The vast majority of business computers use the Microsoft Windows operating system. Most companies have Windows workstations, networked to servers which may also run a version of Windows. Since Windows rules the corporate world, it is a fair question to ask whether it natively provides the security that enterprises need to protect themselves and conduct efficient business operations.

Security software and Soultions at SCCMVPS provide a proactive approach to security that integrates information correlation, application analysis and network level defense. It secures both large scale integrations as well as standalone systems.

Security for Standalone systems: BitLocker Encryption Windows can encrypt entire operating system drives and removable devices with its built-in BitLocker encryption. When TrueCrypt controversially closed up shop, they recommended their user’s transition away from TrueCrypt to BitLocker.

Read More

Overview of Microsoft BitLocker

Administration and Monitoring (MBAM)

In MBAM 2.5 we support the use of fully qualified domain names (FQDN) and single MBAM infrastructure managing clients across two or more trusted forests. Organizations around the world rely on Windows® BitLocker® Drive Encryption and BitLocker To Go™ to protect data on Windows 7, Windows 8, Windows To Go and removable storage devices. To make large-scale BitLocker implementations easier to manage, many are turning to Microsoft® BitLocker Administration and Monitoring (MBAM). Microsoft BitLocker Administration and Monitoring 2.0 – from the Microsoft Desktop Optimization Pack (MDOP) for Software Assurance – takes BitLocker to the next level by simplifying deployment and key recovery, centralizing compliance monitoring and reporting, and minimizing the costs associated with provisioning and supporting encrypted drives within your organization.

Simplified BitLocker Deployment:

Microsoft BitLocker Administration and Monitoring lets you choose the deployment scenario that makes the most sense for your business. You can provision BitLocker as part of your Windows 7, Windows 8, or Windows To Go deployment or you can configure BitLocker encryption to be provisioned after the operating system is installed. Using the additional Group Policy controls in MBAM, it's easier for IT to provision BitLocker in a way that meets your business needs. The controls are checked periodically and if a device is detected as non-compliant, MBAM will help put it back into the desired state.

Increased compliance:

With out-of-box reports you can get a better view of your compliance status, enabling you to easily determine if lost or stolen devices were encrypted. IT staff can also create custom compliance reports using built-in SQL Server Reporting Services tools to show them just the information that they need to see. MBAM also provides you the ability to store BitLocker recovery keys in an encrypted database with granular access controls and creates an audit trail of who has accessed recovery key information, keeping this information protected and only accessible to the right people in the organization.

Reduce support costs:

By making it easier for end users to quickly support themselves MBAM will reduce costs by minimizing the burden on IT and support staff. Using the Self Service and Helpdesk recovery portal, users and authorized help-desk staff will find it easy to support recovery scenarios if they run into issues. Also by automating pre-BitLocker setup steps and making it easy for end users to perform basic tasks such as starting the encryption process and managing their BitLocker PIN, your IT staff has more time to help drive your business forward. MBAM’s integration into System Center Configuration Manager also helps reduce costs by enabling you to deploy MBAM within the infrastructure that you’ve already deployed. Announcing the availability of MBAM 2.5 which includes a substantial update to this BitLocker management solution. Learn more about MBAM 2.5.a B:
Today’s an exciting day for the Microsoft BitLocker Administration and Monitoring (MBAM) team, as we just announced general availability of the Microsoft Desktop Optimization Pack (MDOP) 2014 for Software Assurance, which includes a substantial set of improvements for MBAM. As mentioned in our announcement on the Windows for your Business blogthe big star of the MDOP 2014 release is MBAM 2.5 which is designed to help further reduce the costs associated with provisioning, managing, and supporting BitLocker encrypted devices (Windows 7, Windows 8, and Windows To Go) within your environment. MBAM 2.0, which was released about a year ago, represented the break through release for the product, and we’ve seen tremendous adoption within organizations of all shapes and sizes including Siemens, BT, General Mills, and Yes Prep Public Schools just to name a few. It’s inclusion of the following features made broad adoption and appeal possible: Self-Service Portal: The Self-Service Portal helps end users recover devices (e.g.: lost PIN) without the need of help desk assistance

Support for

enterprise scenarios and topologies

While MBAM has been deployed in some of the world’s largest and most complex environments there were some topologies and configurations that MBAM 2.5 didn’t support, at least ideally. The first was related to organizations that consisted of multiple forests. To support this type of network topology in MBAM 2.0 required separate MBAM infrastructures within each forest. In MBAM 2.5 we support the use of fully qualified domain names (FQDN) and a single MBAM infrastructure managing clients across two or more trusted forests.
In addition to cross forest support MBAM 2.5 now supports high availability configurations on Windows Server, IIS, and SQL Server. MBAM supports load balancing of its web components using software or hardware based load balancers and its databases can now be deployed to SQL Server failover clusters. In the end MBAM 2.5 includes something for everyone and it addresses some of the top customer requests that we’ve received over the last year. It even ships with the localized versions on day one so customers no longer have to wait ~6 months for non-English builds! If you’re already running MBAM 1.0 or 2.0 in your environment moving to 2.5 is an easy transition that will provide many new benefits. If you’re not using BitLocker or MBAM today now is the perfect time to start evaluating it for your organization. To learn more about MBAM 2.5 please refer to the product documentationon TechNet.

SCCM/MBAM Integration

Installing Microsoft BitLocker Administration and Monitoring (MBAM) allows to choose a topology that integrates MBAM with System Center Configuration Manager. In the integrated topology, the hardware compliance and reporting features are removed from MBAM and are accessed from Configuration Manager. The integration of MBAM is based on a new Configuration Pack that installs the following three items into System Center Configuration Manager. Configuration data that consists of configuration items and a configuration baseline -Collection -Reports

Configuration Data

The configuration data installs a configuration baseline, called “BitLocker Protection,” which contains two configuration items: “BitLocker Operating System Drive Protection” and “BitLocker Fixed Data Drives Protection.” The configuration baseline is deployed to the collection, which is also created when MBAM is installed. The two configuration items provide the basis for evaluating the compliance status of the client computers. This information is captured, stored, and evaluated in Configuration Manager. The configuration items are based on the compliance requirements for operating system drives (OSDs) and Fixed Data Drives (FDDs). The required details for the deployed computers are collected so that the compliance for those drive types can be evaluated. By default, the configuration baseline evaluates the compliance status every 12 hours and sends the compliance data to Configuration Manager.


MBAM creates a collection that is called MBAM Supported Computers. The configuration baseline is targeted to client computers that are in this collection. This is a dynamic collection that, by default, runs every 12 hours and evaluates membership. Membership is based on three criteria: It is a supported version of the Windows operating system. Currently, MBAM supports only Windows 7 Enterprise and Windows 7 Ultimate, Windows 8 Enterprise, and Windows To Go, when Windows To Go is running on Windows 8 Enterprise. It is a physical computer. Virtual machines are not supported. Trusted Platform Module (TPM) is available. A compatible version of TPM 1.2 or later is required for Windows 7. Windows 8 and Windows To Go do not require a TPM. The collection is evaluated against all computers and creates the subset of compatible computers that provides the basis for compliance evaluation and reporting for the MBAM integration.


There are four reports used to view compliance. They are:

BitLocker Enterprise Compliance Dashboard –

gives IT administrators’ three different views of information on a single report: Compliance Status Distribution, Non-Compliant – Errors Distribution, and Compliance Status Distribution By Drive Type. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select.BitLocker Enterprise Compliance Details – lets IT administrators view information about the BitLocker encryption compliance status of the enterprise and includes the compliance status for each computer. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select.

BitLocker Computer Compliance –

lets IT administrators view an individual computer and determine why it was reported with a given status of compliant or not compliant. The report also displays the encryption state of the operating system drives (OSD) and fixed data drives (FDDs).

BitLocker Enterprise Compliance Summary –

lets IT administrators view the status of the compliance of the enterprise with MBAM policy. Each computer’s state is evaluated, and the report shows a summary of the compliance of all computers in the enterprise against the policy. Drill-down options on the report let IT administrators click through the data and view a list of computers that match the state that you select.

High-Level Architecture of MBAM with Configuration Manager

The following image shows the MBAM architecture with the Configuration Manager topology. This configuration supports up to 200,000 MBAM clients in a production environment.
A description of the servers, databases, and features of this architecture follows. The server features and databases in the architecture image are listed under the computer or server where we recommend that you install them.

Database Server –T

he Recovery Database, Audit Database, and Audit Reports are installed on a Windows server and supported SQL Server instance. The Recovery database stores recovery data that is collected from MBAM client computers. The Audit Database stores audit activity data that is collected from client computers that have accessed recovery data. The Audit Reports provide data about the compliance status of client computers in your enterprise.

Configuration Manager Primary Site Server –

The Configuration Manager Server contains of the MBAM server installation with the System Center Configuration Manager Integration stopology, which must be installed on a Configuration Manager primary site server. The Configuration Manager Server collects the hardware inventory information from client computers and is used to report BitLocker compliance of client computers. When you run the MBAM Setup server installation, a collection and the configuration data are installed on the Configuration Manager Primary Site Server.

Administration and Monitoring Server -

The Administration and Monitoring Server is installed on a Windows server and consists of the Administration and Monitoring website and the monitoring web services. The Administration and Monitoring website is used to audit activity and to access recovery data (for example, BitLocker recovery keys). The Self-Service Portal is also installed on the Administration and Monitoring Server. The Portal enables end users on client computers to independently log onto a website to get a recovery key if they lose or forget their BitLocker password. The Audit reports are also installed on the Administration and Monitoring Server.

Management Workstation -

The Policy Template consists of Group Policy Objects that define MBAM implementation settings for BitLocker drive encryption. You can install the Policy template on any server or workstation, but it is commonly installed on a management workstation that is a supported Windows server or client computer. The workstation does not have to be a dedicated computer. MBAM Client and

Configuration Manager Clien

computer The MBAM Client performs the following tasks: Uses Group Policy Objects to enforce the BitLocker encryption of client computers in the enterprise. Collects the recovery key for the three BitLocker data drive types: operating system drives, fixed data drives, and removable data (USB) drives Collects recovery information and computer information about the client computers.

Configuration Manager Client –

The Configuration Manager client enables Configuration Manager to collect hardware compatibility data about the client computers, and enables Configuration Manager to report compliance information.