Information

BitLocker Drive Encryption provides protection for operating system drives, fixed data drives, and removable data drives that are lost or stolen. BitLocker does this by encrypting the contents of drives and requiring users to authenticate their credentials to be able to access the information. Encrypting the entire Windows operating system drive on the hard disk encrypts all user files and system files on the OS drive, including the swap (page) files and hibernation files.

Applies to

RequirementDescription
Operating systemWindows 10
Hardware TPMTPM is not required for BitLocker; however, only a computer with a TPM can provide the additional security of pre-startup system integrity verification and multifactor authentication
BIOS firmwareBitLocker requires at least two NTFS disk partitions, one for the system drive and one for the operating system drive
UEFI firmwareBitLocker requires at least one FAT32 partition for the system drive and one NTFS partition for the operating system drive
Desktop Management Solution
System Center Configuration Management
ENGL Custom Deployment


In this example the base image has been created with a System and OS Partition using the Project Settings in Build Console.

Scenario

This TID details a scenario where a company would like the option to enable BitLocker during the build process using TPM+PIN.
To do this you will need to ensure that you have a Group Policy Object to allow a PIN to be set at startup. More information on configuring the GPO can be found here: https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings
The feature to encrypt used space only is used and the output is written directly to the ztoolkit.log.

By using this TID as a guideline it should be possible to modify the scenario to meet your own specific requirements.

Procedure

DoneTask
 
1.Update zim.cfg
 
2.Update Project files
 
3.Create and deploy new Ztoolkit image
 
4.Test


WARNING!Changes should be tested in a non-production environment and all files backed up before making any alterations.


  1. Update zim.cfg

    Update your zim.cfg by adding the lines shown in green.

    • Update information read in from EBD.
      ; Read EBD:Custom
      EBD:Get,Custom,EBDSTRING
      
      ; Read stored information in from EBD
      Set:Ebd_Project,GetKeyPairStringValue("%EBDSTRING%", "Project")
      Set:Ebd_bit_OS,GetKeyPairStringValue("%EBDSTRING%", "bit_OS")
      Set:Ebd_bit_PIN,GetKeyPairStringValue("%EBDSTRING%", "bit_PIN")
      
      ; ------------------------------------------------------
      ; Menu Definitions
      ; ------------------------------------------------------


    • Update the 'Detected Hardware' Zim form to allow you to choose whether or not to enable BitLocker
      Label:Ztoolkit_ComputerName_Form
      
      ; Launch a Form to display detected hardware and select machine type
      Form:Start,"Info","Hardware Detected","_OkCancel^_Ok",Blue
      Form:Item,"Item1",Label,"Manufacturer"
      Form:Item,"Item2",EditBox,"%Lookup_Section%",ReadOnly
      Form:Item,"Item3",Label,"Model"
      Form:Item,"Item4",EditBox,"%Lookup_Value%",ReadOnly
      Form:Item,"Item5",Label,"Hardware Image"
      Form:Item,"Item6",EditBox,"%Drivers_Image%",ReadOnly
      Form:Item,"Item7",Label,"Hardware Type"
      Form:Item,"Item8",EditBox,"%Machine_Type%",ReadOnly
      Form:Item,"Item9",Label,"OS"
      Form:Item,"Item10",EditBox,"%Project_OS%",ReadOnly
      Form:Item,"Item11",Label,"Computer Name"
      Form:Item,"Item12",EditBox,"%Ask_COMPUTERNAME%"
      Form:Item,"Encrypt1",Label,"Encrypt OS Partition:"
      Form:Item,"Encrypt2",Radiobuttons,"%Ebd_bit_OS%","No,Yes"
      Form:Item,"Encrypt3",Label,"Enter PIN:"
      Form:Item,"Encrypt4",EditBox,"%Ebd_bit_PIN%"
      Form:Item,"Item14",Label,"Auto Restart after imaging"
      Form:Item,"Item15",RadioButtons,"Yes","Yes,No"
      Form:Display,"Info"
      
      If:Var,_Form,EQ,"_Cancel"
      Menu:Return
      End:
      
      Set:Ask_COMPUTERNAME,"%_Info_Item12%"
      
      ; Validate bitlocker information
      Set:BitLocker_OS,%_Info_Encrypt2%
      Set:BitLocker_PIN,%_Info_Encrypt4%
      
      ; Configure the following variables to match Group Policy details
      Set:BitLocker_PIN_MinLength,"6"
      Set:BitLocker_PIN_MaxLength,"20"
      Set:BitLocker_PIN_Enhanced,"False"
      
      If:Var,BitLocker_OS,EQ,"Yes"
      ; We need to check the bitlocker pin is valid
      Set:PinLength,Len(%BitLocker_PIN%)
      
      If:Var,PinLength,lt,"%BitLocker_PIN_MinLength%"
      Dialog:ask,"Error","You must specify a Bitlocker Pin between %BitLocker_PIN_MinLength% and %BitLocker_PIN_MaxLength% characters","_ok",Red
      Goto:Ztoolkit_ComputerName_Form
      End:
      If:Var,PinLength,GT,"%BitLocker_PIN_MaxLength%"
       Dialog:ask,"Error","You must specify a Bitlocker Pin between %BitLocker_PIN_MinLength% and %BitLocker_PIN_MaxLength% characters","_ok",Red
      Goto:Ztoolkit_ComputerName_Form
      End:
      
      if:var,BitLocker_PIN_Enhanced,EQ,"False"
       ; The pin entered must be a number
      Set:PINCheck,%BitLocker_PIN%
      Set:PINCheck,Math("*", 1)
      Set:PINCheckLength,Len(%PINCheck%)
      If:Var,PINCheck,EQ,"0"
      Dialog:ask,"Error","You must specify a Numeric PIN","_ok",Red
      Goto:Ztoolkit_ComputerName_Form
      End:
      If:Var,PINCheckLength,NE,"%PinLength%"
      Dialog:ask,"Error","You must specify a Numeric PIN","_ok",Red
      Goto:Ztoolkit_ComputerName_Form
      End:
      End:
      End:
      


    • Update BitLocker information to EBD
      Dialog:Popup,"Restoring ENGL Smart Windows build process, please wait...",Green
      Pause:3
      
      ; Update EBDSTRING (sample)
      Set:EBDSTRING,PutKeyPairStringValue("%EBDSTRING%","Machine_Type","%Machine_Type%")
      Set:EBDSTRING,PutKeyPairStringValue("%EBDSTRING%","OS","%Project_OS%")
      Set:EBDSTRING,PutKeyPairStringValue("%EBDSTRING%","Project","%Lookup_Project%")
      Set:EBDSTRING,PutKeyPairStringValue("%EBDSTRING%","bit_OS","%BitLocker_OS%")
      Set:EBDSTRING,PutKeyPairStringValue("%EBDSTRING%","bit_PIN","%BitLocker_PIN%")
      
      


    • Save changes to zim.cfg
  2. Update Project files


    • Open the project in Build Console

    • Select Expert View

    • Select Customisation > Custom Files


    • Update phase2-after.vbs

      • Right click on phase2-after.vbs and select Edit

      • Add the lines shown in green

        '
        ' Custom script template (phase2-after.vbs)
        
        
        
        ' Attach to ENGL Ztoolkit ActiveX Control
        Set LDAP = CreateObject("ENGL.Ztoolkit.LDAP")
        Set Utils = CreateObject("ENGL.Ztoolkit.Utils")
        Set EBD = CreateObject("ENGL.Ztoolkit.EBD")
        Set SCCM = CreateObject("ENGL.Ztoolkit.SCCM")
        
        ' Add custom script here...
        
        'Get ENGL Build data
        EBDSTRING = EBD.Get("Custom")
        
        ' Separate strings
        ebd_bit_OS = Utils.GetKeyPairStringValue(EBDSTRING, "bit_OS")
        
        ' Check if ebd_bit_OS is set
        If (ebd_bit_OS = "Yes") then
        
        ' BitLocker needs to be enabled on this machine
        utils.appendlog "Enabling BitLocker Pre-Provisioning"
        utils.appendlog "Enabling BitLocker Pre-Provisioning on OS Partition"
        utils.run "%comspec% /c manage-bde -protectors -add C: -rp >> c:\ztoolkit\ztoolkit.log",0,true
        utils.appendlog "Starting Encryption of used space..."
        utils.run "%comspec% /c manage-bde -on C: -used -skiphardwaretest >> c:\ztoolkit\ztoolkit.log",0,true
        utils.run "%comspec% /c manage-bde -status >> c:\ztoolkit\ztoolkit.log",0,true
        else
        utils.appendlog "BitLocker Pre-Provisioning disabled!"
        end if


    • Update phase4-before.vbs

      • Right click on phase4-before.vbs and select Edit

      • Add the lines shown in green

        '
        ' Custom script template (phase4-before.vbs)
        
        
        ' Attach to ENGL Ztoolkit ActiveX Control
        Set LDAP = CreateObject("ENGL.Ztoolkit.LDAP")
        Set Utils = CreateObject("ENGL.Ztoolkit.Utils")
        Set EBD = CreateObject("ENGL.Ztoolkit.EBD")
        Set SCCM = CreateObject("ENGL.Ztoolkit.SCCM")
        
        
        ' Add custom script here...
        
        'Get ENGL Build data
        EBDSTRING = EBD.Get("Custom")
        
        ' Separate strings
        ebd_bit_OS = Utils.GetKeyPairStringValue(EBDSTRING, "bit_OS")
        ebd_bit_PIN = Utils.GetKeyPairStringValue(EBDSTRING, "bit_PIN")
        
        If (ebd_bit_OS = "Yes") then
        
        ' Bitlocker activation for normal image
        utils.appendlog "Activating BitLocker (ENGL Image)"
        utils.run "%comspec% /c manage-bde -protectors -add C: -tpmandpin " & ebd_Bit_PIN & " >> c:\ztoolkit\ztoolkit.log",0,true
        else
        utils.appendlog "BitLocker Activation not needed!"
        end if
        
        'Remove Environment variable ebd_bit_PIN
        Utils.SetSystemEnvironmentVariable "ebd_bit_PIN", ""
        
        'Remove bit_PIN from EBD
        EBDSTRING = Utils.PutKeyPairStringValue (EBDSTRING, "bit_PIN", "")
        EBD.Put "Custom",EBDSTRING
        EBD.Write


      • Save the changes to phase4-before.vbs

  3. Create and deploy new Ztoolkit image

    • Launch Build Console

    • Open the project

    • Run the Deployment Wizard

    • Select the option to create Build Process images

    • Select the option to create the Build Process (ztoolkit) image

    • Once complete, copy the new Ztoolkit image to the server

  4. Test

    To test everything is working do the following:

    • PXE boot a machine into Zim

    • Select the Restore menu

    • Select the project

    • Select Enable BitLocker

    • Continue to restore all images and allow the machine to build

    • Once the machine has built successfully check the following;

      • Ztoolkit.log file - this should contain Bitlocker information

      • Launch a command prompt and run manage-bde -status, this will give information on current status of the local partitions

      • Open Control Panel - launch BitLocker Drive Encryption will show similar information

  5. If there are issues with the process review both the zim.log and ztoolkit.log to troubleshoot the problem.
     For more information about the log files review ENGL TID-2013016


If you have any problems or questions about the steps in this TID please contact the ENGL support team