BitLocker with TPM and Cert - Brief Introduction

BitLocker is introduced on Windows Vista and Server 2008 to guard against theft of sensitive drives and cold boot attacks. In Windows 7 and Server 2008 R2, Bitlocker further introduces some enhancements, including eliminate the need of pre-creating 1.5GB partition and "BitLocker to Go" for removable media.

You can also use BitLocker with (1) Trusted Platform Module (TPM) and (2) smart card certificate for enhanced security. TPM is a microcontroller security chip embedded on motherboard to protect sensitive key materials from unauthorized tampering. TPM is used for system drive (e.g. C:\) where Windows is installed and the certificate is for data drives, including both fixed and removable media.

On the drive that Windows is installed on, BitLocker uses the Trusted Platform Module (TPM) to detect if the computer's critical startup process has been tampered with. Additionally, a PIN or startup key can be required for users to have access to the drive's data.

BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys cannot be accessed until the TPM has verified the state of the computer. Encrypting the entire volume protects all of the data, including the operating system itself, the Windows registry, temporary files, and the hibernation file. Because the keys needed to decrypt data remain locked by the TPM, an attacker cannot read the data just by removing your hard disk and installing it in another computer.

During the startup process, the TPM releases the key that unlocks the encrypted partition only after comparing a hash of important operating system configuration values with a snapshot taken earlier. This verifies the integrity of the Windows startup process. The key is not released if the TPM detects that your Windows installation has been tampered with.

On fixed and removable data drives, users can use smart card certificate or password to unlock BitLocker-protected drive. An administrator that has been designated a BitLocker data recovery agent is also able to use certificate to recover access to a BitLocker-protected drive.

BitLocker and TPM recovery information can also be backup to Active Directory. This ensures that encrypted data belonging to the enterprise can always be accessed by authorized users. Backing up the TPM owner information for a computer allows administrators to locally and remotely configure the TPM security hardware on that computer. As an example, an administrator might want to reset the TPM to factory defaults when decommissioning or repurposing computers.

More detailed technical documentation and guides can be obtained from this Microsoft Technet site.

More information on BitLocker & TPM Recovery.

Dell PowerConnect VLAN Interoperability with Cisco

According to this document, Cisco catalyst switches and Dell PowerConnect switches (in fact, most other non-Cisco switches e.g. Juniper etc) are not compatible on VLAN trunking i.e. single physical link that carries multiple VLANs. This is because Dell and Cisco devices have different default mechanisms for dynamic exchange of VLAN information. Cisco Catalyst switches’ default mechanism is the VLAN trunking protocol(VTP). In contrast, Dell PowerConnect switches use the GARP VLAN registration protocol (GVRP) for dynamic exchange of VLAN configuration information. Because the Dell and Cisco switches use different protocols by default, no exchange of VLAN control traffic will take place – and thus no intra-VLAN traffic will flow between the Dell and Cisco switches. By disabling VTP and enabling GVRP on the Cisco switch, it is possible to exchange intra-VLAN data and control information in mixed Dell-Cisco environments.

I have just recieved confirmation from Cisco saying this:

Unfortunately, GVRP is not supported on Catalyst 3560 or 3750 switches. GVRP is only supported on the CatOS releases on Cat4000 and Cat6500 platfroms (on select releases - Only 6000s, 5000s and 4000 switches running CatOS software support this feature.)

If you connect a 3560 or 3750 switch to a device that supports GVRP you will see unsupported messages on the switch, telling you that the device itself is not able to process the GVRP information from the hosts/neighbours and therefore it drop it.

Nevertheless, GVRP is supported on IOS Router (cGVRP):
http://www.cisco.com/en/US/partner/docs/ios/12_2sr/12_2srb/feature/guide/srbcgvrp.html
What's the hell?! CatOS is already obsolete. And IOS routers being at L3 do not even need to pass VLAN trunking information. Does it mean Cisco lock-in?

Part 1: Using WinPE & ImageX to capture & deploy System Images

Windows Preinstallation Environment (or WinPE in short) is a lightweight operating system that you can boot up to capture system images, install drivers and system troubleshooting. Think of it like the bootable MS-DOS disk in the good old days. Unlike the 16-bit MS DOS that requires separate set of drivers, WinPE leverages on Win7 drivers. Furthermore, you can make and customise it freely using Windows Automated Installation Kits (WAIK) that is also freely available from Microsoft.

There are several online resources that teach you how to use WinPE. Nevertheless, here are the summary steps that I have compiled of using WAIK to capture & deploy system image.

0) Make a bootable WinPE CD, including ImageX toolkit.

1) Install OS, drivers, applications into a standard Dell PC

2) Run sysprep, click on "generalize" and quit.

3) Boot the PC into WinPE environment.

4) Use ImageX /capture to capture image. Save the wim image to a network folder

5) Boot new PC from WinPE.

6) Perform diskpart to create at least 2 partitions (first partition ~300MB for Win7/Win2K8R2 Bitlocker)

7) Map to the network folder that contains the WIM image.

8) Apply WIM image to new PC partition using ImageX /apply command.

Booting into WinPE

Do note that the WIM image can also be used in conjunction with Windows Deployment Services (WDS)., where it can be used as an Install Image. Think of an install image like a master image that can be installed and applied on bare-metal computers. Some of the useful online resources that outlined the detailed step-by-step include:

Walkthrough: Boot Windows PE from CD-ROM

Preparing an Image Using Sysprep and ImageX

Deploying A WIM Image With ImageX

Of these, making bootable WinPE CD is the first step. When creating a new boot configuration file called BCD by using BCDEdit, the Microsoft Technet walkthrough contains command options for BCDEdit that are no longer valid with Windows 7. In particular, replace the "-" with "/". I have listed down the workable commands outlined in the walkthrough

Bcdedit /createstore c:\winpe-amd64\mount\boot\BCD

Bcdedit /store c:\winpe-amd64\mount\boot\BCD /create {bootmgr}

Bcdedit /store c:\winpe-amd64\mount\boot\BCD /set {bootmgr} device boot

Bcdedit /store c:\winpe-amd64\mount\boot\BCD /create /d “WINPE” /application osloader

The last command returns a GUID value. Substitute with this value in the following examples.

Bcdedit /store c:\winpe-amd64\mount\boot\BCD /set <GUID> osdevice boot
Bcdedit /store c:\winpe-amd64\mount\boot\BCD /set <GUID> device boot
Bcdedit /store c:\winpe-amd64\mount\boot\BCD /set <GUID> path \windows\system32\boot\winload.exe
Bcdedit /store d:\winpe-amd64\mount\boot\BCD /set <GUID> systemroot \windows
Bcdedit /store d:\winpe-amd64\mount\boot\BCD /set <GUID> winpe yes
Bcdedit /store d:\winpe-amd64\mount\boot\BCD /set <GUID> detecthal yes
Bcdedit /store d:\winpe-amd64\mount\boot\BCD /displayorder <GUID> -addlast

SolarWinds Orion Part 2 - Monitoring Interfaces

After the new node is added in part 1, all the interfaces will be listed out for you. Typically, you would pay particular attention to interfaces that are prone to congestion and link errors e.g. WAN interfaces. Solarwinds also automatically calculate the bandwidth utilization based on the default bandwidth of the interface. For example, Solarwinds assumes 1000Mbps bandwidth for Gigabit Ethernet (GE) interface and traffic usage of 8Mbps will constitute less than 1% utilization rate. What if that interface is connected to your service provider device that provides only 10Mbps? That would become 80% high utilization instead!

To customise the actual bandwidth, click on the interface and click on "edit interface" button. Check on "Custom Bandwidth" and enter the actual transmit and recieve bandwidth.

SolarWinds Orion Part 1 - Adding nodes to NPM

We have recently implemented SolarWinds Orion as part of our Network Management Systems (NMS), which is pretty essential if you're managing a large network. You would want to monitor and track the network device status, configuration changes, network traffic and bandwidth utilization within the network. SolarWinds Orion is made up of several sub-modules that handle different aspects of NMS. For example, SolarWinds Netflow module is necessary to track network application usage and the Network Configuration Manager (NCM) is needed to track configuration changes.

Above all, you would first need to have the Network Performance Monitor (NPM) installed as the base module before you can do anything more. NPM is simply used to monitor the network devices up/down status, as well as measuring basic bandwidth utilization rate at the interface level. Hence, adding new network nodes to the NPM is the first step.

To add new nodes, you can either manually add a single node or enable a network discovery sweep to add multiple nodes at one go. Either way, you must first supply the node IP addresses and SNMP credentials (SNMPv3 is recommended for security reasons). Hence, you must first enable SNMP on the network devices.

For Cisco IOS devices:

'define the snmp scope
(config)# snmp-server view SNMPVIEW dod included
'create a snmp group and permit the group read access to the above view
(config)# snmp-server group SNMPGROUP v3 auth read SNMPVIEW access SNMP_ACL
'create a snmp user and add it to the above group
(config)# snmp-server user SNMPUSER SNMPGROUP v3 auth sha **** access SNMP_ACL
'permit SNMP polling only from the NMS server
(config)# ip access-list standard SNMP_ACL
(config-std-nacl)# permit 1.1.1.1
(config-std-nacl)# deny any

After that, login to SolarWinds Orion as administrator, click on "Manage Node" and then "Add Node". Uncheck the box beside ICMP (Ping only). Supply the node IP address and the SNMP credential that you created above. You can also save the SNMP credential as a template account for subsequent nodes.

Sharing ISO images among Hyper-V hosts

By default, when you want to mount an ISO image to a DVD drive on your Hyper-V VMs, SCVMM would copy the ISO image to the hosting parent partition. For better I/O performance & resiliency, this is desirable when you need to mount the image on a permanent basis. However, quite often, we only need to mount the image temporarily to install some applications.

SCVMM R2 (yes, only the latest version at this time of writing) allows you to share the image over CIFS (a.k.a file share). This saves storage space and time to transfer the image over.


If you read the in-built help, it only briefly mentioned about using "constrained delegation". Constrained delegation (1) allows a computer to impersonate a user account to gain access to resources that normally only available to that user; and (2) constraints the access only to specific services e.g. CIFS. How do configure that? Someone did the step-by-step explanation. Read this blog post.

Publish Offline Certificates and CRLs to Active Directory

This is refering to step 2 and 3 of the earlier post. Before publishing the Root CA cert, check the extensions on the Root CA server, esp on the CRL Distrisbution Point (CDP) extensions.

To publish the offline Root CA cert and CRL to AD, set the "Include in all CRLs" flag in the Root CA extension properties and use the certutil -dspublish command. Do note that file share CDP (FILE://) is not supported - only LDAP:// and HTTP://. I have tried and it's not going to work. Similarly, you would need to specify where clients and servers can obtain the root cert (i.e. LDAP and/or HTTP) in the "Authority Information Access (AIA)" drop-down setting.


The "Include in all CRLs" flag specifies that the Active Directory publication location should be included in the CRL itself. It can be used by an offline CA to specify the LDAP URL for manually publishing CRLs on the Active Directory. The explicit configuration container must be explicitly set in the URL. Alternatively, the DSConfigDN value can be set in the registry by using "certutil –setreg ca\DSConfigDN CN=Configuration,DC=contoso,DC=com". Note that the last two DC values (DC=contoso,DC=com for "contoso.com") are to be replaced by your actual Domain Name.


Export out the Root CA cert and CRL files and import them into a domain member server.
To publish the Root Cert to the Root CA store on the Active Directory: certutil -f -dspublish RootCA.cer RootCA 

To publish the CRL to Active Directory: certutil -f -dspublish Root-Test-CA.crl "LoneSrv1" "Root-Test-CA". The last 2 parameters to specify the containers are optional but could be needed if the offline RootCA is non-Microsoft.