Bitlocker notification or disablement

we trying roll out bitlocker on company laptops. problem, though our gpo seems not allow it, individual users able disable bitlocker. have problem this, dont want our workers in field, hold client data, able disable encryption. or if do, havent found way show notification bitlocker has been disabled know it. has faced issue, or know doing wrong stop this? thanks.

i asked same question microsoft -- responded can use applocker policies block execution of bitlocker "manage-bde.exe" tool.

note block execution of tool itself, regardless of command line switches.  have not been able figure out how selectively block specific switches (for example, allow "manage-bde.exe -status" current encryption status deny "manage-bde.exe -off" decrypts , disables bitlocker).  because of limitation opted use 3rd-party tool (beyondtrust privilege manager) accomplish this.

this link technet's article on applocker:
http://technet.microsoft.com/ja-jp/library/ee619725%28ws.10%29.aspx

given that, if think applocker may enough you, here steps enable rules:

1: open services control manager (services.msc) , start "application identity" service.

2: open security policy editor (secpol.msc).

3: expand application control policies, click applocker

4: click "configure rule enforcement" , choose whether want enforce or audit executable rule. (do audit first can understand behavior , don't accidentally blow machine).

5: right-click on executable rules , create default rules.  these 3 rules allow users execute files in programfiles , windows folders (and allows local admins execute program regardless of location).   important create default rules because application not explicitly addressed applocker rules prohibited running.  theoretically lock out , render windows inoperative if don't configure rules correctly.

6: right click on executable rules , create new rule deny access on "manage-bde.exe" group (default).

7: reboot, log in , if open command prompt , try run "manage-bde –status" should message command blocked group policy.

notes:

* these steps testing on single pc; setting application identity , applocker rules on domain should done group policies.  tutorial that: http://www.windowsnetworking.com/articles_tutorials/introduction-applocker-part1.html

* deny rules take precedence on allow rules, why explicitly denying manage-bde.exe run after 3 default allow rules allows users execute applications.

* view results of applocker rule, check security logs in event viewer

* use path rule block c:\windows\system32\manage-bde.exe if user copied file c:\temp, you're screwed.  hash rule more useful because hash of file never changes regardless whether user renames file or moves different folder (this weakness of hash rule because if microsoft ever patches manage-bde.exe, in service pack or security update, hash no longer valid , rule break).

* of course, you'll need protect user killing application identity service (appidsvc), without applocker rules cannot enforced.   i'll leave exercise reader.  ;-)

roland thomas

 

---

life motto #1: "live life give damn."

Windows Server  >  Security