Monthly Archives: February 2015

Exporting TPM Owner Key and BitLocker Recovery Password from Active Directory via PowerShell

Synopsis: When looking up a BitLocker Recovery Password or TPM Owner Key, the process can be quite laborious. This post contains a PowerShell script to help automate the process of manually looking at attributes in Active Directory to pull such information.

Download a copy of the script here (make sure to remove the .txt at the end): Get-TPMandBitlockerInfo.ps1.txt

Run the script with PowerShell

Here are the results it should return

Here is a copy of the script in Plain Text

<#
.SYNOPSIS
    Automates the process on gathering BitLocker recovery password and TPM owner password.

.DESCRIPTION
    This script will lookup multiple attribute in Active Directory and display the correlating
    values that hold sensitive BitLocker information.  Additionally, the TPM Owner Password
    can be exported to a .tpm file, which can be used to make changes to the correlating machine.

.NOTES
    File Name      : Get-TPMandBitlockerInfo.ps1
    Author         : Jack Stromberg (jackstromberg.com)
    Prerequisite   : PowerShell V2 over Vista and upper
    Version History: 2/5/2015 (original release)

.LINK
    Script posted over at:
    http://jackstromberg.com/2015/02/exporting-tpm-owner-key-and-bitlocker-recovery-password-from-active-directory-via-powershell/
#>

clear
Write-Host "~Enter in the correct credentials to access the BitLocker and TPM Owner attributes~"
$UserName = Read-Host "Enter User Name" 
$Password = Read-Host -AsSecureString "Enter Your Password" 
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $UserName , $Password 

# Get input on which machine to lookup
$computer = Read-Host 'Enter in machine name'

# Import our Active Directory PowerShell commands
Import-Module ActiveDirectory

# Check if the Computer Object exists in AD
$computerObject = Get-ADComputer -Filter {cn -eq $computer} -Property msTPM-OwnerInformation, msTPM-TpmInformationForComputer -Credential $credential
if($computerObject -eq $null){
    Write-Host "Computer object not found.  Exiting the script..."
    Cmd /c pause
	Exit
}

# Windows Vista and 7 stores the TPM owner password in the msTPM-OwnerInformation attribute, check that first.
# If the key hasn't been stored there, check the msTPM-TpmInformationForComputer object to see if it was backed up on a Win 8 or greater machine
if($computerObject.'msTPM-OwnerInformation' -eq $null){
    #Check if the computer object has had the TPM info backed up to AD
    if($computerObject.'msTPM-TpmInformationForComputer' -ne $null){
        # Grab the TPM Owner Password from the msTPM-InformationObject
        $TPMObject = Get-ADObject -Identity $computerObject.'msTPM-TpmInformationForComputer' -Properties msTPM-OwnerInformation  -Credential $credential
        $TPMRecoveryKey = $TPMObject.'msTPM-OwnerInformation'
    }else{
        $TPMRecoveryKey = '<not set>'
    }
}else{
    # Windows 7 and older OS TPM Owner Password
    $TPMRecoveryKey = $computerObject.'msTPM-OwnerInformation'
}

# Check if the computer object has had a BitLocker Recovery Password backed up to AD
$BitLockerObject = Get-ADObject -Filter {objectclass -eq 'msFVE-RecoveryInformation'} -SearchBase $computerObject.DistinguishedName -Properties 'msFVE-RecoveryPassword' -Credential $credential | Select-Object -Last 1
if($BitLockerObject.'msFVE-RecoveryPassword'){
    $BitLockerRecoveryKey = $BitLockerObject.'msFVE-RecoveryPassword'
}else{
    $BitLockerRecoveryKey = '<not set>'
}

#Print out our findings
Write-Host 'TPM Owner Recovery Key:' $TPMRecoveryKey
Write-Host 'BitLocker Recovery Password:' $BitLockerRecoveryKey

# Export TPM Owner Password File
if($computerObject.'msTPM-TpmInformationForComputer' -ne $null){
    $exportToFile = Read-Host 'Would you like to export the recovery key [y or n]'
    if($exportToFile -ne 'y'){
        Exit
    }

    $TPMOwnerFile = '<?xml version="1.0" encoding="UTF-8"?><ownerAuth>' + $TPMRecoveryKey + '</ownerAuth>'
    $TPMOwnerFile | Out-File "TPMOwnerPasswordFile.tpm"
}else{
    Cmd /c pause
}

[Tutorial] Configuring BitLocker to store recovery keys in Active Directory

16 Replies

This guide is more of a reflection on the steps I took to publish the BitLocker recovery keys of machines deployed on an Active Directory domain. Microsoft has gobs and gobs of information on this subject which can be a tad overwhelming, so I have tried to consolidate this article down as much as possible, citing Microsoft sources where found. If you have any questions, comments, feedback, please feel free to leave a message below.

Prerequisites

Domain Controllers are running Windows Server 2003 SP1 or greater
Schema Admin or an Enterprise Admin user account privileges

Step 1: Verify your schema is ready (and extend it if applicable)

Based on what I have read, if your DCs were introduced with Server 2008 Beta 3 or later, your schema will be ready, if you started with anything older, your AD environment will more than likely will not have the schema objects/attributes.

Verify you have the schema changes if running Server 2003 R2 or older:

If you are on Server 2003 you will need to open up ADSI edit and verify you have the schema changes (here you can see we are missing the five schema changes for BitLocker)

Verify you have the schema changes if running Server 2008 or newer:

If you are on Server 2008 or greater and have powershell, you can execute the following command (here you can see we have the necessary schema changes to proceed, if you receive 0 results, you will need to extend your schema):

Get-ADObject -SearchBase ((GET-ADRootDSE).SchemaNamingContext) -Filter {Name -like "ms-FVE-*"}

Extending your schema if you don't have the schema changes above

If you need the schema update (you are missing the five schema objects listed in the above powershell command), you can execute the following command via Command Prompt on your Domain Controller:

Note: If you are on Server 2008 r2, it is recommended you extend your schema to Server 2012 or if you just want the BitLocker attributes, use these two ldf files: https://technet.microsoft.com/en-us/library/jj635854.aspx

ldifde -i -v -f BitLockerTPMSchemaExtension.ldf -c "DC=X" "DC=mydomain,DC=local" -k -j .

Yes, you do want the trailing period (.) at the end of the command. It is literally apart of the command, so ensure you execute the command exactly like above (changing your domain of course). You can see the official technet article here for more information on the command: https://technet.microsoft.com/en-us/library/cc766015(v=ws.10).aspx

If you would like to verify everything went well, Microsoft has posted some output on what the command should write: https://technet.microsoft.com/en-us/library/cc722060(v=ws.10).aspx

Step 2: Set the required permissions for backing up TPM password information

Next, we need to add an access control entry (ACE) so that backing up TPM recovery information is possible.

Head over to the following Microsoft document and download each of the VBS scripts they have displayed: Save the following VBS scripts from the following website: https://technet.microsoft.com/en-us/library/dn466534.aspx#Sample scripts

Ensure you are on one of your domain controllers
Open up a command prompt as an administrator
Navigate to your BitLocker folder
Execute the following command on your domain controller
1. cscript Add-TPMSelfWriteACE.vbs
Delegate msTPM-OwnerInformation
1. Open up Active Directory Users and Computers
2. Navigate to the OU that stores your computers, right click, and select Delegate Control...
3. Click Next > button on the welcome screen
4. Click the Add... button
5. Type in SELF, hit the Check Names button, and click OK
6. Click Next >
7. Select Create a custom task to delegate and click Next >
8. Check Only the following objects in the folder, check Computer objects, click Next >
9. Check Property-specific, scroll down and find Write msTPM-OwnerInformation and click Next >
10. Click Finish

Step 3: Configure group policy to back up BitLocker and TPM recovery information to Active Directory

In this step, we will push out the actual policy that tells the machine to push BitLocker and TPM recovery info to Active Directory. We will try to follow some of Microsoft's best practices on deploying the group policy here: https://technet.microsoft.com/en-us/library/dd875532(WS.10).aspx

Login to your domain controller
In Server Manager, open up Group Policy Management
Select the policy you want to edit/deploy for this and hit Edit...
Expand Computer Configuration, expand Policies, expand Administrative Templates, open Windows Components, and then select BitLocker Drive Encryption

Follow the below configuration for each policy (most of these are Microsoft's best practices with a few notes I have made in the Settings)

CATEGORY

SETTING NAME

SETTING

Global

Store BitLocker recovery information in Active Directory Domain Services

Set to enabled, check Require BitLocker backup to AD DS, ensure Recovery passwords and key packages is selected

Global

Choose drive encryption method and cipher strength

Set to not configured.

Global

Prevent memory overwrite on restart

Set to not configured.

Global

Provide the unique identifiers for your organization

Set to enabled, and enter an identifier in the BitLocker identification field (based on what I can tell, you can enter your organization name here).

Operating system drives

Choose how BitLocker-protected operating system drives can be recovered

Set to enabled, Allow 48-digit recovery password, Allow 256-bit recovery key, omit recovery options from the BitLocker setup wizard, Store recovery passwords and key packages, Do not enable BitLocker until recovery information is stored to AD DS for operating system drives.For more information about storing BitLocker recovery information in AD DS, see Backing Up BitLocker and TPM Recovery Information to AD DS.

Operating system drives

Configure minimum PIN length for startup

Set to enabled, and require a personal identification number (PIN) of at least seven numerals.

Operating system drives

Require additional authentication at startup

Set to enabled, and require the use of a startup PIN with a Trusted Platform Module (TPM).

Fixed data drives

Choose how BitLocker-protected fixed drives can be recovered

Fixed data drives

Configure use of passwords for fixed data drives

If your organization does not have a public key infrastructure (PKI), set to enabled, require password complexity, and set a minimum password length of at least 12 characters.

Fixed data drives

Configure use of smart cards on fixed data drives

If your organization has a PKI, set to enabled, and require the use of smart cards with fixed data drives.

Removable data drives

Choose how BitLocker-protected removable drives can be recovered

Removable data drives

Configure use of passwords for removable data drives

Set to enabled, set a minimum password length of at least 12 characters, and require password complexity if your organization does not have a PKI or if there is a need to access BitLocker-protected drives from computers running Windows XP or Windows Vista.

Removable data drives

Configure use of smart cards on removable data drives

Set to enabled, and require the use of smart cards with removable data drives if your organization has a PKI.

Removable data drives

Control use of BitLocker on removable drives

Set to enabled, Allow users to apply BitLocker protection on removable data drives, and uncheck Allow users to suspend and decrypt BitLocker protection on removable data drives.

Removable data drives

Deny write access to removable data drives not protected by BitLocker

Set to enabled, and Do not allow write access to devices configured in another organization.

NOTE
This policy cannot be enabled if your organization uses recovery keys or startup keys. Recovery keys and startup keys must be stored on unencrypted USB drives.

Next, configure Group Policy to backup the TPM owner information; open Computer Configuration, open Administrative Templates, open System, and then open Trusted Platform Module Services
Double-click Turn on TPM backup to Active Directory, check Enabled, and click OK
1. Note: If you are on Server 2008 R2, make sure you select Require TPM backup to AD DS. Based on what I can find, if you are on Server 2012 R2, this option has been removed.
Define a BitLocker Drive Encryption Data Recovery Agent
1. Open Computer Configuration, open Policies, open Windows Settings, open Security Settings, open Public Key Policies, and right click on BitLocker Drive Encryption and select Add Data Recovery Agent...
2. Click Next > on the Add Recovery Agent Wizard
3. Select a Recovery agent and click Next >
  1. If you are using PKI, select the Browse Directory... button and select a user that has been configured with an EFS certificate. I found this guide the most helpful on setting this process up (if anyone has a guide to an official Microsoft document explaining the best practices on configuring this, please drop a comment below: http://technetlibrary.com/use-data-recovery-agent-dra-decrypt-encrypted-files-domain/163)
    1. Here is the only official Microsoft article that I could find that explains the configuration of the Data Recovery Agent: https://technet.microsoft.com/en-us/library/dd875560%28v=ws.10%29.aspx#BKMK_proc_dra
  2. If you don't have a PKI environment setup, you can use a self signed certificate by opening up a command prompt and executing the following command: cipher /r:administrator
    1. Copied from the cipher command: This command generates an EFS recovery key and certificate, then writes them to a .PFX file (containing certificate and private key) and a .CER file (containing only the certificate). An administrator may add the contents of the .CER to the EFS recovery policy to create the recovery key for users, and import the .PFX to recover individual files. If SMARTCARD is specified, then writes the recovery key and certificate to a smart card. A .CER file is generated (containing only the certificate). No .PFX file is generated.
4. Click Finish on the Add Recovery Agent Wizard

Step 4: Install the BitLocker Password Recovery Viewer

On your domain controller, open up Server Manager
Select Manage, Add Roles and Features
Click Next >
Click Next >
Click Next >
Click Next > (You don't need to add any additional roles)
Check BitLocker Drive Encryption (click Add Features when prompted) and click Next >
Click Install
Click Close
Repeat these steps for each domain controller you want to manage BitLocker on

Step 5: Push existing BitLocker protected machines to Active Directory (optional step)

Open an Administrative Command prompt on the client machine that has a BitLocker enabled drive
Execute the following command to get your current BitLocker information
manage-bde -protectors -get c:
Execute the following command to publish this information to AD
manage-bde -protectors -adbackup c: -id {yourNumericalPasswordID}
Login to one of the domain controllers you installed the BitLocker Recovery Viewer feature and open up Active Directory Users and Computers
Find your computer object and right click Properties on it
Select the BitLocker Recovery tab and verify the recovery passwords have been published

Notes: By default, Windows Vista and greater clients running BitLocker will backup the owner the owner password to the msTPM-OwnerInformation attribute. If you notice this field is <Not Set> for your Windows 8 and greater machines, ensure you check the TPM Devices container in Active Directory Users and Computers for the recovery information.

To automate the process of looking up the Bitlocker Recovery Password and Owner TPM Recovery Key, I have written a powershell script which can be found here: http://jackstromberg.com/2015/02/exporting-tpm-owner-key-and-bitlocker-recovery-password-from-active-directory-via-powershell/

[Tutorial] Configuring Lync Server 2013 to block calls based on Caller ID

3 Replies

Synopsis: Out of the box, Lync Server 2013 does not have any way to block specific calls destined to any user or specific user inside of an organization. However, Microsoft added in the ability for users/partners/etc. to write custom scripts to help allow flexibility in Lync. That being said, this tutorial will go over deploying a custom script to allow Lync Server to block calls based on caller ID.

Before we begin, I would like to give credit to a few individuals. This guide will make use of David Paulino's guide/script for Lync Server 2013 (http://uclobby.com/2014/07/31/calleridblock/), which was a converted script from VoIP Norm's original Lync Server 2010 script (http://voipnorm.blogspot.co.uk/2011/06/blocking-calls-in-lync-based-on-caller.html). The only changes in this article is a more step-by-step deployment guide as well as the ability to control blocking of numbers at a user level and the ability to optionally leave comments on why a rule was added.

Tutorial

Download a copy of the CallerIDBlock.am.txt script (or copy and paste this script into a file called CallerIDBlock.am) (if you downloaded this file, make sure you remove the .txt at the end)
1. <?xml version="1.0" ?> <lc:applicationManifest lc:appUri="http://jackstromberg.com/2015/02/CallerIDBlock" xmlns:lc="http://schemas.microsoft.com/lcs/2006/05"> <lc:requestFilter methodNames="ALL" strictRoute="true"/> <lc:responseFilter reasonCodes="NONE"/> <lc:scriptOnly/> <lc:file name="BlockedTelephoneNumbers" path="\\<Lync Share Path>\CallerIDBlock\BlockedTelephoneNumbers.txt" delimitedBy="comma" keyColumnName="FromSIP" static="false"> <lc:column name="FromSIP" /> <lc:column name="ToSIP" /> <lc:column name="Action" /> <lc:column name="Comments" /> </lc:file> <lc:splScript><![CDATA[/*
  Module Name: CallerIDBlock.am
  */if(sipRequest.Method == "INVITE"){
  fromSIPUser = GetUserName(GetUri(sipRequest.From));
  toSIPUser = GetUserName(GetUri(sipRequest.To));
  sep = IndexOfString(fromSIPUser, ";");Log ("Debugr", false, "CallerIDBlock processing request:");
  Log ("Debugr", false, "From - ", fromSIPUser);
  Log ("Debugr", false, "To - ", toSIPUser);
  if(sep != -1) {
  fromSIPUser = SubString(fromSIPUser, 0, sep);
  }
  
  action = BlockedTelephoneNumbers[fromSIPUser].Action;
  if(action == "block") {
  if(BlockedTelephoneNumbers[fromSIPUser].ToSIP == "*" || BlockedTelephoneNumbers[fromSIPUser].ToSIP == toSIPUser){
  Log ("Debugr", false, "Rejected by CallerIDBlock");
  Respond(403, "Forbidden");
  }
  } else {
  Log ("Debugr", false, "Allowed by CallerIDBlock");
  }
  }
  return;
  ]]></lc:splScript>
  </lc:applicationManifest>
Download a copy of the BlockedTelephoneNumbers.txt file (or copy and paste the code below into a file called BlockedTelephoneNumbers.txt)
1. FromSIP,ToSIP,Action,Comments
Edit the CallerIDBlock.am file and change the BlockedTelephoneNumbers path to be your fileshare
Edit the list of blocked numbers inside the BlockedTelephoneNumbers.txt file
1. Notes: The FromSIP address is the Caller ID of the incoming call; the ToSIP is the individual that is trying to be reached (side-note, in this particular script, if you set this field so an asterisk (*), this will be a wildcard for any/every user; the Action should be set to "block" to block the call; the Comments field is an optional field to document when/why the number was added to be blocked
Create a new folder where your Lync share is
Copy the CallerIDBlock.am and BlcokedTelephoneNumbers.txt files to your Lync Share where your new CallerIDBlock folder is
Add the CallerIDBlock script as a Lync Server Application
1. Open up the Lync Server Manage Shell as an Administrator
2. New-CsServerApplication -Identity "Service:Registrar:<Lync Front End Pool>/CallerIDBlock" -Uri http://jackstromberg.com/2015/02/CallerIDBlock -Critical $false -ScriptName "\\<Lync Share Path>\CallerIDBlock\CallerIDBlock.am"
Enable the CallerIDBlockLync Server Application
1. Set-CsServerApplication -Identity "Service:Registrar:<Lync Front End Pool>/CallerIDBlock" -Enabled $true
Verify the script is actively listening for calls
1. Open up Event Viewer, navigate to Applications and Services Logs, Lync Server, and verify you see Event ID 30208