Microsoft è bene sul relativo modo trasportare il primo pacchetto di servizio per Windows Vista. Attualmente, la data di disponibilità esatta per il pacchetto 1 di servizio di Windows Vista è in su nell'aria, Microsoft offrendo soltanto un orario generale quel indica al primo trimestre di 2008. And with Vista SP1 intimately connected with Windows Server 2008, formerly codenamed Longhorn, at kernel level, the first service pack for latest Windows client from Microsoft is synchronized with the company’s last 32-bit server operating system. The official launch of Windows Server 2008 has been set for
February 28, next year, and Vista SP1 is bound to keep up the pace wit the server platform.

In mid July, Microsoft debuted the testing of Vista SP1 outside of Redmond. A preview of the first beta of Vista SP1 shipped to a select pool of testers at that time. (more…)

As you may know, BitLocker Drive Encryption only encrypts the C:\ drive. If you have additional drives in your PC, or use an external USB hard drive with your notebook, you can't encrypt that drive with BDE. Officially that is :)

While Vista SP1 will bring support for encrypting the other volumes in your system you can do it today using the command line tool manage-bde.wsf. Now before we get started I must inform you that this is in now way supported by Microsoft. I've tried it, it worked for me, but I highly recommend taking a backup of the data before proceeding!

With that out of the way launch the Command Prompt as Administrator and run the following command to encrypt additional drives:

cscript manage-bde.wsf -on X: -recoverykey Y:\ -recoverypassword

In this example X: is the drive you wish to recover and Y: is the drive the recovery key will be saved to. Remember to backup the recovery key and store it in a secure location. You can store this key on the C: drive (which is encrypted) and it will make things easier when you need to unlock the drive.

Once that is complete you will need to run a command to "unlock"

We've done a few post on BitLocker around some of the more advanced features and controls. The one thing we haven't touched yet is just how easy it is to encrypt your drive with BitLocker. Before we get started on the procedure a little review of the options you can choose is in order.

• TPM Only - This is the easiest to deploy and use. Everything happens in the background invisible to the user.
• Dongle Only - This is used with systems that do not have a TPM 1.2 chip. Rather than store the ket in TPM it stores it on a USB key which must be insterted prior to booting the PC
• TPM + PIN - This is more secure. In effect it is a form of two factor authentication, what you have (the TPM chip with the key) and what you know (the PIN)
• Dongle + PIN - This is another form of two factor authentication again for older systems with no TPM 1.2 chip

Personally I prefer TPM + PIN as I usually store my USB keys in my notebook bag. Should that ever get lost or stolen the person has all they need to get access

We have gone over the GPO settings for BitLocker recently and now we are going to cover the actual configuration of BitLocker on the computer itself. There are two ways, the GUI way, or the CLI way. Today we will focus on the CLI method.

There is one command that allows you to manage BitLocker via the CLI and that is manage-bde. Simply run this from an elevated command prompt and you will see the following output.

To determine the status of the volume simply run manage-bde -status

Before we go any further you will need to have preped the drive with the BitLocker Drive Prep tool. The next step is to initialize TPM. Again there is the GUI method that uses TPM.MSC or you can run the following command.

cscript manage-bde.wsf –tpm –takeownership -<password>

With everything ready you can run the following command to encrypt the drive.

cscript manage-bde.wsf –on –recoverypassword C:

Once complete you can run manage-bde -status again!

Ever wanted to backup your ACLs for every file in a folder? With Windows Vista, and Microsoft Windows Server 2003 SP2 a new tool has been released called ICACLS.

To backup the ACLs of every file in a directory type:

icacls * /save aclfile.txt

This command saves the ACLs of all the files in the directory to a file called aclfile.txt. You can add "/T" to include all the subfolders.

You can later restore that file using the /restore aclfiles.txt.

This is great when an application or administrator makes changes to the ACLs and then forgets what they changed when it causes a problem.

You can also modify the ACE of a file this is the "Access Control Entry" it controls how different processes can access files. You do this by changing the Integrity Level of a file to Low Medium or High. The Integrity Level or IL indicates if a process may access a particular file. When a process launches it is given an IL typically the same IL as its parent process.

You can see the Integrity Level of your processes using a tool like processexplorer