Passer au contenu principal
Quitter

Bienvenue chez Dell

Mon compte
  • Passer des commandes rapidement et facilement
  • Voir les commandes et de suivre l'état de votre expédition
  • Profitez membres seulement récompenses et des remises
  • Créez et accédez à une liste de vos produits
  • Gérez vos sites Dell EMC, vos produits et vos personnes-ressources pour les produits dans Administration de l’entreprise.
Connexion Créer un compte Connexion Premier Connexion au programme Partner
Nous contacter

Vos paniers Dell.com

Dell Wyse Windows 10 IoT Enterprise for Latitude 5280 Mobile Thin Client Administrator’s Guide

PDF

Using TPM and BitLocker

A TPM is a microchip designed to provide basic security-related functions, primarily involving encryption keys. BitLocker Drive Encryption (BDE) is a full disk encryption feature which is designed to protect data by providing encryption for entire volumes. By default it uses the AES encryption algorithm in CBC mode with a 128 bit key, combined with the Elephant diffuser for additional disk encryption-specific security not provided by AES.

Windows 10 does not support sysprep on a BitLocker encrypted device. Because of this limitation, you cannot encrypt the device, perform a sysprep and pull the image. To overcome this issue, you must add or modify the TPM related script that handles TPM. The device must not be encrypted before sysprep (pull). The device encryption is handled by the post push script that uses the TPM_enable.ps1 script located at C:\Windows\setup\tools\. This script must be included before enabling the UWF and after sysprep scripts. The PIN used to encrypt the client must be passed to the script as an argument.

To use TPM and BitLocker, do the following:
  1. Enable TPM from the BIOS menu.
  2. Modify the TPM related part of the script, based on the imaging solution.
  3. Uncomment the below lines and update the pin for TPM encryption in the Custom FICore imaging method in C:\Windows\Setup\CustomSysprep\Modules\Post_CustomSysprep.psm1
    • #cd C:\windows\setup\Tools\TPM\
    • #.\TPM_enable.ps1 -pin 1234
  4. Uncomment the below lines and update the pin for TPM encryption for SCCM push in C:\Windows\Setup\ConfigMgrSysprep\Modules\Admin_ConfigMgrSysprep.psm1
    • #cd C:\windows\setup\Tools\TPM\
    • #.\TPM_enable.ps1 -pin 1234
  5. Uncomment the below lines and update the pin for TPM encryption in Non-Factory environment (WDM,WSI, USB Imaging solution) in Post_CustomSysprep.psm1
    • #cd C:\windows\setup\Tools\TPM\
    • #.\TPM_enable.ps1 -pin 1234
  • NOTE:
    If the client is encrypted previously, then do the following to clear the TPM.

    1. Enter the BIOS mode.

    2. In TPM configuration, set the Change TPM Status to Clear, and then apply the settings.

    3. Reboot the device, and enter the BIOS mode again.

    4. Set the Change TPM Status to Enable and Activate.

  Veuillez évaluer cet article (1 à 5 étoiles).
  Veuillez évaluer cet article (1 à 5 étoiles).
  Veuillez évaluer cet article (1 à 5 étoiles).
  Avez-vous trouvé cet article utile?
  Les commentaires ne peuvent pas contenir ces caractères spéciaux : <>()\