Gå til hovedindhold
Log af

Velkommen hos Dell

Min konto
  • Afgiv ordrer hurtigt og nemt
  • Se ordrer og spor status for din forsendelse
  • Opret og få adgang til en liste med dine produkter
  • Administrer dine Dell EMC-websteder, -produkter og -kontaktpersoner på produktniveau ved hjælp af Company Administration (Virksomhedsadministration).
Log på Opret en konto Log på Premier Log på Partnerprogram
Kontakt os

Dine Dell.com-kurve

Dell Wyse Windows 10 IoT Enterprise for Latitude 5280 Mobile Thin Client Administrator’s Guide

PDF

Using TPM and BitLocker

A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys. BitLocker Drive Encryption (BDE) is a full disk encryption feature which is designed to protect data by providing encryption for entire volumes. By default it uses the AES encryption algorithm in CBC mode with a 128 bit key, combined with the Elephant diffuser for additional disk encryption-specific security not provided by AES.

Windows 10 does not support sysprep on a BitLocker encrypted device. Because of this limitation, you cannot encrypt the device, perform a sysprep and pull the image. To overcome this issue, you must add or modify the TPM related script that handles TPM. The device must not be encrypted before sysprep (pull). The device encryption is handled by the post push script that uses the TPM_enable.ps1 script located at C:\Windows\setup\tools\. This script must be included before enabling the UWF and after sysprep scripts. The PIN used to encrypt the client must be passed to the script as an argument.

To use TPM and BitLocker, do the following:
  1. Enable TPM from the BIOS menu.
  2. Modify the TPM related part of the script, based on the imaging solution.
  3. Uncomment the below lines and update the pin for TPM encryption in the Custom FICore imaging method in C:\Windows\Setup\CustomSysprep\Modules\Post_CustomSysprep.psm1
    • #cd C:\windows\setup\Tools\TPM\
    • #.\TPM_enable.ps1 -pin 1234
  4. Uncomment the below lines and update the pin for TPM encryption for SCCM push in C:\Windows\Setup\ConfigMgrSysprep\Modules\Admin_ConfigMgrSysprep.psm1
    • #cd C:\windows\setup\Tools\TPM\
    • #.\TPM_enable.ps1 -pin 1234
  5. Uncomment the below lines and update the pin for TPM encryption in Non-Factory environment (WDM,WSI, USB Imaging solution) in Post_CustomSysprep.psm1
    • #cd C:\windows\setup\Tools\TPM\
    • #.\TPM_enable.ps1 -pin 1234
  • NOTE:
    If the client is encrypted previously, then do the following to clear the TPM.

    1. Enter the BIOS mode.

    2. In TPM configuration, set the Change TPM Status to Clear, and then apply the settings.

    3. Reboot the device, and enter the BIOS mode again.

    4. Set the Change TPM Status to Enable and Activate.

Bedøm indholdet

Nøjagtig
Nyttig
Nemt at forstå
Var denne artikel nyttig?
0/3000 characters
  Angiv vurderinger (1-5 stjerner).
  Angiv vurderinger (1-5 stjerner).
  Angiv vurderinger (1-5 stjerner).
  Angiv, om artiklen var nyttig eller ej.
  Kommentarer må ikke indeholde følgende specialtegn: <>()\