumeEncryption")

'Fire WMI Query
Set objCIMObj = objWMIService.ExecQuery("select * from Win32_EncryptableVolume",,48)
'Set objCIMObj = objWMIService.ExecQuery("Select * from Win32_EncryptableVolume " & "Where DriveLetter = 'C:'")

'===================================================================================================================

'Create instance of Altiris NSE component
dim nse
set nse = WScript.CreateObject ("Altiris.AeXNSEvent")

' Set the header data of the NSE
' Please don't modify this GUID
nse.To = "{1592B913-72F3-4C36-91D2-D4EDA21D2F96}"
nse.Priority = 1

'Create Inventory data block. Here assumption is that the data class with below guid is already configured on server
dim objDCInstance
set objDCInstance = nse.AddDataClass ("Expanded Bitlocker Status")

dim objDataClass
set objDataClass = nse.AddDataBlock (objDCInstance)

Dim arEncryptionMethod

arEncryptionMethod = Array("None", "AES 128 With Diffuser", "AES 256 With Diffuser", "AES 128", "AES 256")

Dim arProtectionStatus

arProtectionStatus = Array("Protection Off", "Protection On", "Protection Unknown")

Dim arConversionStatus

arConversionStatus = Array("Fully Decrypted", "Fully Encrypted", "Encryption In Progress", "Decryption In Progress", "Encryption Paused", "Decryption Paused")

Dim arLockStatus

arLockStatus = Array("Unlocked", "Locked")

'For each objInfo in objCIMObj
For Each objItem in objCIMObj

 Dim EncryptionMethod

 Dim ProtectionStatus

 Dim ConversionStatus

 Dim EncryptionPercentage 'Percentage of the volume that is encrypted

 Dim VolumeKeyProtectorID

 Dim LockStatus

 objItem.GetEncryptionMethod EncryptionMethod
 objItem.GetProtectionStatus ProtectionStatus
 objItem.GetConversionStatus ConversionStatus, EncryptionPercentage
 objItem.GetKeyProtectors 0,VolumeKeyProtectorID
 objItem.GetLockStatus LockStatus

 'Add a new row
dim objDataRow
set objDataRow = objDataClass.AddRow
'Set columns
objDataRow.SetField 0, objItem.DeviceID
objDataRow.SetField 1, objItem.DriveLetter
objDataRow.SetField 2, arEncryptionMethod(EncryptionMethod)
objDataRow.SetField 3, arProtectionStatus(ProtectionStatus)
objDataRow.SetField 4, arConversionStatus(ConversionStatus)
objDataRow.SetField 5, EncryptionPercentage & "%"
objDataRow.SetField 6, arLockStatus(LockStatus)
Next

nse.SendQueued

– Custom Inventory – Bitlocker Recovery Info

Script type: VBScript – copy and paste bellow

strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root/CIMv2/Security/MicrosoftVolumeEncryption")

Set objCIMObj = objWMIService.ExecQuery("select * from Win32_EncryptableVolume",,48)
'Set objCIMObj = objWMIService.ExecQuery("Select * from Win32_EncryptableVolume " & "Where DriveLetter = C:'")

dim nse
set nse = WScript.CreateObject ("Altiris.AeXNSEvent")

nse.To = "{1592B913-72F3-4C36-91D2-D4EDA21D2F96}"
nse.Priority = 1

dim objDCInstance
set objDCInstance = nse.AddDataClass ("Bitlocker Recovery Info")

dim objDataClass
set objDataClass = nse.AddDataBlock (objDCInstance)

For Each objItem in objCIMObj

Set oShell = WScript.CreateObject("WSCript.shell")
oShell.run"cmd /K manage-bde -protectors -get """ &objitem.driveletter& """ >C:\keys.txt & exit",0,True

'Const ForReading = 1

Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objFile = objFSO.OpenTextFile("C:\keys.txt", 1)

Do Until objFile.AtEndOfStream
    strNextLine = objFile.ReadLine
    If Len(strNextLine) > 0 Then
        strLine = strNextLine
    End If
Loop

objFile.Close

'Wscript.Echo strLine

dim objDataRow
set objDataRow = objDataClass.AddRow

objDataRow.SetField 0, objItem.DriveLetter
objDataRow.SetField 1, strLine
Next

oShell.run"cmd /K del c:\keys.txt & exit",0,True

nse.SendQueued

– Custom Inventory – TPM Status

Script type: VBScript – copy and paste bellow script then Save changes

'------------------------------------------------------------------------------------

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\CIMV2\Security\MicrosoftTpm")
Set colItems = objWMIService.ExecQuery("SELECT * FROM Win32_Tpm", "WQL", _
                                        wbemFlagReturnImmediately + wbemFlagForwardOnly)

'============================================
'Create instance of Altiris NSE component
dim nse
set nse = WScript.CreateObject ("Altiris.AeXNSEvent")
nse.To = "{1592B913-72F3-4C36-91D2-D4EDA21D2F96}"
nse.Priority = 1

dim objDCInstance
'my custom data class
set objDCInstance = nse.AddDataClass ("TPM Status")

dim objDataClass
set objDataClass = nse.AddDataBlock (objDCInstance)

For each objInfo in colItems 'script crash here because invalid data

dim objDataRow
set objDataRow = objDataClass.AddRow

objDataRow.SetField 0, objInfo.IsActivated_InitialValue
objDataRow.SetField 1, objInfo.IsEnabled_InitialValue
objDataRow.SetField 2, objInfo.IsOwned_InitialValue
objDataRow.SetField 3, objInfo.ManufacturerId
objDataRow.SetField 4, objInfo.ManufacturerVersion
objDataRow.SetField 5, objInfo.ManufacturerVersionInfo
objDataRow.SetField 6, objInfo.PhysicalPresenceVersionInfo
objDataRow.SetField 7, objInfo.SpecVersion

Next
nse.SendQueued

'---------------------------------------------------------------------------

Now, you can “Quick run” the task on any machine you want, or you can specify a filter then apply the task to it – this will create new custom inventory  for each computer with all the data you’re collecting:

Altiris console: \Computers\All Computers\ – search for computer you’d like to check, right click and select Resource Manager. Go to “View”, “Inventory” then expand “Data Classes”\”Inventory”\”Custom” and tour class is there with all the info.
6.3 Create Bitlocker report

Altiris Console: \Reports\All Reports\ – New Report\Computer report

Yo need to show Altiris where to look at. Go to “Fields” and add the following:

Save Changes and run report.

7. Creating Dynamic Deployment filter that will include all laptops

Lets say we want to deploy it to all laptops as well as any new build laptop will also receive the policy. We need dynamic filter for this that will identify machines by chassis type (here are all values listed – you can compose an SQL query based on that). The one bellow searches for machines thata 9 – Are laptop, 10 – are notebook, 12 – has docking station

Create new filter and select Filter definition: Query Mode: Raw SQL

SELECT DISTINCT

ch._ResourceGuid

FROM

Inv_HW_Chassis ch

WHERE

ch.[Chassis Package Type] = '8'
OR ch.[Chassis Package Type] = '9'
OR ch.[Chassis Package Type] = '10'
OR ch.[Chassis Package Type] = '12'

 

Leave a Reply