Windows 7:n yleistymisen myötä olisi kiva tietää, missä koneissa ja missä osioissa BitLocker on käytössä sekä onko TPM-piiri aktivoitu. Tein pienen laajennuksen SMS_DEF.MOF:iin, joilla nämä määrittelyt voidaan havaita.
Lisää seuraava pätkä site serverin SMS_DEF.MOF-tiedoston loppuun:
-------------
//
// BitLocker related information
// Panu Saukko, 17.11.2010
[ SMS_Report (TRUE),
SMS_Group_Name ("BitLocker Volume Encryption"),
SMS_Class_ID ("MICROSOFT|BITLOCKER_VOLUME_ENC|1.0"),
SMS_Namespace (FALSE),
Namespace ("\\\\\\\\localhost\\\\root\\\\cimv2\\\\security\\\\MicrosoftVolumeEncryption") ]
class Win32_EncryptableVolume : SMS_Class_Template
{
[SMS_Report (TRUE), key ]
string DeviceID;
[SMS_Report (TRUE) ]
string DriveLetter;
[SMS_Report (FALSE) ]
string PersistentVolumeID;
[SMS_Report (TRUE) ]
uint32 ProtectionStatus;
};
[ SMS_Report (TRUE),
SMS_Group_Name ("Trusted Platform Module"),
SMS_Class_ID ("MICROSOFT|TRUSTED_PLATFORM_MODULE|1.0"),
SMS_Namespace (FALSE),
Namespace ("\\\\\\\\localhost\\\\root\\\\cimv2\\\\security\\\\MicrosoftTPM") ]
class Win32_TPM : SMS_Class_Template
{
[SMS_Report (TRUE) ]
boolean IsActivated_InitialValue;
[SMS_Report (TRUE) ]
boolean IsEnabled_InitialValue;
[SMS_Report (TRUE) ]
boolean IsOwned_InitialValue;
[SMS_Report (FALSE), key]
uint32 ManufacturerId;
[SMS_Report (TRUE) ]
string ManufacturerVersion;
[SMS_Report (FALSE) ]
string ManufacturerVersionInfo;
[SMS_Report (FALSE) ]
string PhysicalPresenceVersionInfo;
[SMS_Report (TRUE) ]
string SpecVersion;
};
-------------
Seuraavassa on kaksi raporttia näihin BitLocker-tietoihin:
- tietyn koneen BitLocker-tiedot
- kaikki tietyn collectionin koneet, joiden osiot eivät ole suojattu BitLockerilla
Kopioi seuraava pätkä uudeksi MOF-tiedostoksi ja lisää raportit ConfigMgr:n Import Objects -toiminnallisuudella.
-------------
// *********************************************************************************
//
// Created by SMS Export object wizard
//
// 19. marraskuuta 2010 created
//
// File Name: bitlocker reports.mof
//
// Comments :
//
//
// *********************************************************************************
// ***** Class : SMS_Report *****
[SecurityVerbs(140551)]
instance of SMS_Report
{
Category = "Hardware - Disk";
Comment = "Displays summary information about the Bitlocker state on a computer";
DrillThroughColumns = {};
MachineDetail = TRUE;
MachineSource = FALSE;
Name = "Bitlocker information for a specific computer";
NumPrompts = 1;
RefreshInterval = 0;
ReportGUID = "{F04893FC-2827-4095-92BB-33A0B86CCBAD}";
ReportParams = {
instance of SMS_ReportParameter
{
AllowEmpty = FALSE;
DefaultValue = "";
PromptText = "Computer Name";
SampleValueSQL = "begin
\n if (@__filterwildcard = '')
\n SELECT DISTINCT SYS.Netbios_Name0 from v_R_System SYS ORDER By SYS.Netbios_Name0
\n else
\n SELECT DISTINCT SYS.Netbios_Name0 from v_R_System SYS
\n WHERE SYS.Netbios_Name0 like @__filterwildcard
\n ORDER By SYS.Netbios_Name0
\nend";
VariableName = "variable";
}};
SecurityKey = "";
SQLQuery = "SELECT Distinct SYS.Netbios_Name0, BITL.DriveLetter0 as 'Drive',
\n'Bitlocker Status' =
\nCASE
\n\twhen BITL.ProtectionStatus0 = 0 then 'Not protected'
\n\twhen BITL.ProtectionStatus0 = 1 then 'Protected'
\n\twhen BITL.ProtectionStatus0 = 2 then 'Unknown'
\n\telse 'Not defined'
\nEND
\nFROM v_R_System SYS
\nJOIN v_GS_BITLOCKER_VOLUME_ENC BITL on SYS.ResourceID = BITL.ResourceID
\nWHERE \tSYS.Netbios_Name0 LIKE @variable
\nORDER BY SYS.Netbios_Name0";
StatusMessageDetailSource = FALSE;
UnicodeData = FALSE;
};
// ***** End *****
// ***** Class : SMS_Report *****
[SecurityVerbs(140551)]
instance of SMS_Report
{
Category = "Hardware - Disk";
Comment = "Displays a list of computers that don't have all their volumes protected by BitLocker";
DrillThroughColumns = {};
MachineDetail = FALSE;
MachineSource = FALSE;
Name = "Computers with volumes which are not protected by Bitlocker";
NumPrompts = 1;
RefreshInterval = 0;
ReportGUID = "{F097C663-C655-4157-A117-2B592AE396FE}";
ReportParams = {
instance of SMS_ReportParameter
{
AllowEmpty = FALSE;
DefaultValue = "";
PromptText = "Collection ID";
SampleValueSQL = "begin
\n if (@__filterwildcard = '')
\n select CollectionID, Name from v_Collection order by Name
\n else
\n select CollectionID, Name from v_Collection
\n WHERE CollectionID like @__filterwildcard
\n order by Name
\nend";
VariableName = "CollID";
}};
SecurityKey = "";
SQLQuery = "SELECT Distinct SYS.Name, BITL.DriveLetter0 as 'Drive',
\n'Bitlocker Status' =
\nCASE
\n\twhen BITL.ProtectionStatus0 = 0 then 'Not protected'
\n\twhen BITL.ProtectionStatus0 = 1 then 'Protected'
\n\twhen BITL.ProtectionStatus0 = 2 then 'Unknown'
\n\telse 'Not defined'
\nEND
\nFROM v_FullCollectionMembership SYS
\nJOIN v_GS_BITLOCKER_VOLUME_ENC BITL on SYS.ResourceID = BITL.ResourceID
\nWHERE \tBITL.ProtectionStatus0=0 and
SYS.CollectionID=@CollID\nORDER BY SYS.Name";
StatusMessageDetailSource = FALSE;
UnicodeData = FALSE;
};
// ***** End *****
----------