4 ms·

This is one reason why we use BitLocker with TPM unlock on all of our student PCs. If the system is booted in an usual way like this, the disk won't unlock. We

This is one reason why we use BitLocker with TPM unlock on all of our student PCs. If the system is booted in an usual way like this, the disk won't unlock. We had issues our first year with a student who booted a Linux DVD and reset the local administrator password and another instance where the student removed the hard drive to do the same (after we'd locked our BIOS settings). Encrypting the drives has 100% prevented these problems, and makes us feel better about sending failed drives to vendors without wiping them.

Shank 12y ago
If your students can physically remove the hard drive, you should consider physical security rather than software security.
- Someone1234 12y ago
  What exactly are you suggesting? Those dumb case keys everyone now has? Or security screws? CCTV likely won't help as you cannot realistically get 100% coverage of every lab on site. So while it might stop someone walking out with a tower (or ID them), it wouldn't stop anyone doing this... Honestly software security is the optimal solution. It solves a whole host of threat models (alternative boot media, repair tool, HDD removal, stolen machines, HDD warranty data leaks, lost laptops, etc). All physical security does with that in place is stop someone stealing your internal components, but it is expensive to do well and relatively easy to defeat with just a screwdriver or paperclip (and "unlimited" time).
- discreditable 12y ago
  These are laptops that the students take home with them. The lab computers are physically secured.
  - driverdan 12y ago
    If the student knows enough to boot Linux and remove admin passwords why don't you just let them have admin access?
    - discreditable 12y ago
      Because they use it to circumvent restrictions on our network and devices. Our early years we had some students do this. They used proxy software, installed games, cheated on tests, etc. It was a giant mess and made staff question the effectiveness of our laptop program. I don't doubt that some students would use admin access responsibly, it's the other 90% of kids that won't that are the problem.
DanBlake 12y ago
If you have physical access to the harddrive and can turn it on or off legitimately, then can you not just image the harddrive to a backup (While its running) then modify whatever files you want and restore the new modified backup back to the harddrive? Sounds to me like you would be off to the races then. Bottom line is, if you let people have physical access to the machine, they can always own it.
- discreditable 12y ago
  > an you not just image the harddrive to a backup (While its running) The disk contents are fully encrypted, and Windows will only boot when the system is in an untampered state (via TPM unlock). A student would have to compromise Windows in a way that escalates their privileges. From there they could turn BitLocker off if they liked. This is far from impossible, but we also use AppLocker to prevent students from running any software that has not be explicitly approved--so they would have to compromise some software which is already installed. I won't delude myself and say it's impossible to compromise all of this, but for my goal of keeping 13-18 year-olds from resetting the local admin password it is quite sufficient.
- stevecalifornia 12y ago
  TPM is a chip on the motherboard that stores the keys for the encrypted hard-drive. You can't move the hard disk to another machine or use a backup to go elsewhere because it won't have the correct key on the TPM to decrypt the hard drive.
  - rilita 12y ago
    If you have physical access, just reset the bios and reinstall windows on the box from scratch. If the bios cannot be reset ( is such a thing possible ) then remove, clip, or melt the tpm chip in order to force the system to forget it's tpm info?
    - Klathmon 12y ago
      It's not that the TPM chip is "enforcing" the encryption, it actually contains the "password" to it. So if you remove, clip, or melt the TPM chip the hard drives' data is forever lost, as that key is now destroyed.

Shank 12y ago

If your students can physically remove the hard drive, you should consider physical security rather than software security.

Someone1234 12y ago
What exactly are you suggesting? Those dumb case keys everyone now has? Or security screws? CCTV likely won't help as you cannot realistically get 100% coverage of every lab on site. So while it might stop someone walking out with a tower (or ID them), it wouldn't stop anyone doing this... Honestly software security is the optimal solution. It solves a whole host of threat models (alternative boot media, repair tool, HDD removal, stolen machines, HDD warranty data leaks, lost laptops, etc). All physical security does with that in place is stop someone stealing your internal components, but it is expensive to do well and relatively easy to defeat with just a screwdriver or paperclip (and "unlimited" time).
discreditable 12y ago
These are laptops that the students take home with them. The lab computers are physically secured.
- driverdan 12y ago
  If the student knows enough to boot Linux and remove admin passwords why don't you just let them have admin access?
  - discreditable 12y ago
    Because they use it to circumvent restrictions on our network and devices. Our early years we had some students do this. They used proxy software, installed games, cheated on tests, etc. It was a giant mess and made staff question the effectiveness of our laptop program. I don't doubt that some students would use admin access responsibly, it's the other 90% of kids that won't that are the problem.

DanBlake 12y ago

If you have physical access to the harddrive and can turn it on or off legitimately, then can you not just image the harddrive to a backup (While its running) then modify whatever files you want and restore the new modified backup back to the harddrive? Sounds to me like you would be off to the races then. Bottom line is, if you let people have physical access to the machine, they can always own it.

discreditable 12y ago
> an you not just image the harddrive to a backup (While its running) The disk contents are fully encrypted, and Windows will only boot when the system is in an untampered state (via TPM unlock). A student would have to compromise Windows in a way that escalates their privileges. From there they could turn BitLocker off if they liked. This is far from impossible, but we also use AppLocker to prevent students from running any software that has not be explicitly approved--so they would have to compromise some software which is already installed. I won't delude myself and say it's impossible to compromise all of this, but for my goal of keeping 13-18 year-olds from resetting the local admin password it is quite sufficient.
stevecalifornia 12y ago
TPM is a chip on the motherboard that stores the keys for the encrypted hard-drive. You can't move the hard disk to another machine or use a backup to go elsewhere because it won't have the correct key on the TPM to decrypt the hard drive.
- rilita 12y ago
  If you have physical access, just reset the bios and reinstall windows on the box from scratch. If the bios cannot be reset ( is such a thing possible ) then remove, clip, or melt the tpm chip in order to force the system to forget it's tpm info?
  - Klathmon 12y ago
    It's not that the TPM chip is "enforcing" the encryption, it actually contains the "password" to it. So if you remove, clip, or melt the TPM chip the hard drives' data is forever lost, as that key is now destroyed.