mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-22 05:43:41 +00:00
Merge branch 'master' of https://cpubwin.visualstudio.com/_git/it-client into sec-landing-page
This commit is contained in:
Justin Hall
@ -19,13 +19,13 @@ ms.date: 11/08/2017
|
||||
|
||||
> This guide only applies to Windows 10, version 1703 or higher.
|
||||
|
||||
Windows Hello for Business is the springboard to a world without passwords. It replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair.
|
||||
Windows Hello for Business is the springboard to a world without passwords. It replaces username and password sign-in to Windows with strong user authentication based on an asymmetric key pair.
|
||||
|
||||
This deployment guide is to guide you through deploying Windows Hello for Business, based on the planning decisions made using the Planning a Windows Hello for Business Deployment Guide. It provides you with the information needed to successfully deploy Windows Hello for Business in an existing environment.
|
||||
|
||||
## Assumptions
|
||||
|
||||
This guide assumes a baseline infrastructure exists that meets the requirements for your deployment. For either hybrid or on-premises deployments, it is expected that you have:
|
||||
This guide assumes that baseline infrastructure exists which meets the requirements for your deployment. For either hybrid or on-premises deployments, it is expected that you have:
|
||||
* A well-connected, working network
|
||||
* Internet access
|
||||
* Multifactor Authentication Server to support MFA during Windows Hello for Business provisioning
|
||||
@ -34,17 +34,20 @@ This guide assumes a baseline infrastructure exists that meets the requirements
|
||||
* Active Directory Certificate Services 2012 or later
|
||||
* One or more workstation computers running Windows 10, version 1703
|
||||
|
||||
If you are installing a role for the first time, ensure the appropriate server operating system is installed, updated with the latest patches, and joined to the domain. This document provides guidance to install and configure the specific roles on that server.
|
||||
If you are installing a server role for the first time, ensure the appropriate server operating system is installed, updated with the latest patches, and joined to the domain. This document provides guidance to install and configure the specific roles on that server.
|
||||
|
||||
Do not begin your deployment until the hosting servers and infrastructure (not roles) identified in your prerequisite worksheet are configured and properly working.
|
||||
|
||||
## Deployment and trust models
|
||||
|
||||
Windows Hello for Business has two deployment models: Hybrid and On-premises. Each deployment model has two trust models: Key trust or certificate trust.
|
||||
Windows Hello for Business has two deployment models: Hybrid and On-premises. Each deployment model has two trust models: *Key trust* or *certificate trust*.
|
||||
|
||||
Hybrid deployments are for enterprises that use Azure Active Directory. On-premises deployments are for enterprises who exclusively use on-premises Active Directory. Remember that the environments that use Azure Active Directory must use the hybrid deployment model for all domains in that forest.
|
||||
Hybrid deployments are for enterprises that use Azure Active Directory. On-premises deployments are for enterprises who exclusively use on-premises Active Directory. Remember that the environments that use Azure Active Directory must use the hybrid deployment model for all domains in that forest.
|
||||
|
||||
The trust model determines how you want users to authentication to the on-premises Active Directory. Remember hybrid environments use Azure Active Directory and on-premises Active Directory. The key-trust model is for enterprises who do not want to issue end-entity certificates to their users and they have an adequate number of 2016 domain controllers in each site to support the authentication. The certificate-trust model is for enterprise that do want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today. The certificate trust model is also enterprise who are not ready to deploy Windows Server 2016 domain controllers.
|
||||
The trust model determines how you want users to authenticate to the on-premises Active Directory:
|
||||
* The key-trust model is for enterprises who do not want to issue end-entity certificates to their users and have an adequate number of 2016 domain controllers in each site to support authentication.
|
||||
* The certificate-trust model is for enterprise that *do* want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today.
|
||||
* The certificate trust model also supports enterprises which are not ready to deploy Windows Server 2016 Domain Controllers.
|
||||
|
||||
Following are the various deployment guides included in this topic:
|
||||
* [Hybrid Key Trust Deployment](hello-hybrid-key-trust.md)
|
||||
@ -55,5 +58,5 @@ Following are the various deployment guides included in this topic:
|
||||
|
||||
## Provisioning
|
||||
|
||||
The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**.
|
||||
Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**.
|
||||
|
||||
|
||||
@ -17,14 +17,7 @@ ms.date: 04/19/2017
|
||||
|
||||
This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption.
|
||||
|
||||
The following sections provide information that will help you put together your basic deployment plan for implementing BitLocker in your organization:
|
||||
|
||||
- [Using BitLocker to encrypt volumes](#bkmk-dep1)
|
||||
- [Down-level compatibility](#bkmk-dep2)
|
||||
- [Using manage-bde to encrypt volumes with BitLocker](#bkmk-dep3)
|
||||
- [Using PowerShell to encrypt volumes with BitLocker](#bkmk-dep4)
|
||||
|
||||
## <a href="" id="bkmk-dep1"></a>Using BitLocker to encrypt volumes
|
||||
## Using BitLocker to encrypt volumes
|
||||
|
||||
BitLocker provides full volume encryption (FVE) for operating system volumes, as well as fixed and removable data volumes. To support fully encrypted operating system volumes, BitLocker uses an unencrypted system volume for the files required to boot, decrypt, and load the operating system. This volume is automatically created during a new installation of both client and server operating systems.
|
||||
|
||||
@ -182,8 +175,9 @@ Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Window
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
### Encrypting volumes using the manage-bde command line interface
|
||||
|
||||
|
||||
## <a href="" id="bkmk-dep3"></a>Encrypting volumes using the manage-bde command line interface
|
||||
|
||||
Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](http://technet.microsoft.com/library/ff829849.aspx).
|
||||
Manage-bde offers a multitude of wider options for configuring BitLocker. This means that using the command syntax may require care and possibly later customization by the user. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected.
|
||||
@ -240,9 +234,8 @@ A common protector for a data volume is the password protector. In the example b
|
||||
manage-bde -protectors -add -pw C:
|
||||
manage-bde -on C:
|
||||
```
|
||||
## <a href="" id="bkmk-dep3"></a>Using manage-bde to encrypt volumes with BitLocker
|
||||
|
||||
### Encrypting volumes using the BitLocker Windows PowerShell cmdlets
|
||||
## <a href="" id="bkmk-dep4"></a>Encrypting volumes using the BitLocker Windows PowerShell cmdlets
|
||||
|
||||
Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Using Windows PowerShell's scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets.
|
||||
<table>
|
||||
@ -442,9 +435,7 @@ Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup "<SID>
|
||||
```
|
||||
> **Note:** Active Directory-based protectors are normally used to unlock Failover Cluster enabled volumes.
|
||||
|
||||
## <a href="" id="bkmk-dep4"></a>Using PowerShell to encrypt volumes with BitLocker
|
||||
|
||||
### Checking BitLocker status
|
||||
## <a href="" id="bkmk-dep5"></a> Checking BitLocker status
|
||||
|
||||
To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We will look at each of the available methods in the following section.
|
||||
|
||||
|
||||
@ -100,15 +100,16 @@ Before you create a thorough BitLocker recovery process, we recommend that you t
|
||||
|
||||
1. Click the **Start** button, type **cmd** in the **Start Search** box, right-click **cmd.exe**, and then click **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press ENTER:
|
||||
`manage-bde -forcerecovery <Volume>`
|
||||
`manage-bde -forcerecovery <BitLockerVolume>`
|
||||
|
||||
|
||||
**To force recovery for a remote computer**
|
||||
|
||||
1. On the Start screen, type **cmd.exe**, and then click **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press ENTER:
|
||||
`manage-bde. -ComputerName <ComputerName> -forcerecovery <Volume>`
|
||||
`manage-bde. -ComputerName <RemoteComputerName> -forcerecovery <BitLockerVolume>`
|
||||
|
||||
> **Note:** *ComputerName* represents the name of the remote computer. *Volume* represents the volume on the remote computer that is protected with BitLocker.
|
||||
> **Note:** Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user.
|
||||
|
||||
## <a href="" id="bkmk-planningrecovery"></a>Planning your recovery process
|
||||
|
||||
|
||||
@ -1056,37 +1056,37 @@ To deploy and manage a WDAC policy with Group Policy:
|
||||
|
||||
1. On a domain controller on a client computer on which RSAT is installed, open the GPMC by running **GPMC.MSC** or searching for “Group Policy Management” in Windows Search.
|
||||
|
||||
2. Create a new GPO: right-click an OU, for example, the **DG Enabled PCs OU**, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 3.
|
||||
2. Create a new GPO: right-click an OU and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 3.
|
||||
|
||||
> **Note** You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies (or keeping them separate), as discussed in [Planning and getting started on the Windows Defender Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md).
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 3. Create a GPO
|
||||
Figure 3. Create a GPO
|
||||
|
||||
3. Name new GPO **Contoso GPO Test**. This example uses Contoso GPO Test as the name of the GPO. You can choose any name that you prefer for this example.
|
||||
3. Name new GPO. You can choose any name.
|
||||
|
||||
4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**.
|
||||
|
||||
5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Windows Defender Device Guard. Right-click **Deploy Windows Defender Application Control** and then click **Edit**.
|
||||
5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Deploy Windows Defender Application Control** and then click **Edit**.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 4. Edit the group policy for Windows Defender Application Control
|
||||
Figure 4. Edit the Group Policy for Windows Defender Application Control
|
||||
|
||||
6. In the **Deploy Windows Defender Application Control** dialog box, select the **Enabled** option, and then specify the code integrity policy deployment path.
|
||||
|
||||
In this policy setting, you specify either the local path in which the policy will exist on the client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. For example, with DeviceGuardPolicy.bin on the test computer, the example file path would be C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 5.
|
||||
In this policy setting, you specify either the local path in which the policy will exist on the client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. For example, with DeviceGuardPolicy.bin on the test computer, the example file path would be C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 5.
|
||||
|
||||
> [!Note]
|
||||
> The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). Also, this policy file does not need to be copied to every computer. You can instead copy the WDAC policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers.
|
||||
> [!Note]
|
||||
> The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a Windows Defender Application Control policy from a reference computer](#create-a-windows-defender-application-control-policy-from-a-reference-computer). Also, this policy file does not need to be copied to every computer. You can instead copy the WDAC policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers.
|
||||
|
||||
|
||||
|
||||
|
||||
Figure 5. Enable the Windows Defender Application Control policy
|
||||
Figure 5. Enable the Windows Defender Application Control policy
|
||||
|
||||
> [!Note]
|
||||
> You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Make your WDAC policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository.
|
||||
> [!Note]
|
||||
> You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Make your WDAC policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository.
|
||||
|
||||
7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. Restarting the computer updates the WDAC policy. For information about how to audit WDAC policies, see the [Audit Windows Defender Application Control policies](#audit-windows-defender-application-control-policies) section.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user