MBAM 2.0 - Complex PIN support

Hi
Referring to
windowsteamblog I found the following:
Additionally, to protect machines during the pre-boot authentication
process, we’re adding complex PIN support to address situations where
users attempt to set a weak PIN.
How can configure complex PINs (not passwords)? Which PIN code are then no longer allowed?
Thanks!

Hi,
Password is necessary when encrypting the hard drive via Bitlocker for security.
As the statement in this blog, some common PIN sequences like 1111, 1234, and others like them can’t be used.
Tracy Cai
TechNet Community Support

Similar Messages

10.1.3 complex graphs support...?

Has anyone used 10.1.3 with Oracle Business Intelligence beans.
I need it for complex graphs for dashboard screen (jspx page) but when I try to download BI 10.1.2.2, I come across the following note.
Note that JDeveloper 10.1.3 is currently not supported
There is support for graphs in jdev 10.1.2 by using BI Beans 10.1.2.2 and also graphic capabilities in 11g but …
Why there is not support for the 10.1.3?
Is BI scheduled for release, which supports 10.1.3?
Is any other alternative solution in ADF for the complex graphs?
Thanks

Hi,
There is no Developer Suite release using JDeveloper 10.1.3 which explains why there is ne BIBeans integration. In addition, when implementing the JSF/ADF Faces development environment, the Graph components weren't ready. This will now come in JDeveloper 11.
Frank

SSL Pinning support for mobile apps ?

Hi there
i've just read this article and wondered if there is cross platform support for SSL pinning for mobile apps (iOS and Android) developed with AIR ?
So far my Google research wasn't successful, therefore i ask here.
Maybe this feature could be supported by a native extension ?
Thank you for any hint.
Regards
valley

I believe IBM has a mini version of DB2 designed for mobile Apps.
Good Luck,
J.Clancey
Pats World Champs!!!

6 digit PIN support

I have been informed that I will not be allowed connect my Pre to Exchange at work because the Pre does not support a 6-digit pin. Due to the lack of a 6-digit pin our I.T. says that the Pre does not support the full security implementation for Exchange. Windows Mobile and iPhone both support a 6-digit pin for Exchange so I am surprised at the omission on webOS.
Is there any hope that webOS will be patched to support a 6-digit pin or should I be shopping for a new phone that will be allowed to sync with my Exchange server at work?
Post relates to: Pre p100eww (Sprint)

Hmmm...I'll take that silence as a "yes, you should be shopping for a new phone" answer. Bought a used a Treo Pro two days ago and am all set up and running for the time being. I will hold onto the Pre for a bit to see if webOS is updated to support a 6-digit pin. Sigh...things should not be this hard.

Pin support

Hy,
I have a bb8520
[Removed personal information to comply with Community Guidelines and Terms and Conditions of Use]
recently bought
and i have the following problem:
I have a bis contract on orange romania and i cant conect to bis,i
speeked to orange and they said my phone is regestred to bis in another
country and they cant mange my acount because of that,
Please can u help me because my bb is usless if my bis acount doesnt work!
best regards,Vlad Olteanu

I spoked with a provider,and they dont give a rats **bleep** about pin problems,they say the device is faulty,they dont even bother to chek,so unlike blackberry and rim,the acounts shouldnt be administrated by providers,problem like mine aren't only one case,they are a lot so if thei dont do somethig is their loss!!! "The device associated with this PIN and device id belongs to a different service provider" error is displayed when trying to create a new BlackBerry Internet Service account.
Article ID: KB29502
Type: Support Content
Last Modified: 03-15-2012
PrintEmail Document Bookmark
Product(s) Affected:
BlackBerry Internet Service
BlackBerry ID
Search the knowledge base:
Visit BlackBerry Community Support Forums
Follow us on Twitter® @BlackBerryHelp
Collapse all | Expand all
Jump to: Environment | Overview | Cause | Resolution
Environment
BlackBerry® Internet Service
Back to top
Overview
When trying to create a new BlackBerry® Internet Service account for a new subscriber, the following error displays:
The device associated with this PIN and device id belongs to a different service provider
As a result, a new BlackBerry Internet Service Account can not be created.
Back to top
Cause
A BlackBerry Internet Service account is already associated with the BlackBerry smartphone.
Back to top
Resolution
Contact the wireless service provider for further assistance.

Pre-Provisioning Bit Locker in MDT 2012 SP1 while using MBAM 2.5 - No Pin Required

Does anyone have some step by step instructions for Pre-Provisioning Bit Locker. Through task sequences, we are currently able to bit locker the computers but it's the last set of tasks. I would like to Bit Locker the computer while no data is on the
disc so it's faster and then as its imaging, the files are already encrypted.
Currently:
Creates BIOS Password
TPM turned on and enabled (using CCTK)
Remove Password
Registry changes
Installing MBAM 2.5
Removing Registry Entries
Any help would be appreciated!
Thanks
Rick

Bitlocker Pre-Provisioning is available by default on MDT Litetouch...
If you just want to pre-provision the drive without letting MDT LiteTouch enable any protectors (let MBAM do that) then just run the following command after the "FOrmat and PArtition" step in the Task Sequence:
x:\windows\system32\Manage-BDE.exe c: -used
(OR whatever drive letter OS exists on in WinPE)
AS an alternative, I would add a step just before the "ENable Bitlocker (offline)" step in the task sequence:
    BDEInstallSuppress=NO
    isBDE=YES
then after the "Enable Bitlocker (offline)" step in the Task Sequence, I would set the following:
    isBDE=NO
Keith Garner - Principal Consultant [owner] -
http://DeploymentLive.com

ETA for PIN support for EAS on the PRE?

Is there an ETA for EAS support on the Pre? Many users are anxious to see this happen.
Post relates to: Pre p100eww (Sprint)

Ah, I was outraged as well. And then I discovered the entire thread was moved to the Synergy (webOS) forum: link to the whole thread.
Message Edited by tspine on 06-08-2009 05:18 PM
Message Edited by tspine on 06-08-2009 05:19 PM

MBAM 2.5 - no TPM - options?

Hello. So we have MBAM 2.5 (upgraded from 2.0 over the past week), and now we also have our first UEFI computers without TPMs. We would like to enable USB keys as a protector for these devices, but unless I'm missing something it does not seem
to be an option.
I was also considering the password method, but even though the release notes indicate that the password method is now FIPS compliant, the GPO (updated with 2.5 ADMX) indicates that it is *not* FIPS compliant.
Under "Configure use of password for operating system drives" it states:
Note: Passwords cannot be used if FIPS-compliance is enabled. The "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" policy setting in Computer Configuration\Windows Settings\Security Settings\Local Policies\Security
Options specifies whether FIPS-compliance is enabled.
It is enabled in our environment, so does that mean we can not use the password protection, or was the description just not updated?
Our ideal method right now would be to encrypt the OS drive and store the key on a USB drive, in addition to MBAM storing a recovery key. A second best solution would be FIPS compliant password protection. Are either/both of these possible?
Thanks,
-Nick

Thanks for the reply!
I still have a question regarding USB protectors though. When I check the supported protector methods for OS volumes I see:
Trusted Platform Module (TPM)
TPM + PIN
TPM + USB key – supported only when the operating system volume is encrypted before MBAM is installed
TPM + PIN + USB key - supported only when the operating system volume is encrypted before MBAM is installed
Password - supported only for Windows To Go devices, fixed data drives, and Windows 8 devices that do not have a TPM
Numerical password - applied automatically as part of volume encryption and does not need to be configured except in FIPS mode on Windows 7
Data recovery agent (DRA)
So out of those, all seem to be out except for Numerical password and DRA. None of these options state just USB or USB + password. How would I enable encryption of the OS Drive with just a USB key? I've found only a little bit of information
on DRA, and it mentions certificates. Is that required to configure the USB protector? Which certificate do I need to use? How would I recover a volume protected with USB if the user loses their USB key?
I've read this article on configuring DRAs but it is pretty confusing and seems to be written for Windows 7/2008r2:
http://technet.microsoft.com/library/dd875560(v=WS.10).aspx

TPM password not found in MBAM database

There are other threads I have read through and did some troubleshooting, but still I´m stuck with this, how to get TPM password in MBAM database. Another question is, do I really need it? Isn´t recovery key enough?
My situation is this:
1. Computers are encrypted during Task Sequence and MBAM client is installed.
2. During first logon MBAM client promts for PIN and encryption is complete.
3. Bitlocker recovery key is found in MBAM Admin Web page, but not TPM password.
What I tried to do:
- There is no Group Policy for controling TPM password.
- I´m member of MBAM Admin group and Helpdesk groups.
- If I clear and initialize TPM from its mgmt console, there will not be any activity from MBAM client, and TPM password still does not go to DB
- I have checked from SQL mgmt studio, that TPM hash is NULL
- I tried to use TPM-EK vbs script before and after encryption, there is no effect.
So how to get TPM password to DP? Specially I´m intresting in scenario where Computer is already encrypted.

MBAM has to own the TPM to store the password. During a task sequence, follow the steps below. The steps assume pre-provisioning, but the concept is the same even if you don't use it. If the machine is already encrypted and you want MBAM to store the
password, you will have to clear the TPM and reboot. Note that this requires physical presence - someone will have to hit F1 in the preboot screen. See below for info on how to clear it via PowerShell. The reason you want the TPM OwnerAuth password is
that if a user types their PIN too many times in preboot, the TPM may put the machine into BitLocker Recovery and lock itself for some period of time (depends on manufacturer). To unlock it faster after you have supplied the BitLocker Recovery Password
and are in the OS, you have to go to tpm.msc and choose Reset TPM Lockout, supplying the TPM Owner Auth password. If MBAM stores it, you can get this info from the Helpdesk portal.
To configure MBAM to own the TPM and store OwnerAuth passwords
On the client computer, open an elevated Windows PowerShell command prompt.
Type the following Windows PowerShell commands:
Command
Description
$tpm=get-wmiobject -class Win32_Tpm -namespace root\cimv2\security\microsofttpm
Gets an instance of the TPM WMI class.
$tpm.DisableAutoProvisioning()
Disables TPM auto-provisioning.
$tpm. SetPhysicalPresenceRequest(22)
Clears the TPM.
Restart the computer, and then confirm that you want to clear the TPM.
For the task sequence to get MBAM to own it out of the box, do the following:
Capture and      sysprep a WIM as you normally would.
Mount the      captured WIM using
dism /mount-wim /wimfile:C:\WimImages\Win7.wim
/index:1 /mountdir:C:\AIKMount
Load the WIM      registry -
reg load
HKLM\WimRegistry
c:\AIKMount\windows\system32\config\system
Open regedit      and browse to hklm\WimRegistry\system\controlset001\services\TPM\WMI and      add the two reg keys that
Jim mentioned
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tpm\WMI: NoAutoProvision [REG_DWORD]
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tpm\WMI: NoDisableOwnerClear [REG_DWORD]
Close regedit
Unload the WIM      registry -
reg unload HKLM\WimRegistry
Commit changes      to the WIM and unmount -
dism /unmount-wim /mountdir:C:\AIKMount
     /commit
Went to MDT      2012 Update 1 and my deployment share.
Edited the      ZTIBDE.wsf script in MDT to tell it not to take ownership of the TPM.
In that script, replace the TPMValidate      function with what I have below (I just commented out the SetTPMOwner      lines)
Function TpmValidate ()
Dim iRetVal, sCmd, sTpmOwnerPassword
iRetVal = Success
'// Set oTpm to valid instance
iRetVal = GetTpmInstance()
TestAndFail iRetVal, 6734, "Get TPM Instance"
'// Set global booleans for TPM state. Error bubble handled by subs
iRetVal    = GetTpmEnabled()
TestAndFail iRetVal, 6735, "Check to see if TPM is enabled"
iRetVal = GetTpmActivated()
TestAndFail iRetVal, 6736, "Check to see if TPM is activated"
iRetVal = GetTpmOwner()
TestAndFail iRetVal, 6737, "Check to see if TPM is owned"
iRetVal = GetTpmOwnershipAllowed()
TestAndFail iRetVal, 6738, "Check to see if TPM Ownership is allowed"
iRetVal = GetEndorsementKeyPairPresent()
oLogging.CreateEntry "TpmEnabled: " & bTpmEnabled, LogTypeInfo
oLogging.CreateEntry "TpmActivated: " & bTpmActivated, LogTypeInfo
oLogging.CreateEntry "TpmOwned: " & bTpmOwned, LogTypeInfo
oLogging.CreateEntry "TpmOwnershipAllowed: " & bTpmOwnershipAllowed, LogTypeInfo
oLogging.CreateEntry "EndorsementKeyPairPresent: " & bEndorsementKeyPairPresent, LogTypeInfo
'// Single instance check to allow future corrective action branching.
TestAndFail bTPMEnabled, 6739, "Check to see if TPM is enabled"
TestAndFail bTPMActivated, 6740, "Check to see if TPM is activated"
TestAndFail bTpmOwned or bTpmOwnershipAllowed , 6741, "Check to see if TPM is owned and ownership is allowed"
If bTpmOwned <> True AND bTpmOwnershipAllowed = True Then
If oEnvironment.Item("TpmOwnerPassword") <> "" Then
oLogging.CreateEntry "TPM Ownership being intiated.", LogTypeInfo
'iRetVal = SetTpmOwner(oEnvironment.Item("TpmOwnerPassword"))
TestAndFail iRetVal, 6741, "TPM Owner Password set"
ElseIf oEnvironment.Item("AdminPassword") <> "" Then
oLogging.CreateEntry "TPM Ownership being intiated with AdminP@ssword (not TPMOwnerP@ssword).", LogTypeInfo
'iRetVal = SetTpmOwner(oEnvironment.Item("AdminPassword"))
TestAndFail iRetVal, 6742, "TPM Owner P@ssword set to AdminP@ssword"
Else
oLogging.CreateEntry "TPM Ownership being intiated with Default p@ssword (not TPMOwnerP@ssword).", LogTypeInfo
'iRetVal = SetTpmOwner("M0nksH00d!4T3al")
TestAndFail iRetVal, 6743, "Set TPM Owner P@ssword to value"
End If
End If
TpmValidate = Success
End Function
Grab the      StartMBAMEncryption.wsf script from
here
and edit out those same lines as above.
Added the      following files to an MDT application.
Set the app to run cscript.exe startmbamencryption.wsf      /MBAMServiceEndPoint:http://<yourmbamserver>/MBAMRecoveryAndHardwareService/CoreService.svc
Added the MBAM      agent installer as an application
Added the MBAM      agent to the task sequence
Added the Start      MBAM Encryption app to the task sequence
Set      OSDBitLockerMode=TPM and IsBDE=True in customsettings.ini
Made sure this was a bare metal machine where the TPM was clear (for testing, you can clear it from the BIOS, just make sure it is activated).
Ran the TS on      the box.
Result:
BitLocker was pre-provisioned and activated, and MBAM took ownership of the TPM which escrowed the OwnerAuth info to MBAM.

Database Adapter: cannot access table with complex record type as columns

Hi all,
I cannot perform any operations on a table that has columns with complex record type.
I have created a table to store purchase order details.
Sample script:
CREATE type XX_CUST_INFO_TYP as object
ssn VARCHAR2(20),
rating NUMBER(15)
CREATE type XX_ITEM_TYP as object
item_name VARCHAR2(20),
unit_price NUMBER(15),
quantity NUMBER(15)
CREATE table XX_PORDER (cust XX_CUST_INFO_TYP, porder XX_ITEM_TYP);
When i try to access the table X_PORDER in jdev through a database Adapter, i receive the error as
"some tables contains columns that are not recognized by the database adpter"
1.) so in this case, how to include such tables that have complex types?
Also, check out this scenario also..
1. add a table through a database adapter
2. drop the table in backend
3. i can still see the table and its structure in the database adapter wizard even after restarting Jdeveloper.. How is it possible?
These are some really interesting scenarios to experiment. Please suggest your ideas on this..
Thanks All!

Hi Hem,
for a select you could select against a view. And for inserts you could create a stored procedure. They support complex types since 10.1.2. Complex types support in tables/views was added for 11 (next major release).
You might be able to use PureSQL as a workaround too, i.e.
insert into XX_PORDER values (XX_CUST_INFO_TYP(?,?), XX_ITEM_TYP(?, ?, ?))
As for your other problem, in 10.1.2/10.1.3 the DBAdapter wizard sits on top of the Jdev Offline Tables and TopLink Mapping Workbench components. When you remove a table in the wizard it won't delete the Offline DB component. It was added by the wizard, but afterwards it is public to the entire Jdev project. You must remove it from Jdev yourself. This has been improved for the next major release too, no artifacts from underlying components are created.
To remove it select:
Offline DB Objects -> <schema> -> <table> and try File.. Erase From Disk.
Thanks
Steve

WARNING: DSP 3 NOT supported under Quad-Core G5 Systems!

This is from my posting at the DSP forum and a warning to all...
Alright, are you ready for this one? I just contacted Apple Support about running DSP 3 on my newly purchased Quad-core G5.
Those of us with a Quad-core G5 system are SCREWED when it comes to using DSP 3. The Apple guy told me that DSP 3 is not supported under the Quad systems (because "the Quad systems didn't exist at the time that DSP 3 was around" but wait, didn't DSP 4 come out BEFORE the Quad-core systems, too?). You have to use DSP 4 if you have a Quad-core G5.
I explained my outrage to the guy (very unsympathetic) that Apple does not post this information on their website and does not inform their Apple Store employees about the issue (I had mentioned to several employees of my intentions to run DSP 3 on the system when I was buying it).
The guy said that no one's complaining about this issue because "everyone gets the latest and greatest software to run on the newest machines" and "that's just the nature of technology" Yeah, right. I hate to say it, but I have Windows 98 apps from a single proc that run fine on Windows XP on a dual proc system.
Anyway, spread the word and give Apple some more money by upgrading to DSP 4, so that they can keep nickel and diming us. The guy mentioned that if anyone wants to complain, that they can complain to the Final Cut Pro discussions site since apparently, that's the place where Apple actually reads posts.

Heya,
Unsupported it may be, but does it run ok? I could
see it having worse performance than on a single-proc
machine, but it shouldn;t have any actual problems.
The guy said that no one's complaining about this
issue because "everyone gets the latest and greatest
software to run on the newest machines" and "that's
Well, given that you have bought their first machine
which supports > 2 concurrent threads [e.g. one system
thread and one app thread], I'd say he's partly right.
Anyone forking out the money for a quad will be [partly]
wasting it if they do not run applications that are
written to be fully multithreaded, i.e. written with
the quad in mind.
This is probably especially true on the Apple platform
as the programmers will assume that the user is on
one of the handful of machines available at the time.
Being inherently lazy, no programmer is going to add the
complexity of supporting n threads if only single-proc
machines are being sold [yeah,ok, there were dual-procs,
but that really means a two-thread system, which is
normally the case anyways ... one for GUI and one for
processing].
to say it, but I have Windows 98 apps from a single
proc that run fine on Windows XP on a dual proc
system.
Given the nature of Windows 98[/95/ME] and the
applications written for it, I am very frightened
for your system integrity
--Mike

DBA Support cost - Per DB ( Unit Pricing Model) .

Hi,
For one of the RFP solution we are asked to give the DBA Support cost Per unit ( Different pricing for Simple, medium, Complex Categories ) .
Do you know the typical price range for DB / Instance ?
Apart from Clustering,Size what all factors are taken into account to decide on Complexity
Thanks in advance for an immediate reply
Regards

For one of the RFP solution we are asked to give the DBA Support cost Per unit ( Different pricing for Simple, medium, Complex Categories ) .
Do you know the typical price range for DB / Instance ?
Apart from Clustering,Size what all factors are taken into account to decide on Complexity Contact Support person.
Check this for license and pricing list http://www.oracle.com/us/corporate/pricing/technology-price-list-070617.pdf

I Love The Map Support

Great Beta!
Would love to see KML/KMZ layer or pin support on map module. The I can see if images are out of place based on my Google Earth pin's which I can export from Google Earth, Import into LR4.
Also, when clicking on many images (orange button with a big number) metadata is = <mixed>. Would like to see this refect the image being show, and updating when going forward/backwards.
Color customize. e.g: year 20101=orange, 2008=blue, 2007=red...etc..etc. User config.
Seems really stable for a beta. Running 64bit.
Thanks

Hi,
I basically use LR for validation of metadata (keywords and GPS). While Geocoding is possible, via a plugin or nativitly, its not really possible to do 10's of thousands of images. I use a special app for this which wiorks very well.
In in current state, LR4 offers a interesting map feature, which good for managing small catalogs (a few thousand). In my case it would not provide me much in terms of my workflow.
I will try to give an example.
Catalog contains 100K images (mine in much larger)
Lets say we filter by the keyword 'Stadiums"
I'm presented with 15,000 images
I then move to my map view and see clusters of images on a map. They represent all the stadiums in USA.
What I need to do is zoom into each cluster and verify that the pictues are on top of satalite images of that stadium. Very slow.
If I had pins (and maybe rollover or click to see the text label) I could see various pins on a map and I would see the images always near a pin. If a set of images were nowhere near a pin, then I know something is out of place.
In Google Earth, you can organize pins into folders, and you can hide/display them by ticking and unticking a folder in "My Places". The same thing would be needed in LR4. So not all pins are displayed (Stadiums, shopping center's, parks, etc) and I could just select Stadium's to see stadium pins., for matching up with images.
When working with 100's of thousands of images, this would greatly speed up my workflow (validation).
Thanks

Setup of support structure for J2EE systems running on Oracle App Servers

I'm not sure if this is the best place to pose this question, but I can' really think of anywhere better. Apologies to anyone who may be reading this and thinking 'what does this guy think he's doing!'
Over the last two years, we have been implementing a number of J2EE systems for a large insurance company. The way we have been supporting these systems, is by making a number of senior staff available to field any issues. We are talking about DBAs, Oracle App Server admins, and senior Java staff (generally the same individuals as the Oracle App Server admins). Now, we do have an on-call support roster, but because our developers are generally not environment savvy they are not suitable for on-call support. They know the code inside out (for their particular application) but have not been exposed to the environment and possibly other applications running there in.
So since it is not feasible, or fair, to ask developers to go oncall, it is left to us poor saps (generally myself and a DBA in the States). This problem will only get worse as time goes on: the more applications added to the environment, the more complex the support requirements, the less available developers are to do frontline support.
So my questions are:
Has anyone faced this kind of a problem before?
What kind of an individual is most suitable for frontline support?
What structures could be put in place to address this problem?
What tools do people use to help them in frontline support of their J2EE systems?
In my mind, a suitable candidate needs, at the very least the following skills:
Knowledge of Unix commands
Working knowledge of Oracle AS, various OC4j instances, config files, deployment structure etc.
Good, not necessarily expert level, of Java. Someone who can make sense of a stack trace at least.
Awareness of the enterprise, not just the application servers but all constituent parts in the application i.e. database, ldaps, external hosts etc.
Thanks much in advance to anyone who can offer any advice on this topic.

Jason,
You said:
So since it is not feasible, or fair, to ask developers to go oncallActually, in my experience, developers are always "oncall". In the company that I work for, a developer can be contacted whenever and asked to help with some support issue.
Good Luck,
Avi.

How can I see Indic scripts in Wikipedia using Firefox 3.6.3?

I use Firefox 3.6.3 on Windows XP. I cannot see the Indic scripts in Wikipedia.
The page http://en.wikipedia.org/wiki/Help:Multilingual_support_%28Indic%29 is of no use at all, because it never mentions Firefox 3.6.3, only 1.5 and 3.0 and what worked for them doesn't work for me.
What should I do to see all the scripts in Wikipedia correctly?
== This happened ==
Every time Firefox opened
== Maybe with a new version of Firefox?

The Firefox version doesn't matter.
Only matters is that you have installed Indic (complex script) support in Windows and that you have all fonts installed as well.
Which Indic scripts are causing problems?
Does the help page indicate that support for that script is present in Windows XP?
See also http://en.wikipedia.org/wiki/Supplementary_Multilingual_Plane

MBAM 2.0 - Complex PIN support

Similar Messages

Maybe you are looking for