JF10 Posted March 13, 2014 Posted March 13, 2014 (edited) Hi We have about 700 laptops that we image and maintain with USB Drives running Ghost. We have our laptops with a C: (Operating System / Program Files) and D: (My Documents, Pictures, Desktop etc). The D: is more important to be encrypted (for us) than the C:, but if it could work easily, encrypting both, then that is also fine. When we re-image a laptop because of a significant update / fix / crash etc, we just re-image the C partition. This allows us to wipe a system without needing to worry about the work stored on the D drive. This works perfect for us and with encryption in the pipeline, we would like to keep it as simple and similar as possible. What version of Ghost should we be running that would allow encryption? What encryption software could Ghost allow to be written over? Any general advice about encryption from people that have done a similar thing would be appreciated. If Ghost, cannot handle encryption? What system do you recommend for imaging from local storage (not across a LAN). Thank you EDIT: Deployed OS is Windows 7 Professional 64bit. Edited March 13, 2014 by JF10
JF10 Posted March 13, 2014 Author Posted March 13, 2014 Hi Ben, At the moment Windows 7 Professional - 64bit.
SYNACK Posted March 13, 2014 Posted March 13, 2014 (edited) What version of Windows and what kind of laptops, TPM? If you have Vista, 7 Pro or 8 Enterpise then just use bitlocker, configurable via GPO but may need a bios tweak (which can be pushed remotely to come laptops( to enable the TPM and the OS to take ownership. SCCM, Windows 7 and Bitlocker - Part 1 - Blogs - EduGeek.net Encryption happens in the background after the image. Way faster on 8 to. Edited March 13, 2014 by SYNACK 1
JF10 Posted March 13, 2014 Author Posted March 13, 2014 (edited) Thanks Synack Hypothetically, I image with an unencrypted Windows 7 Professional image. Enable Bitlocker, encrypts data. 6 months later, C drive corrupts and cannot 'turn off' bitlocker. We want to re-image the C: with the unencrypted image over the top of the encrypted C: partition. Should this scenario work? Edited March 13, 2014 by JF10
SYNACK Posted March 13, 2014 Posted March 13, 2014 Thanks Synack Hypothetically, I image with an unencrypted Windows 7 Professional image. Enable Bitlocker, encrypts data. 6 months later, C drive corrupts and cannot 'turn off' bitlocker. We want to re-image the C: with the unencrypted image over the top of the encrypted drive. Should this scenario work? Yes, there would be a recovery key stored in AD and if it (the partition) was toast just dump a new image on and reinitialize the TPM, easy . 1
FN-GM Posted March 13, 2014 Posted March 13, 2014 (edited) Thanks Synack Hypothetically, I image with an unencrypted Windows 7 Professional image. Enable Bitlocker, encrypts data. 6 months later, C drive corrupts and cannot 'turn off' bitlocker. We want to re-image the C: with the unencrypted image over the top of the encrypted C: partition. Should this scenario work? That will work. But Bit Locker isn't included With Windows 7 Pro. Only Enterprise and Ultimate. - http://technet.microsoft.com/en-us/library/ee449438(v=ws.10).aspx#BKMK_Vista Edited March 13, 2014 by FN-GM 1
MordyT Posted March 13, 2014 Posted March 13, 2014 What version of Windows and what kind of laptops, TPM? If you have Vista, 7 Pro or 8 Enterpise then just use bitlocker, configurable via GPO but may need a bios tweak (which can be pushed remotely to come laptops( to enable the TPM and the OS to take ownership. SCCM, Windows 7 and Bitlocker - Part 1 - Blogs - EduGeek.net Encryption happens in the background after the image. Way faster on 8 to. Since when did Bitlocker work on Windows 7 Pro? Enterprise and Ultimate only I thought? Thanks Synack Hypothetically, I image with an unencrypted Windows 7 Professional image. Enable Bitlocker, encrypts data. 6 months later, C drive corrupts and cannot 'turn off' bitlocker. We want to re-image the C: with the unencrypted image over the top of the encrypted C: partition. Should this scenario work? About 90% Yes. Bitlocker usually does software based encryption, which means you can reformat and its gone. Unless you have hardware encryptable drives... 1
SYNACK Posted March 13, 2014 Posted March 13, 2014 That will work. But Bit Locker isn't included With Windows 7 Pro. Only Enterprise and Ultimate. - BitLocker Drive Encryption in Windows 7: Frequently Asked Questions Oops was thinking of Vista where I think pro did it. Do you have VL, should have access and be using enterprise anyway so easy enough as you reimage as stuff breaks. 1
FN-GM Posted March 13, 2014 Posted March 13, 2014 Do you have VL, should have access and be using enterprise anyway so easy enough as you reimage as stuff breaks. You only get Enterprise if you have purchased Software Assurance. Oops was thinking of Vista where I think pro did it. It was only Enterprise and Ultimate for Vista as well 1
JF10 Posted March 13, 2014 Author Posted March 13, 2014 Oops was thinking of Vista where I think pro did it. Do you have VL, should have access and be using enterprise anyway so easy enough as you reimage as stuff breaks. We do have Microsoft Schools Agreement, but I am not sure whether we are entitled to Enterprise? Yes, it wouldn't be a big project we set out to do in a half term. It would just be a case of rolling it out as and when a laptop required a re-image.
Norphy Posted March 13, 2014 Posted March 13, 2014 Since when did Bitlocker work on Windows 7 Pro? Enterprise and Ultimate only I thought? I'm fairly sure that Windows 7 Pro will let you encrypt USB sticks with Bitlocker, it won't encrypt system drives for you though.
JF10 Posted March 13, 2014 Author Posted March 13, 2014 I'm fairly sure that Windows 7 Pro will let you encrypt USB sticks with Bitlocker, it won't encrypt system drives for you though. What about a non-system partition?
Norphy Posted March 13, 2014 Posted March 13, 2014 I don't know, I've not tried. I think though that it'll only do removable drives.
Michael Posted March 13, 2014 Posted March 13, 2014 The problem with Bitlocker in Windows 7 (when encrypting system drives) is it'll literally do the whole drive, so if it 1TB in size it'll take hours. All flavours of Windows 7 support Bitlocker. Starter, Home and Pro only support portable drives being encrypted. Enterprise will let you do system drives. Windows 8's better in this respect - you can encrypt system drives, but it'll only encrypt the actual data vs. the whole drive. Considerably quicker and more intelligent.
SYNACK Posted March 15, 2014 Posted March 15, 2014 It does do the encryption in the background though so can be used while it is doing it, even survives sleep and shutdown while its doing it.
Arthur Posted March 15, 2014 Posted March 15, 2014 (edited) The problem with Bitlocker in Windows 7 (when encrypting system drives) is it'll literally do the whole drive, so if it 1TB in size it'll take hours. With SCCM, you can encrypt the entire system drive prior to the operating system image being applied in WinPE. This enables you to encrypt a Windows 7 laptop really quickly since there isn't any data on the drive. Increasing the size of the "System Reserved" partition also helps to increase Bitlocker's encryption speed. I usually set it to 1GB. Edited March 15, 2014 by Arthur
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now