Do you guys use secure boot?

[TheGoodGuy]

I am just curious if people here deploy with secure boot enabled or not. I have read it can cause some issues..

[sted]

no as iirc to pxe boot with it on you need 2012r2 (and most of my schools dont have it) and unless youre running win 8+ (again usually not its no use) it seems to be more of a probelm than a solution to me

[Michael]

I think at the moment Secure Boot is more hassle for anything older than Windows 8, but in time, it will become the norm with modern Operating Systems

 

I think most people on here are deploying Windows 7, so Secure Boot is most likely disabled. In saying that, it does work with the 64Bit version of Windows 7.

[CraigM]

On my PC that's running Windows 8.1, yeah Secure Boot is on. Otherwise no, all our other PC's are on 7. Not to mention, only about 55 out of 175 PC's have an UEFI capable of Secure Boot i.e. Intel 7 and 8 series chipsets. Luckily all new PC's will come with Secure Boot capable UEFI from now on.

[Norphy]

no as iirc to pxe boot with it on you need 2012r2 (and most of my schools dont have it) and unless youre running win 8+ (again usually not its no use) it seems to be more of a probelm than a solution to me

 

2012, R2 not required.

 

I think at the moment Secure Boot is more hassle for anything older than Windows 8, but in time, it will become the norm with modern Operating Systems

 

I think most people on here are deploying Windows 7, so Secure Boot is most likely disabled. In saying that, it does work with the 64Bit version of Windows 7.

 

Windows 7 x64 will only work with UEFI, not with secureboot enabled UEFI.

[mac_shinobi]

Regards to windows 8 features, I am looking forward to eDrive on windows 8 ( Head To Head: Crucial's M500s Vs. Samsung's 840 EVOs - SSD Deathmatch: Crucial's M500 Vs. Samsung's 840 EVO )

 

Which will mean enabling encryption will be a matter of minutes on SSD's versus bitlocker which can take anywhere from twenty minutes to several hours depending on a number of factors ie hard drive capacity / speed ( RPM versus Flash ie SSD ) / and other factors

 

This will make use of the already available hardware encryption on the SSD itself as apposed to software encryption like bitlocker / true crypt etc

[SYNACK]

Yes, deploy8.11 with it off so it allows mdt then switch on once imaged

[Arthur]

Which will mean enabling encryption will be a matter of minutes on SSD's versus bitlocker which can take anywhere from twenty minutes to several hours

Seconds, not minutes.

 

Hardware Accelerated BitLocker Encryption: Microsoft Windows 8 eDrive Investigated with Crucial M500 « AnandTech

 

It turns out that if you have a storage device (e.g. SSD, eMMC, etc...) that meets the right encryption standards, Windows 8’s BitLocker will leverage the device’s hardware encryption engine, bypassing the software based encryption altogether. The result should be better performance and lower power consumption.

 

The M500 is the first drive that I'm aware of to support Microsoft’s eDrive standard. Because of its TCG Opal 2.0 and IEEE-1667 compliance, the M500 is eDrive compatible. There are some platform requirements to get eDrive working as well. You’ll obviously need a system that will support BitLocker (although hardware TPM isn't necessary, you can still go the USB key route). It’s important to note that you have to enable UEFI boot and make sure you have a UEFI enabled Windows 8 install in order for this to work. Your platform will specifically need to support UEFI 2.3.1 (Class II no CSM/Class III). Often times UEFI boot support on motherboards can be tricky, particularly on earlier firmware revisions, so be sure you’re updated (this was the problem I ran into with my test hardware). I've had varied luck with getting DIY desktop PC hardware to behave appropriately with UEFI and BitLocker enabled, so your mileage may vary. The experience on a TPM enabled notebook should be far cleaner from what I've heard.

 

With all of your ducks in a row, all you need to do is enable BitLocker at this point. If everything is eDrive compliant you won't be asked whether or you want to encrypt all or part of the drive, after you go through the initial setup BitLocker will just be enabled. There’s no extra encryption stage (since the data is already encrypted on your SSD). If you've done something wrong, or some part of your system isn't eDrive compliant, you'll get a progress indicator and a somewhat lengthy software encryption process.

 

For example, with 107GB in use my test 240GB M500 was fully encrypted with BitLocker enabled after a couple of seconds. Just a pause, then boom, BitLocker was enabled. My 256GB Samsung SSD 840 Pro on the other hand took about 21 minutes to encrypt the very same data using software encryption.

 

The ability to quickly enable/disable BitLocker is a nice perk, but it’s only part of the story. There’s basically no change in performance with BitLocker enabled on the M500 since the encryption is all done on the drive (and was always being done there to begin with).

 

This will make use of the already available hardware encryption on the SSD itself as opposed to software encryption like bitlocker / truecrypt etc

It's still Bitlocker, but with the encryption done on the drive (so much much faster).

Edited May 19, 2014 by Arthur

[mac_shinobi]

Seconds, not minutes.

 

Hardware Accelerated BitLocker Encryption: Microsoft Windows 8 eDrive Investigated with Crucial M500 « AnandTech

 

 

 

 

It's still Bitlocker, but with the encryption done on the drive (so much much faster).

 

Still faster than bitlocker / truecrypt etc