Federal Desktop Core Configuration : Webcasts

Q&A From "Using BitLocker with FDCC and FIPS" webcast

Aaron Margosis — Thu, 29 May 2008 21:18:00 GMT

Q&A content from the "Using BitLocker with FDCC and FIPS" webcast from May 27, 2008. The recording of the webcast may be viewed on-demand here.

Question: You may have mentioned this earlier but should FIPS be setup before or after FDCC?

Answer: FIPS should be enabled and applied to the end system before BitLocker Drive Encryption is enabled. If the FIPS compliance setting is enabled after the drive has been encrypted, you must turn off BitLocker (decrypt the drive) and then re-enable BitLocker.

Question: What would be the deployment strategy for telecommuters?

Answer: I recommend reading the Windows BitLocker Design and Deployment guides (http://www.microsoft.com/downloads/details.aspx?familyid=41ba0cf0-57d6-4c38-9743-b7f4ddbe25cd&displaylang=en&tm). Some factors to consider:

· How many systems will need to be activated ( > 15 systems, recommend WMI scripts)

· Are the systems domain attached

· Initializing the TPM chip and enabling BitLocker requires administrative right.

Question: Does bitlocker work on solid state hard drives?

Answer: Yes, as long as the drive is an NTFS formatted and is Vista compatible.

Question: Any references/examples of govt agencies that have tested or used Bitlocker?

Answer: Not at this time, but I will inquire further.

Webcast for upcoming Local GPO tool

Aaron Margosis — Fri, 25 Apr 2008 23:32:00 GMT

Updated, 28 April 2008

We're preparing a new utility for public release and will be demonstrating it in a webcast on Thursday, May 8, 2008 ~~Tuesday, April 29, 2008~~, 2:30pm Eastern time.

The utility is called Apply_LGPO_Delta, and makes it possible to automate custom changes to local group policy. It is intended to be used in conjunction with Set_FDCC_LGPO: After you run Set_FDCC_LGPO to apply all the NIST GPO settings to local group policy, you can run Apply_LGPO_Delta to make specific changes to those settings.

Updated 28 April 2008, 11:51pm EDT:

Click here to register for the webcast.

(The webcast was postponed from its original date because of technical problems with the event registration site. The issues have now been fixed. Sorry for the inconvenience.)

FDCC Webcast: FIPS Challenges - Q & A

Mandy Tidwell — Tue, 29 Jan 2008 08:07:00 GMT

Author: Paul Fox, Senior Consultant

Question: Is it possible to save more than 1 Set of Recovery Keys to a single USB drive?

Answer: Yes, you can save multiple BitLocker recovery keys to single USB drive. The size of a key is 124 bytes.

More information can be found at http://technet2.microsoft.com/WindowsVista/en/library/ce4d5a2e-59a5-4742-89cc-ef9f5908b4731033.mspx?mfr=true

Question: Is the deadline still February 1, 2008 or pushed to March 31, 2008?

Answer: Yes, the deadline is still February 1, 2008 to have tested FDCC, but SCAP reporting on compliance is not due until March 31, 2008. Please contact fdcc@nist.gov for more information.

Question: Have you seen problems with FIPS and servers Win2k using MSMQ

Answer: The Message Queue task fails to comply with Federal Information Processing Standard (FIPS) 140-2 when the computer's operating system is configured in FIPS mode and the task uses encryption. If the Message Queue task does not use encryption, the task can run successfully.

When configuring the Message Queue task to send messages, you can use one of the encryption algorithms that are currently supported by Message Queuing, RC2 and RC4, to encrypt the message. Both of these encryption algorithms are now considered cryptographically weak compared to newer algorithms, which Message Queuing does not yet support. Therefore, you should consider your cryptography needs carefully when sending messages using the Message Queue task.

More information can be found at: http://msdn2.microsoft.com/en-us/library/ms141227.aspx & http://support.microsoft.com/kb/245030/

Question: Re; SSL certificates untrusted source - We use this type of certificate in our development and test environments, but not production. Can the option to trust the site allowed in only our dev and test environments be enabled?

Answer: Yes, in your development and test environments you can publish the SSL certificate’s Root CA’s certificate and certificate revocation list into your development’s Active Directory with the certutil (certutil –dspublish –f <RootCA>.cer RootCA & certutil –dspublish –f <RootCA>.crl) command. This will put the Root CA’s certificate into all development domain attached systems’ computer Trusted Root Certification Authorities certificate store. If you want a targeted deployment to specific workstations you can deploy via group policy Computer Settings ->Windows Settings->Security Settings->Public Key Policies->Trusted Root Certification Authorities

Note: It is best practice to re-issue with a properly trusted certificate when moving applications from development/test to production environments.

More information can be found at http://www.microsoft.com/pki

Question: is it possible to enforce TLSv1 in advanced option in IE via AD group policy?

Answer: Yes, with Internet Explorer 6 you will need to create a custom Group Policy ADM file.

http://groups.google.com/group/microsoft.public.windows.inetexplorer.ie6.browser/browse_thread/thread/fd85a7eb83075243/3531f993790f6ce8?hl=en&lnk=st&q=ie+tls+registry#3531f993790f6ce8

12/19/2007 FDCC Webcast: Utility to Apply FDCC Settings to Local Policy

David L. Dixon — Tue, 18 Dec 2007 21:06:00 GMT

Please post your comments and questions with respect to this webcast here...

Upcoming FDCC webcasts

Aaron Margosis — Mon, 19 Nov 2007 23:27:00 GMT

Our upcoming FDCC webcasts include:

Dec 5, 2007: Top 10 Questions About FDCC
Discussion of the Top Ten List of questions customers have asked Microsoft with respect to the FDCC initiative

Dec 19, 2007: Utility to Apply FDCC Settings to Local Group Policy
Demonstration and discussion of a new utility that applies FDCC GPO settings to the Local Group Policy of a target computer.
[UPDATED Dec 16, 2007] Register for this webcast here: http://msevents.microsoft.com/CUI/EventDetail.aspx?EventID=1032361165&Culture=en-US

Jan. 3, 2008: FDCC and Mobile User Scenarios
Discussion of FDCC settings that are specifically relevant to mobile users

Each of these is targeted to technical audiences. Webcast URLs will be posted here shortly.