HP Integrity Superdome 2 8/16 HP Smart Update Manager 5.1 User Guide - Page 13

BitLocker Drive Encryption must be temporarily disabled. Disabling the BitLocker Drive Encryption

Get HP Integrity Superdome 2 8/16 PDF manuals and user guides View all HP Integrity Superdome 2 8/16 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 13 highlights

temporarily disable BitLocker and does not cancel the flash, the BitLocker recovery key is needed to access the user data upon reboot. A recovery event is triggered if: • You do not temporarily disable BitLocker before flashing the system BIOS when using the Microsoft BitLocker Drive Encryption. • You have optionally selected to measure HP iLO, Smart Array, and NIC firmware. If HP SUM detects a TPM, a warning message appears. To enable firmware updates without the need to type in the TPM password on each server, the BitLocker Drive Encryption must be temporarily disabled. Disabling the BitLocker Drive Encryption keeps the hard drive data encrypted. However, BitLocker uses a plain text decryption key that is stored on the hard drive to read the information. After the firmware updates have been completed, the BitLocker Drive Encryption can be re-enabled. Once the BitLocker Drive Encryption has been re-enabled, the plain text key is removed and BitLocker secures the drive again. NOTE: Temporarily disabling BitLocker Drive Encryption can compromise drive security and should only be attempted in a secure environment. If you are unable to provide a secure environment, HP recommends providing the boot password and leaving BitLocker Drive Encryption enabled throughout the firmware update process. This requires setting the /tpmbypass parameter for HP SUM or the firmware update is blocked. To temporarily disable BitLocker support to allow firmware updates: 1. Click Start, and then search for gpedit.msc in the Search Text box. 2. When the Local Group Policy Editor starts, click Local Computer Policy. 3. Click Computer Configuration→Administrative Templates→Windows Components→Bitlocker Drive Encryption. 4. When the BitLocker settings are displayed, double-click Control Panel Setup: Enable Advanced startup options. 5. When the dialog box appears, click Disable. 6. Close all windows, and then start the firmware update. To enable advanced startup options: 1. Enter cscript manage-bde.wsf -protectors -disable c: 2. When the firmware update process is completed, the BitLocker Drive Encryption support can be re-enabled by following steps 1 through 4 but clicking Enabled in step 5 instead. The following command can be used to re-enable BitLocker Drive Encryption after firmware deployment has completed. 3. Enter cscript manage-bde.wsf -protectors -enable c: Trusted Platform Module 13

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
temporarily disable BitLocker and does not cancel the flash, the BitLocker recovery key is needed
to access the user data upon reboot.
A recovery event is triggered if:
•
You do not temporarily disable BitLocker before flashing the system BIOS when using the
Microsoft BitLocker Drive Encryption.
•
You have optionally selected to measure HP iLO, Smart Array, and NIC firmware.
If HP SUM detects a TPM, a warning message appears.
To enable firmware updates without the need to type in the TPM password on each server, the
BitLocker Drive Encryption must be temporarily disabled. Disabling the BitLocker Drive Encryption
keeps the hard drive data encrypted. However, BitLocker uses a plain text decryption key that is
stored on the hard drive to read the information. After the firmware updates have been completed,
the BitLocker Drive Encryption can be re-enabled. Once the BitLocker Drive Encryption has been
re-enabled, the plain text key is removed and BitLocker secures the drive again.
NOTE:
Temporarily disabling BitLocker Drive Encryption can compromise drive security and
should only be attempted in a secure environment. If you are unable to provide a secure
environment, HP recommends providing the boot password and leaving BitLocker Drive Encryption
enabled throughout the firmware update process. This requires setting the
/tpmbypass
parameter
for HP SUM or the firmware update is blocked.
To temporarily disable BitLocker support to allow firmware updates:
1.
Click
Start
, and then search for
gpedit.msc
in the Search Text box.
2.
When the Local Group Policy Editor starts, click
Local Computer Policy
.
3.
Click
Computer Configuration
→
Administrative Templates
→
Windows Components
→
Bitlocker
Drive Encryption
.
4.
When the BitLocker settings are displayed, double-click
Control Panel Setup: Enable Advanced
startup options
.
5.
When the dialog box appears, click
Disable
.
6.
Close all windows, and then start the firmware update.
To enable advanced startup options:
1.
Enter
cscript manage-bde.wsf -protectors -disable c:
2.
When the firmware update process is completed, the BitLocker Drive Encryption support can
be re-enabled by following steps 1 through 4 but clicking
Enabled
in step 5 instead. The
following command can be used to re-enable BitLocker Drive Encryption after firmware
deployment has completed.
3.
Enter
cscript manage-bde.wsf -protectors -enable c:
Trusted Platform Module
13