Windows OS Refresh Process Guide for UEFI Systems

Transcription

1 McAfee Drive Encryption 7.x Windows OS Refresh Process Guide for UEFI Systems Revision B Last updated: 13 April 2018 Contents Disclaimer Introduction Planning the refresh process Creating the Task Sequence Disclaimer The information contained in this document is subject to change without notice. MCAFEE, LLC MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. McAfee shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. McAfee reserves the right to add, subtract or modify features or functionality, or modify the product, at its sole discretion, without notice. McAfee makes no commitment, implied or otherwise, to support any functionality or technology discussed or referenced in this document 2

2 Introduction The McAfee Drive Encryption product provides full disk encryption for enterprises. Purpose and scope The purpose of this document is to provide a recommended process for refreshing systems running Windows operating systems in Unified Extensible Firmware Interface (UEFI) mode only, which are encrypted with McAfee Drive Encryption 7.x. The purpose of the process described in this document is to refresh the Windows operating system without the need of decrypting the hard drive and uninstalling McAfee Drive Encryption. In this guide, OS Refresh is referred to as the process whereby the disk hosting the operating system is cleared and a new operating system installed by laying an image using a tool that works at file level and not at sector level. The process and utilities provided address the common problems occurring, whilst maintaining the encrypted drive during OS refresh. Intended audience The intended audience for this document are IT administrators with a thorough knowledge and experience in reimaging via Microsoft System Center 2016 Configuration Manager (SCCM), Microsoft Deployment Toolkit (MDT) 6.3 and McAfee Drive Encryption 7.x. Here are the main products and features that you will need to have knowledge of: McAfee Drive Encryption administration Microsoft System Center 2016 Configuration Manager (SCCM) Microsoft Windows 10 Assessment and Deployment Kit (ADK) Microsoft Deployment Toolkit (MDT) 6.3 Understanding of UEFI boot process Understanding of Windows Registry Understanding of Windows command line usage Understanding of the use and purpose of Operating System drivers Requirements The minimum requirements for the server environment which hosts the Microsoft System Center Configuration Manager (SCCM) are as follows: Microsoft System Center 2016 Configuration Manager (SCCM) Microsoft Windows 10 Assessment and Deployment Kit (ADK) Microsoft Deployment Toolkit (MDT) 6.3 McAfee Drive Encryption (DE) 7.1.x, DE 7.2.x Any images must be captured via SCCM or MDT by following Microsoft official guidelines. For more information please visit: us/library/dd744389(v=ws.10).aspx 3

3 Planning the refresh process The following section describes how to plan and prepare a refresh process for Windows operating systems. This includes describing the McAfee Drive Encryption boot process, preparation of images and requirements for the refresh process. Overview of the McAfee Drive Encryption Boot Process Prior to EFI, PC s relied on bootstrapping programs stored in the Master Boot Record (for Windows based PC s) to start the boot process. EFI, however, relies on a boot manager that is built in to the firmware of the machine. A designated partition, known as the EFI System Partition, contains boot loader programs, which are EFI executable programs that are loaded and run by the EFI boot manager. During the boot process the Hard Drive is searched for an EFI system partition, the EFI boot manager will then look for an EFI executable to run which is stored within the EFI partition. This program is architecture specific, for 64 bit systems the program is Bootx64.efi and for 32 bit systems the program is Bootia32.efi. With McAfee Drive Encryption installed these files are replaced with files of the same name that will call the pre boot environment. It is there for essential that this partition is not replaced in anyway otherwise the target machine will fail to boot. Preparing the Operating System images In order to refresh an operating system, an image has to be prepared that will be laid over the encrypted disk. This can be done in a number of ways via SCCM or MDT. However, any image that is captured, which results in a WIM file, must have the McAfee Drive Encryption drivers and registry entries injected prior to the refresh process. This will allow the new system to access the disk when it tries to boot. To do this McAfee has provided an executable called EpeWinUpgradeTool.exe for 32 bit systems and the EpeWinUpgradeTool64.exe for 64 bit systems. This tool can be run from a command line with Administrator rights to inject the McAfee Drive Encryption drivers and registry amendments. Prior to running the tool extract the following files from the MfeEEPC32.msi (for 32bit systems) or the MfeEEPC64.msi (for 64bit systems): MfeEpePC.sys Mfeccde.sys MfeEpeOpal.sys Place these files within a folder located in a convenient location: Example C:\Drivers From a command line run the following command for x64 architecture: Example EpeWinUpgradeTool64.exe inject C:\drivers C:\OSWIMFILE.wim This will inject the McAfee Drive Encryption drivers and make the necessary registry amendments in the target WIM file. Once complete, the WIM file can either be imported into the SCCM/MDT environment or have its contents re distributed to the distribution points within SCCM/MDT. Preparing the Windows PE images (Boot image) The Windows PE environment is used for installing or refreshing operating systems. The McAfee Drive Encryption driver has to be included within the Windows PE image so the encrypted drive can be accessed by the installer. If you are planning to refresh for both 32 bit and 64 bit systems, then you will require two independent PE images, one for 64 bit and one for 32 bit respectively. To do this the procedure is the same as injecting the McAfee Drive Encryption drivers and registry amendments into an Operating System WIM file. 4

4 Prior to running the EpeWinUpgrade Tool extract the following files from the MfeEEPC32.msi (for 32bit systems) or the MfeEEPC64.msi (for 64bit systems). Note: The drivers are the same for both the Operating System injection and the Boot Image injection: MfeEpePC.sys Mfeccde.sys MfeEpeOpal.sys Place these files within a folder located in a convenient location. Example C:\Drivers From a command line run the following command for x64 architecture: Example EpeWinUpgradeTool64.exe inject C:\drivers C:\BOOTWIMFILE.wim This will inject the McAfee Drive Encryption drivers and make the necessary registry amendments in the target WIM file. Once complete the WIM file can either be imported into the SCCM/MDT environment or have its contents re distributed to the distribution points within SCCM/MDT. It is also required to place a copy of the EpeWinUpgradeTool into the boot image. If the image is 32 bit use the EpeWinUpgradeTool.exe if the image is 64 bit use the EpeWinUpgradeTool64.exe. Preparing the Target Machine for OS refresh The target machines will require the EpeWinUpgrade tool to be stored locally on the PC in the root of C:\ prior to the Task Sequence being initiated. EpeWinUpgradeTool Expanded A utility was developed to allow administrators to carry out the necessary steps during the OS refresh process. As previously mention in this guide the utility is called EpeWinUpgradeTool.exe (32 bit) and EpeWinUpgradeTool64.exe (64 bit). The utility can be run at the command line with administrative rights and offers the following options: -Inject <Drivers Dir> <Image> -MountWim <Image> <Mount Path> -UnmountWim <Mount Path> [Save] -ForceMBR <Filename> Injects McAfee Drive Encryption drivers into a WIM Image Mount Image in a specified Directory Unmount the image. Update image if Save Restore MBR from file continuously 5

5

6 Creating the Task Sequence 1) On SCCM console goto Software Library > Operating System > Task Sequence 2) Right click and select Create Task sequence 3) Select Install an existing image package 7

7 4) Task sequence information > boot image = the boot image with MDE drivers injected 5) On Install Windows a) Image = the new OS image with MDE drivers injected b) Partition and format the target computer before installing the operating system = off c) Configure task sequence for use with BitLocker, as shown below 8

8 6) On Install configuration management client, use the default 7) On Configure state migration: a) Select a USMT package, the default one from Windows ADK 5 or above is recommended b) Select Save user settings and files locally, and also enable Capture locally by using link instead of by copying files 9

9 8) Complete the wizard 9) In the Software Library workspace, click Task Sequences, right-click on the task sequence just created, and then click Edit 10) Add these steps within State Capture a) Click on State Capture group and click Add > General > Run Command Line i. name = Shutdown MDE services ii. iii. command line = SC Stop "McAfee Endpoint Encryption Agent" click on options > enable Continue on Error b) click Add > new group i. name = Backup UEFI bootcode ii. This new group must be on the same level as Backup EEPC MBR c) click Add > General > Run Command Line: i. name = Mount EFI Partition ii. command line = MountVol y: /s d) click Add > General > Run Command Line: i. name = Restore MDE Boot code 1 ii. command line = xcopy y:\efi\mcafee\epe\mfeeeboot.efi y:\efi\boot\bootx64.efi /y e) click Add > General > Run Command Line: i. name = Restore MDE Boot Code 2 ii. command line = xcopy y:\efi\mcafee\epe\mfeeeboot.efi y:\efi\microsoft\boot\bootmgfw.efi /y 10

10 11) Add these steps within Install a) Right click on the Backup UEFI bootcode group > copy b) Scroll down to the Install group right click on Apply Operating System Image > paste. c) Click Mount EFI Partition > Add > General > Run Command Line: i. name = backup MS bootcodes ii. command line = xcopy y:\efi\microsoft\boot\bootmgfw.efi y:\efi\mcafee\epe\msboot.efi /y 11

11 Copyright 2018 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 12