Solved supporting an office of computers with full drive encryption
-
@scottalanmiller If the user forgets password and they are out of town. They can feed you a series of numbers and letters (think windows OS Product Key length) that you plug into the server. That then generates a similar code that you feed back to them then that unlocks the encryption.
-
@MattSpeller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@MattSpeller said in supporting an office of computers with full drive encryption:
@stacksofplates said in supporting an office of computers with full drive encryption:
That may be a setting that can be enabled, idk. I don't manage it.
Good lord I hope you can enable forced password, otherwise you're right, wtf?!
The CIO wants all of the Sysadmin team (and presumably others) to use BitLocker for Full Disk Encryption. I can't reboot my computer without entering the password to decrypt the drives.
Good to know the corporate team is on par.......
-
@dafyre said in supporting an office of computers with full drive encryption:
@MattSpeller said in supporting an office of computers with full drive encryption:
@stacksofplates said in supporting an office of computers with full drive encryption:
That may be a setting that can be enabled, idk. I don't manage it.
Good lord I hope you can enable forced password, otherwise you're right, wtf?!
The CIO wants all of the Sysadmin team (and presumably others) to use BitLocker for Full Disk Encryption. I can't reboot my computer without entering the password to decrypt the drives.
I presume that there is data on there?
-
@PenguinWrangler said in supporting an office of computers with full drive encryption:
@scottalanmiller If the user forgets password and they are out of town. They can feed you a series of numbers and letters (think windows OS Product Key length) that you plug into the server. That then generates a similar code that you feed back to them then that unlocks the encryption.
Does each user have their own password for the drive? Is it AD integrated? Can the admin log in if the user forgets their password?
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
I presume that there is data on there?
The document I was working off of said that even if their data is web based, if they view a .pdf , the .pdf could get stored as a temp file, and that information could be confidential, so they want the drive encrypted.
-
@Mike-Davis It is all AD integrated. When they change their AD password and login then the Dell DDPE will update the PBA (Preboot Authentication screen) with their AD password.
-
@Mike-Davis One thing to note, it will not let them pass the PBA(preboot authentication screen) if their password is expired. Took some teaching, and emails to my users to change passwords when they are prompted and don't let them expire. We push out email warnings the week before and day of their password expiring. Hasn't been too much of an issue. My users seemed to adapt to that fairly well.
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
I presume that there is data on there?
The document I was working off of said that even if their data is web based, if they view a .pdf , the .pdf could get stored as a temp file, and that information could be confidential, so they want the drive encrypted.
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@MattSpeller said in supporting an office of computers with full drive encryption:
@stacksofplates said in supporting an office of computers with full drive encryption:
That may be a setting that can be enabled, idk. I don't manage it.
Good lord I hope you can enable forced password, otherwise you're right, wtf?!
The CIO wants all of the Sysadmin team (and presumably others) to use BitLocker for Full Disk Encryption. I can't reboot my computer without entering the password to decrypt the drives.
I presume that there is data on there?
All my software, and Keepass files. Encrypted SSH keys and RDP password a la MobaXterm. Yeah. There's a bit on here that I don't want folks to have access to.
And if somebody steals my office machine, they'd have to steal the UPS too... and then know the password to unlock my screen... and my desktop weighs about as much as my UPS (it's a small one), lol.
-
@dafyre said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@MattSpeller said in supporting an office of computers with full drive encryption:
@stacksofplates said in supporting an office of computers with full drive encryption:
That may be a setting that can be enabled, idk. I don't manage it.
Good lord I hope you can enable forced password, otherwise you're right, wtf?!
The CIO wants all of the Sysadmin team (and presumably others) to use BitLocker for Full Disk Encryption. I can't reboot my computer without entering the password to decrypt the drives.
I presume that there is data on there?
All my software, and Keepass files. Encrypted SSH keys and RDP password a la MobaXterm. Yeah. There's a bit on here that I don't want folks to have access to.
And if somebody steals my office machine, they'd have to steal the UPS too... and then know the password to unlock my screen... and my desktop weighs about as much as my UPS (it's a small one), lol.
Nearly all of that is already encrypted, though. So those parts won't benefit from further encryption.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@MattSpeller said in supporting an office of computers with full drive encryption:
@stacksofplates said in supporting an office of computers with full drive encryption:
That may be a setting that can be enabled, idk. I don't manage it.
Good lord I hope you can enable forced password, otherwise you're right, wtf?!
The CIO wants all of the Sysadmin team (and presumably others) to use BitLocker for Full Disk Encryption. I can't reboot my computer without entering the password to decrypt the drives.
I presume that there is data on there?
All my software, and Keepass files. Encrypted SSH keys and RDP password a la MobaXterm. Yeah. There's a bit on here that I don't want folks to have access to.
And if somebody steals my office machine, they'd have to steal the UPS too... and then know the password to unlock my screen... and my desktop weighs about as much as my UPS (it's a small one), lol.
Nearly all of that is already encrypted, though. So those parts won't benefit from further encryption.
Many of our laptops do have unencrypted data that would be very bad to have leaked/stolen. Never mind just having access to the email on some of our machines - yikes.
-
@MattSpeller said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@MattSpeller said in supporting an office of computers with full drive encryption:
@stacksofplates said in supporting an office of computers with full drive encryption:
That may be a setting that can be enabled, idk. I don't manage it.
Good lord I hope you can enable forced password, otherwise you're right, wtf?!
The CIO wants all of the Sysadmin team (and presumably others) to use BitLocker for Full Disk Encryption. I can't reboot my computer without entering the password to decrypt the drives.
I presume that there is data on there?
All my software, and Keepass files. Encrypted SSH keys and RDP password a la MobaXterm. Yeah. There's a bit on here that I don't want folks to have access to.
And if somebody steals my office machine, they'd have to steal the UPS too... and then know the password to unlock my screen... and my desktop weighs about as much as my UPS (it's a small one), lol.
Nearly all of that is already encrypted, though. So those parts won't benefit from further encryption.
Many of our laptops do have unencrypted data that would be very bad to have leaked/stolen. Never mind just having access to the email on some of our machines - yikes.
The last manager meeting here, the owners were sounding very interested in this new LANLess thing @scottalanmiller has been talking about. I'll probably be getting a request for a NextCloud, Spreed.Me, and one of the office integration suites here in the near future
-
@travisdh1 said in supporting an office of computers with full drive encryption:
@MattSpeller said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@MattSpeller said in supporting an office of computers with full drive encryption:
@stacksofplates said in supporting an office of computers with full drive encryption:
That may be a setting that can be enabled, idk. I don't manage it.
Good lord I hope you can enable forced password, otherwise you're right, wtf?!
The CIO wants all of the Sysadmin team (and presumably others) to use BitLocker for Full Disk Encryption. I can't reboot my computer without entering the password to decrypt the drives.
I presume that there is data on there?
All my software, and Keepass files. Encrypted SSH keys and RDP password a la MobaXterm. Yeah. There's a bit on here that I don't want folks to have access to.
And if somebody steals my office machine, they'd have to steal the UPS too... and then know the password to unlock my screen... and my desktop weighs about as much as my UPS (it's a small one), lol.
Nearly all of that is already encrypted, though. So those parts won't benefit from further encryption.
Many of our laptops do have unencrypted data that would be very bad to have leaked/stolen. Never mind just having access to the email on some of our machines - yikes.
The last manager meeting here, the owners were sounding very interested in this new LANLess thing @scottalanmiller has been talking about. I'll probably be getting a request for a NextCloud, Spreed.Me, and one of the office integration suites here in the near future
Sweet, did they watch the video? Did they remember to give some likes? LOL
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
@travisdh1 said in supporting an office of computers with full drive encryption:
@MattSpeller said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@dafyre said in supporting an office of computers with full drive encryption:
@MattSpeller said in supporting an office of computers with full drive encryption:
@stacksofplates said in supporting an office of computers with full drive encryption:
That may be a setting that can be enabled, idk. I don't manage it.
Good lord I hope you can enable forced password, otherwise you're right, wtf?!
The CIO wants all of the Sysadmin team (and presumably others) to use BitLocker for Full Disk Encryption. I can't reboot my computer without entering the password to decrypt the drives.
I presume that there is data on there?
All my software, and Keepass files. Encrypted SSH keys and RDP password a la MobaXterm. Yeah. There's a bit on here that I don't want folks to have access to.
And if somebody steals my office machine, they'd have to steal the UPS too... and then know the password to unlock my screen... and my desktop weighs about as much as my UPS (it's a small one), lol.
Nearly all of that is already encrypted, though. So those parts won't benefit from further encryption.
Many of our laptops do have unencrypted data that would be very bad to have leaked/stolen. Never mind just having access to the email on some of our machines - yikes.
The last manager meeting here, the owners were sounding very interested in this new LANLess thing @scottalanmiller has been talking about. I'll probably be getting a request for a NextCloud, Spreed.Me, and one of the office integration suites here in the near future
Sweet, did they watch the video? Did they remember to give some likes? LOL
Nope, they were sold when I told them about the Spreed.Me integration. They've been looking for a way to do webinars and being able to interact with remote people. A way to have that available and keep it all "in house" was the kicker.
Also, don't get me started, 3rd party services just won't work because of the crazy legalities surrounding the business. In a sane world I'd have them connect with Skype or something like that.
-
@PenguinWrangler said in supporting an office of computers with full drive encryption:
We use Dell DDPE encryption solution. We can log into the server and tell the computer bypass the first Encryption Screen on next boot if the computer is in the office. So that is how we handle WOL scenarios.
Is that product still made by Wave?
I know Wave was having some issues a little while back.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
How would I go about encrypting the user space without the OS?
-
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
How would I go about encrypting the user space without the OS?
Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
How would I go about encrypting the user space without the OS?
Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.
The issue with that that needs to still be considered can be local data being pulled down to the
drive you are unaware of. Outlook, temp files, whatever.I know in the past when we're argued ... er, discussed ... this, you say you don't use anything that create local temp files, but it's a consideration for many.
-
@BRRABill said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
How would I go about encrypting the user space without the OS?
Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.
The issue with that that needs to still be considered can be local data being pulled down to the
drive you are unaware of. Outlook, temp files, whatever.I know in the past when we're argued ... er, discussed ... this, you say you don't use anything that create local temp files, but it's a consideration for many.
You can include the program files on the D drive. It's not too hard to look at the apps that you will be using and see where they store data.
-
@scottalanmiller said in supporting an office of computers with full drive encryption:
@BRRABill said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
@Mike-Davis said in supporting an office of computers with full drive encryption:
@scottalanmiller said in supporting an office of computers with full drive encryption:
Sure, that can happen, depending on how it is set up. But you can encrypt all user space without encrypting the OS.
How would I go about encrypting the user space without the OS?
Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.
The issue with that that needs to still be considered can be local data being pulled down to the
drive you are unaware of. Outlook, temp files, whatever.I know in the past when we're argued ... er, discussed ... this, you say you don't use anything that create local temp files, but it's a consideration for many.
You can include the program files on the D drive. It's not too hard to look at the apps that you will be using and see where they store data.
I wonder if there would be issues trying to force Internet Explorer to install to an alternate path. (another drive) If you can't and the user launches it, and logs in to a confidential site, and their alternate temporary internet file location is unavailable, does it just store the temp files where it has access, or crash? I did a quick google search and couldn't find much on getting internet explorer to install to an alternate path, so I think that idea might not get to far.
