REFRESH scenario with Bitlocker partition
I have seen this similar thread before but not a satisfactory answer. SCCM SP1 R2 installing Vista Enterprise with MDT 2010 integration enabled. NEWCOMPUTER scenario works perfectly. However we use Bitlocker so there is a Bitlocker partition on the machine set to Y drive. If you run the TS from within windows which kicks off a REFRESH scenario it gets all confused with the Bitlocker partition. I tried the step of putting in a wipe disk before the PE execution but as predicted the config files for the TS are wiped with it and the machine doesn't build properly. If the BDE partition is not there then a REFRESH works ok. The BDE partition is created using the Drive Preparation tool during the build task sequence for a NEWCOMPUTER. Surely there must be a way to do this. Also on the REFRESH scenario how do you stop the TS from doing a backup of the machine. I have just disabled the backup parts of the TS but that seems a little over the top. Can you not just flag it not to do a backup at all and skip over those parts of the TS. The Bitlocker issue happens on MDT as well when you have a bitlocker partition and run MDT from within Vista.
August 3rd, 2010 11:55am

Hi Andrew, I had exactly the same problem with the Refresh scenario and Bitlocker during our Win 7 development. Here is how I solved it... Assuming that you are using a single TS for bare metal and OS refresh (like the MDT client template) then change your format disk steps to store the system partition drive letter in a variable (eg. OSDisk) if it is not configured to do this already. Then change your OS image restore step(s) to restore the image to the drive letter stored in the OSDisk variable. To address the OS refresh issue all that you now need to do is run a script to detect which partition is the system partition and then store this drive letter in the OSDisk variable. The script should run in the Refresh Only group in your task sequence. The end result of this is that for bare metal systems the OSDisk variable will be created by the format step and have a value of C:. For OS refresh the script will determine the drive letter and then create the OSDisk variable with a value of D:. In both cases the same OS image restore step(s) can be used as the image will just be restored the drive letter contained in the variable. That is why it is important to change the format and image restore steps as detailed above. Here is the script you can use to detect the drive letter during OS refresh (ZTISetOSDisk.wsf). It is MDT based so either store it in the MDT package along with the other scripts or in a new package with a copy of ztiutility.vbs from MDT. Just add a run command line step in the Refresh Only group to run: cscript.exe "%deployroot%\scripts\ZTISetOSDisk.wsf" (assuming you create the script in the MDT package). My step is placed just above the Backup step. Btw... you can disable the backup by setting a collection variable called ComputerBackupLocation and setting the value to NONE. Hope this helps. Mark. ***********Start of script ***************** <job id="IncludeExample"> <script language="VBScript" src="ZTIUtility.vbs"/> <script language="VBScript"> ' //*************************************************************************** ' // ***** Script Header ***** ' // ' // File: ZTISetOSDisk.wsf ' // ' // Purpose: Determine drive letter allocated to OS disk ' // ' // Usage: cscript ZTISetOSDisk.wsf ' // ' // ' // ***** End Header ***** ' //*************************************************************************** '//---------------------------------------------------------------------------- '// '// Global constant and variable declarations '// '//---------------------------------------------------------------------------- Option Explicit Dim iRetVal '//---------------------------------------------------------------------------- '// End declarations '//---------------------------------------------------------------------------- '//---------------------------------------------------------------------------- '// Main routine '//---------------------------------------------------------------------------- On Error Resume Next iRetVal = ZTIProcess ProcessResults iRetVal On Error Goto 0 '//--------------------------------------------------------------------------- '// '// Function: ZTIProcess() '// '// Input: None '// '// Return: Success - 0 '// Failure - non-zero '// '// Purpose: Perform main ZTI processing '// '//--------------------------------------------------------------------------- Function ZTIProcess() ' -------------------------------------------------------------------------------- ' Find driver letter allocated to OS disk ' -------------------------------------------------------------------------------- Dim oDrive Dim oFSO Dim sOSDrive Set oFSO = CreateObject("Scripting.FileSystemObject") For each oDrive in oFSO.Drives If oDrive.DriveType = 2 then If oDrive.IsReady Then If (oFSO.FolderExists(oDrive.DriveLetter & ":\Windows") or oFSO.FolderExists(oDrive.DriveLetter & ":\Winnt")) and oDrive.DriveLetter<>"X" then sOSDrive = oDrive.DriveLetter & ":" oLogging.CreateEntry "OS Disk drive letter is " & sOSDrive, LogTypeInfo oLogging.CreateEntry "Setting OSDisk TS variable to " & sOSDrive, LogTypeInfo oEnvironment.Item("OSDisk") = sOSDrive Exit For End if End If End if Next iRetVal = Success ZTIProcess = iRetVal End Function </script> </job> ******** End of script ***************
Free Windows Admin Tool Kit Click here and download it now
August 3rd, 2010 1:22pm

Thanks for the Script. However the problem I have here is that when you have a Vista machine setup for Bitlocker you obviously have one partition with the Bootmgr on it that is not encypted and is around 1.5 GB and the rest of the disk is the Sysem drive which is encrypted. When you run a TS within Vista which kicks off a REFRESH the TS copies its config data down to the C: Drive (the encrypted drive) and copies PE to the non encrypted drive. Reboot into PE but then tries to access the the TS configuration which is on the encrypted drive and the TS fails with: Unable to Read task sequence configuration disk. etc.... So how on earth do you do a Refresh with Bitlocker enabled???????? This must be a common thing to do!!!!
August 11th, 2010 12:22pm

Hi, I have only tried this with Windows 7 and bitlocker and disabling bitlocker as the first step in the task sequence solved my problem with refresh, I have modified a lot of the MDT steps but it should work. Use a "Run Command Line" task manage-bde.exe -protectors -disable C: Hope it helps.---------------------------------------------------- visit my System center blog at www.ccmexec.com
Free Windows Admin Tool Kit Click here and download it now
August 11th, 2010 2:56pm

Hi, i am trying to use the bdehdcfg.exe -target default as a run commandline for creating a bitlocker partition from my single partition in my refresh scenario. how to put this through sccm. currently trying as a last step, still no good. or can u post the screenshot of u r commandline task manage-bde.exe -protectors -disable c: as i am not sure, where to startin (%windir%\system32) or through a package in sccm? . Thanks in advance.
January 7th, 2011 6:20am

Hi, When I ceate the bitlocker partition during deployment I use the command line. bdehdcfg.exe -target default -quiet So it should work if you only add -quiet at the end of the command line and you don't need to specify a directory to startin /Jörgen -- visit my System center blog at http://ccmexec.com --
Free Windows Admin Tool Kit Click here and download it now
January 7th, 2011 8:11am

Hi, When I ceate the bitlocker partition during deployment I use the command line. bdehdcfg.exe -target default -quiet So it should work if you only add -quiet at the end of the command line and you don't need to specify a directory to startin /Jörgen -- visit my System center blog at http://ccmexec.com --
January 7th, 2011 8:11am

Thanks for the reply. I will give a try and update you.
Free Windows Admin Tool Kit Click here and download it now
January 7th, 2011 10:37am

Hi Jorgen, I tried the steps, it threw an error below: The task sequence execution engine failed executing the action (Run Command Line) in the group (Install Software) with the error code 2147942402 Action output: ontinueOnError='' SwdAction = '0001' Command line for extension .exe is "%1" %* Set command line: Run command line Working dir 'not set' Executing command line: Run command line CreateProcess( NULL, (LPWSTR)m_sCommandLine.c_str(), NULL, NULL, TRUE,bNT ? CREATE_UNICODE_ENVIRONMENT : 0, m_pEnvironmentBlock, pszWorkingDir, &si, &pi ), HRESULT=80070002 (e:\nts_sms_fre\sms\framework\core\ccmcore\commandline.cpp,997) clCommandLine.Execute( uOptions, pszWorkingDir, lpDesktop ), HRESULT=80070002 (e:\nts_sms_fre\sms\client\osdeployment\installsoftware\runcommandline.cpp,558) cmd.Execute(pszPkgID, sProgramName, dwCmdLineExitCode), HRESULT=80070002 (e:\nts_sms_fre\sms\client\osdeployment\installsoftware\main.cpp,385) CreateProcess failed. Code(0x80070002)Command line execution failed (80070002) Failed to execute command line 'bdehdcfg.exe -target default -quiet' . The system cannot find the file specified. (Error: 80070002; Source: Windows) Install Software failed to run command line, hr=0x80070002. The operating system reported error 2147942402: The system cannot find the file specified. Any thoughts. Many Thanks, Prakash.
January 7th, 2011 11:40am

Where in the Tas Squenceare you running the comman? the command cannot be executed while in WinPe, the computer must have Windows installed and be restarted for the command to work. Regards, Jörgen-- visit my System center blog at http://ccmexec.com --
Free Windows Admin Tool Kit Click here and download it now
January 8th, 2011 1:36am

Hi Jorgen, Thanks for the reply. I tried as you said, i added it after a reboot, still it says "The system cannot find the file specified". I tried even disabling the 64 bit redirection as i am using a 64Bit Win pe.but still no good. but when i run the syntax manually i can see that works without any problem. How about using a diskpart to shrink and make this partition active. any thoughts how to run this through the commandline? Many Thanks, Prakash.R
January 8th, 2011 12:51pm

There are a similar post in another thread, I will post it here aswell. Hi, I uploaded a screenshot of my task sequence and it can be found here. http://ccmexec.com/wp-content/uploads/2011/01/bitlockerpartition21.JPG and as you can see this is almost the last step I do before the installation is complete. The only thing to keep in mind is that the command checks that you have the AC power connected otherwise it will fail. For X64 enable the "Disable 64-bit file system redirection" and it will work when deploying the task sequence. To be clear you cannot run the command in WinPE, it has to be executed when the computer is booted on the Windows 7 OS being deployed. Regards, Jörgen -- visit my System center blog at http://ccmexec.com --
Free Windows Admin Tool Kit Click here and download it now
January 9th, 2011 8:29am

Hi Jorgen, I will give a try as said, i use a SCCM TS, will that make a difference. I already integrated the SCCM and MDT. But our client prefers a SCCM TS. So is there any other additions to be done for that. Many Thanks, Prakash.R
January 9th, 2011 5:16pm

Hi Jorgen, I will give a try as said, i use a SCCM TS, will that make a difference. I already integrated the SCCM and MDT. But our client prefers a SCCM TS. So is there any other additions to be done for that. Many Thanks, Prakash.R
Free Windows Admin Tool Kit Click here and download it now
January 9th, 2011 5:16pm

It makes no difference if you use a SCCM or SCCM+MDT TS, the step is the same. Regards, jörgen-- visit my System center blog at http://ccmexec.com --
January 10th, 2011 1:34am

Thanks Jorgen, You saved me. It was my mistake that i didnt change the option at restart ( I initially had as "The Boot Image Assigned to this Task sequence") Now i changed that to "The currently installed default Operating System" and it works great. Thanks again. Thank you So much. Many Thanks, Prakash.R
Free Windows Admin Tool Kit Click here and download it now
January 10th, 2011 5:54am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics