Lenovo ThinkPad T400 (English) Hardware Password Manager Deployment Guide - Page 43

a completely different set of scan codes on another keyboard type. For example, consider the password

azw

. On an English keyboard, the scan code representation is 0x1E, 0x2C, 0x11. However, on a German

keyboard, the scan code representation is 0x1E, 0x15, 0x11.

There are 3 keyboard types used to support different languages:

•

French, Belgian

•

German, Swiss, Hungary, Poland, Czechoslovakia, Slovenia, Slovakia

•

All other languages

When deploying hardware passwords from the server, such as POP, SVP and HDP, the server converts the

ASCII text to scan codes based on the keyboard type of the target system. These passwords (represented

by scan codes) are sent to the client to be set in the hardware.

Changing keyboard types is not supported for manual entry of passwords. If a user wants to change

keyboard types, the best practice is to do this:

1. Deregister from Hardware Password Manager.

2. Change the keyboard.

3. Reregister in Hardware Password Manager.

Scenario 5 - Handling enrollment from multiple boot partitions

This scenario can occur when a user registers and enrolls on one boot partition (such as Vista), and wants to

enroll in Hardware Password Manager on a second boot partition (such as XP). In this case, the Hardware

Password Manager Client code should be installed in each boot partition. The user should register and enroll

in Hardware Password Manager from one boot partition. After being enrolled, Hardware Password Manager

functions normally in all boot partitions where the Hardware Password Manager Client code is installed

assuming the Windows login credentials are the same in all boot partitions. If the Windows login credentials

are different, the user will have to manually enter their Windows credentials in the Windows Gina/CP when

using boot partitions other than the one used to register in Hardware Password Manager.

Scenario 6 - BitLocker

BitLocker and Hardware Password Manager are compatible, which means a client enrolled in Hardware

Password Manager (for BIOS password protection - POP, SVP, HDPs) can further protect their data using

BitLocker (logical volume encryption). BitLocker enrollment and key retrieval is handled the same way as is

done today by customers (outside the scope of Hardware Password Manager).

The best practice when using both technologies is to enroll in Hardware Password Manager prior to enabling

BitLocker. If the user ﬁrst enables BitLocker, then registers in Hardware Password Manager, the fact that

BIOS passwords are set will cause BitLocker to fail its integrity check (BIOS passwords are validated within

PCR1) and cause the BitLocker Recovery Mode to start. Hardware Password Manager will warn the user

of this issue during the registration ﬂow if BitLocker is enabled. The user can choose to continue with the

registration or cancel at this point. If the user continues, then BitLocker Recovery Mode will be executed on

the next start since the integrity check on BIOS passwords (PCR1) will have failed.

Chapter 6

.

Scenarios

35

Section	Page
Preface	7
Chapter 1. Overview	9
Chapter 2. Installing Hardware Password Manager on ThinkManagement Console	11
Prerequisites	11
Preparing the core server	12
ThinkManagement Console with HPM server setup	13
Migrating to a new LDAP server	14
Installing Hardware Password Manager on a Lenovo device	14
Chapter 3. Managing Hardware Password Manager devices with ThinkManagement Console	17
Viewing Hardware Password Manager devices and their properties	17
Managing enrolled users on Hardware Password Manager devices	18
Configuring an LDAP server connection	18
Viewing Hardware Password Manager users and their properties	19
Removing a user’s access to a Hardware Password Manager device	20
Managing Hardware Password Manager groups	20
Managing remote actions and policy settings for Hardware Password Manager devices	21
Updating client policies globally	22
Updating hardware passwords globally	23
Updating the emergency account	24
Changing server policy settings	25
Defining scopes and roles for console users	26
Chapter 4. Hardware Password Manager Client	29
Hardware Password Manager device setup	29
Registering a device with the Hardware Password Manager server and enrolling the first user	29
Enrolling additional users on a Hardware Password Manager device	30
Removing a user from a Hardware Password Manager device	31
Unregistering a device from the Hardware Password Manager server	31
Updating credentials on a Hardware Password Manager device	32
Chapter 5. Deployment	33
Fingerprint integration	33
Safe Guard Easy/Safe Guard Enterprise compatibility	34
One-touch registration	34
Pre-registration	35
User enrollment on a pre-registered system	35
Chapter 6. Scenarios	37
Service scenarios (configuration changes)	37
Scenario 1 - Hardware configuration changes	37
Scenario 2 - CMOS error	37
Scenario 3 - Replace the fingerprint device	38
Scenario 4 - Hardware passwords already set	38
Scenario 5 - Setup under the operating system (remote BIOS settings)	38
Scenario 6 - Replace the system board	39
Scenario 7 - Add a hard disk drive	39
Scenario 8 - Replace or move a hard disk drive	39
Scenario 9 - Change the hard disk location within a system	40
Scenario 10 - Remove a hard disk drive	40
Scenario 11 - Flashing the BIOS	40
Scenario 12 - Registered system can no longer access the Hardware Password Manager server	41
Scenario 13 - Enter the BIOS setup	41
Scenario 14 - Load default settings in the BIOS setup	41
Scenario 15 - Do not protect all hard drives	41
User Scenarios	42
Scenario 1 - Forgot Hardware Account credentials, network connected	42
Scenario 2 - Forgot Hardware Account credentials, NOT network connected	42
Scenario 3 - Forgot the corporate password	42
Scenario 4 - Manual login using different keyboard types	42
Scenario 5 - Handling enrollment from multiple boot partitions	43
Scenario 6 - BitLocker	43
Appendix A. Security and convenience	45
Appendix B. Disaster recovery	47
Appendix C. Hints and tips	51
Appendix D. Notices	57

Lenovo ThinkPad T400 (English) Hardware Password Manager Deployment Guide - Page 43

Scenario 5 - Handling enrollment from multiple boot partitions, Scenario 6 - BitLocker, German, Swiss - bios password

Page 43 highlights