/build/static/layout/Breadcrumb_cap_w.png

Blog Posts by Timokirch

Ask a question

KACE SMA | Bitlocker

04/25/2019 added a compatibility matrix.

03/29/2019 added some modifications. Thanks to Andrew Lubchansky for helping me creating this.



OS Common Name
Build Version
Compatible
1507 (RTM) Pro & Ent
10240
No
1511 Pro & Ent
10586
No
1607 Pro & Ent
14393
No
1703 Pro & Ent
15063
No
1709 Pro & Ent
16299
Yes
1803 Pro  & Ent
17134
Yes
1809 Pro & Ent
17763
Yes

Feel free to check your support status of Windows 10 with this report: https://www.itninja.com/blog/view/kace-sma-windows-10-end-of-life-report


Hi all,

 

It’s a long time since I have posted a blog here. Today I want to share with you my KITLOCKER (KACE & Bitlocker ;) ) stuff. In this article you can download several individual KACE-packages. You can download all of them here:  DOWNLOAD

If you need assistance in importing these files to your KACE SMA feel free to contact your local partner, your local sales rep or have a look to this KB article: https://support.quest.com/kace-systems-management-appliance/kb/116949/how-to-import-and-export-resources

 

First: These scripts are Win10 only and tested with x64 1809 Pro and Ent. Also, you need to have an TPM Module in your devices which needs to be activated and the OS needs to be the owner (default in Win10)! You can double check this in your KACE SMA device inventory:

bitlocker_00.png

 

My scenario is that Win10 devices should use Bitlocker with Aes256 bit to secure the hard disk. The disk should be automatically unlocked by TPM during boot (no password needed). If something went wrong or the hardware has changed there should be a recovery key which can be entered. This key should be stored in KACE SMA and not in AD. Also, there should be no GPO involved.

 

The Bitlocker information in your device inventory should look like this if there is currently nothing set up on your device:

bitlocker_01.png

 

To start we should first create a smart label which groups all devices where a TPM module is ready for the use with Bitlocker and no encryption technology is used. You can download the ready to use KACE-package here: DOWNLOAD

 

TPM Based Bitlocker Ready

bitlocker_02.png


Of course, you could add a filter like “OS Name” contains “Windows 10” (or any other filter which matches your environment) to make sure that only your clients will get Bitlocker enabled.

 

KACE SMA will now put all the devices where we can enable Bitlocker into this Label. There is a simple PowerShell command which will enable Bitlocker and start the encryption. Also it will add a recovery password as a key protector which will be needed in case of hardware changes. You can run this by a daily schedule and all devices which already have Bitlocker enabled will not be affected if you use the “TPM Based Bitlocker Ready” smart label which I have shown above. You can download a ready to use KACE-Script here: DOWNLOAD

 

[TW] Bitlocker enable TPM  & Password

Enable-BitLocker -MountPoint $env:SystemDrive -EncryptionMethod Aes256 -TpmProtector -SkipHardwareTest
sleep -Seconds 15
Add-BitLockerKeyProtector -MountPoint $env:SystemDrive -RecoveryPasswordProtector

This will start the encryption process of the C: drive. The user can’t abort it and it will also survive reboots.

bitlocker_03.png

 

You can also check the actual state in your KACE SMA device inventory:


 

If the encryption has been completed by the device, it will automatically fall out of the “TPM Based Bitlocker Ready” smart label. Now we have a secured hard disk which will be automatically unlocked during the bootup by the TPM module. Now we need a custom inventory to store all the key protector information’s in our SMA device inventory. This can be done with a simple custom inventory rule. You can download the ready to use KACE-package here: DOWNLOAD

 

Inventory: Bitlocker Recovery

Get-BitLockerVolume).KeyProtector


Good to know is that devices which need the recovery key will display a screen where users can see the ID of the numerical password. If they call your helpdesk team and don’t know which computer it is they can give you the ID and you can search for it in your KACE SMA device inventory or build a report for that.


 bitlocker_08.png

 

If you want to be sure that clients will always have a recovery password as a key protector you can additionally create a smart label. This will check the right key protectors after every inventory of the device. This could be used for running a script which will then add a recovery password as a key protector. This could be useful if admins change configurations local on the endpoints. The smart label can be downloaded here: DOWNLOAD


Bitlocker missing Protector


All clients which fall into this label can then run the following KACE script on a daily schedule. You can download the script here: DOWNLOAD


[TW] Bitlocker add protector

Add-BitLockerKeyProtector -MountPoint $env:SystemDrive -RecoveryPasswordProtector


This is the basic setup you can use to manage your hard disk encryption for your endpoints. You can think about creating notification which will alert you if a device has Bitlocker missing or a wrong configuration. I hope that this article helps you, creating your own KITLOCKER strategy. If there is anything unclear feel free to use the comment section.

 

Kind Regards

Timo

 

View comments (5)

SDA (K2000) - Hide PopUps during deployment

Hi all,

me again with a little add-on for the SDA. Recently i had the request to hide every popup like Dos-Boxes or PowerShell-Windows during the system deployment. For a better understanding here is a picture of my task :)

focus001.png





  




 As you can see the popup is blocking the view to the task list and the progress bar.








I've created a little tool which will run as a pre- & post install task. It will set the focus to the deployment window every second. So every script, application or whatever will switch to the background and you will always have the clean status page in front of you and your customers. Of course you need to duplicate the task and run it again after a restart in your post-install routine.

If there is an error in your deployment and the error page appears the script will pause. So you can work with notepad / cmd or whatever until you resume your task execution. You can manually pause the script with the key combination mentioned in the task description (you'll see it after an import to your SDA).

The tool is delivered as it is and has no support - questions will be answered here.

Download here: Download
Be the first to comment

SDA (K2000) - Windows 10 MUI Installation

Hi Guys,

i recently created a little PS-Script which will help you if you need to deploy an MUI version of Windows 10.
My scenario:
  • deploy Windows 10 1803 x64 in US-English
  • depending on the hostname: Install a language pack and set the default locales.
    • hostname starts with "US" then do nothing
    • hostname starts with "DE" then target language & keyboard layout German
    • hostname starts with "FR" then target language & keyboard layout French
    • hostname starts with "NL" then target language & keyboard layout Dutch

The solution can be found here: Download

The Post-Install task can be imported easily to your SDA but needs some modification on your site. For legal reasons i removed the language packs from the specific folder. Feel free to add and change the needed files / folder / whatever. Remember that every Windows 10 Build got his own language packs.

If you want to remove the en-US Keyboard then add the following line to the XML files:
<gs:InputLanguageID Action="remove" ID="0409:00000409"/>

The script is delivered as it is and has no support. If you have any questions feel free to ask here on ITNinja.

Helpful links:
Inputprofiles: Link
GeoIDs: Link


Be the first to comment

KACE SMA (K1000) | Spectre & Meltdown Analysis

01/09/2018 update: added a Report and another CIR.
01/12/2018 update: updated the script to use the current script version of today (1.0.4)  > Download
                                Scriptchangelog from Microsoft:
                                        Added message directing users to explanation of output
                                        Addressed feedback regarding multiple CPUs when setting $cpu 
02/02/2018 update: corrected & updated the vulnerable report. Added a new report with secured devices.
                                Vulnerable Report: Download
                                Secured Report: Downlaod

For an official statement from quest please visit: https://support.quest.com/kb/237193

Hi all, 

here a quick blog to check the hardware vulnarabilities CVE-2017-5715, CVE-2017-5753, CVE-2017-5754 or better known as Spectre and Meltdown.
I am using the Microsoft security guidance ADV180002 as base script with KACE modifications. 

The outcome of this blog will be that you can easily see, filter, report and label all your Windows clients higher than Windows 7 SP1 or Server 2012 R2 which are vulnerable or secure against Spectre and / or Meltdown. To archive this we first need a script. 

The script looks like this and can be downloaded here
If you need assistance to import it to your KACE SMA (K1000) please feel free to contact me. 
cpu01.png

The script will create the logfile: "C:\Windows\Logs\KACE_CPU_Check.log" and rewrite it every time. 

To have the posibility to search, label and report these data we need a CustomInventoryRule.
Here you have a screenshot and can find the export as a download here.
cpu02.png
ShellCommandTextReturn(cmd /c type ""C:\Windows\Logs\KACE_CPU_Check.log"")

After that you should be able to filter everything like you know to do it. 
Enabled protections appear in the output as "true".

Example for filtering for vulnerable devices:
cpu03.png
If you go to the details you would see that this device is vulnerable against both.
cpu04.png


Now you want to check with one klick which devices are vulnerable and compatible to get patches through Patching. To do that we first need again a custom inventory which checks if the compatibility registry key is available. You can download the ready to use package here.

RegistryValueReturn(HKEY_LOCAL_MACHINE64\SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat, cadca5fe-87d3-4b96-b7fb-a231484277cc, REG_DWORD) 

The next step is to import a report which shows all vulnerable devices. The package can be downloaded here
Additionaly i have created a report which will list you all devices which are secure. You can downoad it here.

You can modify / add / delete everything wihtin the scripts, custom inventories or SQL-Reports. 
If you rename your custom inventory rules change the names in the SQL query too.


Cheers Timo

View comments (11)

KACE SMA - Adding Clients to AD Groups

Hi All,

this is a little AddOn to my previous post: KACE SDA - Adding Clients to AD Groups during deployment
This blog will focus on an ongoing management of AD security groups. 

First i have to say the main script is written by OneScript Team.

The idea here is to use KACE SMA to have an sheduled or an adhoc script wich will assign devices to specific AD securitygroup(s). 
First we will create an online KScript like this: 
sma_aag_001.png

After that we have to decleare on which device(s) it should be deployed to. Here you can choose to leave it empty or using a specific smartlabel or whatever you need it for.
After that you have to add credentials of a user who has the right to add the targeted devices to the targeted AD securitygroups.
Pro Tipp: Only use Domain Administrator if you are in a lab :)  
sma_aag_002.png

We don't need a notification and the shedule is up to you. Maybe you wan't to run it every monday to be sure that every device is in the correct group(s). 
Necessary to check is the "Allow run without a logged-in user". 
sma_aag_003.png

And now the final step: Upload the VBS as dependency and configure a task (or multiple).
sma_aag_004.png

Of course you can do here whatever you want. Feel free to proof registry keys or whatever you like before adding a computer to an AD securitygroup. 
You can add all securitygroup names seperated by a space as an argument. So you are able to create different sets of joining ad groups in one task. 

You can download the script together with my AutoIt Wrapper for KACE SDA:  Here 

Please note that this is a selfmate script without vendor support.

Kind Regards
Timo
Be the first to comment
Showing 1 - 5 of 13 results

Top Contributors

Talk About Windows 10