ProFox

profox@leafe.com

2704 discussions

Re: [NF] "Modern Standby", Win 10, and Bitlocker with Azure
by Ken Dibble 28 Jun '18

28 Jun '18

Thank you. It's not my fear. We have taken on a subcontract to provide Help Desk support for another organization that is supplying these laptops. We were told the laptops would have "full disk encryption", so that's I what I expected to find when I received them. I did not find what I expected. When I think "full disk encryption", I think that means that when the user turns the machine on, s/he has to enter some credentials before s/he even sees the OS login screen. In other words, the entire disk outside of the master boot record must be manually unlocked before any use can be made of it, no matter where that disk is or who is trying to use it. Having successfully done that, I then expect the user to have to enter another set of credentials at the OS login screen before s/he can use the machine. (Two factor authentication would not work in legitimate situations where there is no internet or phone service, a very common situation in my rural part of the country.) That is what you get if you set up "full disk encryption" using VeraCrypt on a Windows 7 machine. We don't do this very often. I prefer simply to create a separate data partition and encrypt that so the user doesn't need two sets of credentials if s/he isn't going to do anything but, say, run a web browser to access encrypted websites. We don't use BitLocker for this because our laptops are Win7 Pro, not Ultimate. You have to have Ultimate to set up Bitlocker encryption in Win 7 (you only need Pro to read a Bitlocker-encrypted device, like a USB memory stick). So apparently there are two completely different definitions of "full disk encryption" out there in the wild. Both will protect you if somebody steals the device and pulls the HDD out of it. (However, I also thought that ordinary Windows encryption, present in XP and perhaps earlier, would do that.) One of them will protect you if somebody steals the device and one set of credentials; they other one won't. I will point out that I'm not the only person who saw it this way; both of my assistants, who are experienced computer guys and not relying on me, had the same definition of "full disk encryption" in their heads. Since the organization that is paying us has the responsibility for complying with federal NIST security standards, and not me, I will shrug this off even though I don't believe that what you have described--and what the organization has done--actually complies with the standard in question. Anyway, thanks for your help. Ken >BitLocker will only prompt for a recovery key if it detects the device that >the hard drive is in has changed. It's inconspicuous in day-to-day use (and >it has nothing to do with being connected to the Internet or in Modern >Standby mode). > >The purpose is to protect the data when the drive is removed and put into >another machine to be read. If someone steals your entire machine and knows >the local login credentials, well you're on your own. If that's your fear >maybe enable two-factor authentication (e.g. Windows Hello and a PIN). > >Eric > > >On Wed, Jun 27, 2018 at 11:53 AM, Ken Dibble <krdibble(a)stny.rr.com> wrote: > > > Perhaps someone here can answer this question. > > > > I have a Windows 10 Pro laptop. It is part of an Azure AD domain, in which > > InTune is being used for a variety of management functions. It is supposed > > to have Bitlocker full disk encryption enabled, and the Bitlocker key is > > stored in InTune. > > > > I do not connect any cables to this laptop. I simply turn it on. I do not > > manually connect it to any wireless internet source. The machine displays a > > standard Windows 10 login screen. Having local admin credentials, I log in > > and get full access to the machine. > > > > What is wrong with this picture? > > > > As I understand Win 10 Bitlocker disk encryption, I don't need to supply > > pre-boot credentials if the computer can see the internet, or if the > > machine has "Modern Standby" enabled. I understand the latter to mean that > > the laptop has never been fully turned off since somebody unlocked the > > encryption. > > > > If I am correct, since I did not connect the laptop to any internet > > source, yet I still am able to get into the machine using only the local > > admin credentials, if Bitlocker full-disk encryption is actually > > implemented, then the machine must be in "Modern Standby". > > > > I don't use Windows 10 but to me this situation is analogous to having set > > up full disk encryption on a Win 7 box, submitted a PIN to get to the login > > screen, and then closed the lid to force hibernation mode. If I open the > > lid I don't need to put in the pre-boot PIN again but I have to log into > > Windows. > > > > As I see it, if somebody steals this laptop as well as the local admin > > credentials, the alleged Bitlocker "full disk encryption" will do > > absolutely nothing to prevent the thief from gaining full control of the > > machine. > > > > Is this correct, or am I, as is often the case, missing some crucial piece > > of information. > > > > Thanks for any help. > > > > Ken Dibble > > www.stic-cil.org > > > > > > [excessive quoting removed by server]

1 0

Re: [NF] "Modern Standby", Win 10, and Bitlocker with Azure
by Eric Selje 28 Jun '18

28 Jun '18

BitLocker will only prompt for a recovery key if it detects the device that the hard drive is in has changed. It's inconspicuous in day-to-day use (and it has nothing to do with being connected to the Internet or in Modern Standby mode). The purpose is to protect the data when the drive is removed and put into another machine to be read. If someone steals your entire machine and knows the local login credentials, well you're on your own. If that's your fear maybe enable two-factor authentication (e.g. Windows Hello and a PIN). Eric On Wed, Jun 27, 2018 at 11:53 AM, Ken Dibble <krdibble(a)stny.rr.com> wrote: > Perhaps someone here can answer this question. > > I have a Windows 10 Pro laptop. It is part of an Azure AD domain, in which > InTune is being used for a variety of management functions. It is supposed > to have Bitlocker full disk encryption enabled, and the Bitlocker key is > stored in InTune. > > I do not connect any cables to this laptop. I simply turn it on. I do not > manually connect it to any wireless internet source. The machine displays a > standard Windows 10 login screen. Having local admin credentials, I log in > and get full access to the machine. > > What is wrong with this picture? > > As I understand Win 10 Bitlocker disk encryption, I don't need to supply > pre-boot credentials if the computer can see the internet, or if the > machine has "Modern Standby" enabled. I understand the latter to mean that > the laptop has never been fully turned off since somebody unlocked the > encryption. > > If I am correct, since I did not connect the laptop to any internet > source, yet I still am able to get into the machine using only the local > admin credentials, if Bitlocker full-disk encryption is actually > implemented, then the machine must be in "Modern Standby". > > I don't use Windows 10 but to me this situation is analogous to having set > up full disk encryption on a Win 7 box, submitted a PIN to get to the login > screen, and then closed the lid to force hibernation mode. If I open the > lid I don't need to put in the pre-boot PIN again but I have to log into > Windows. > > As I see it, if somebody steals this laptop as well as the local admin > credentials, the alleged Bitlocker "full disk encryption" will do > absolutely nothing to prevent the thief from gaining full control of the > machine. > > Is this correct, or am I, as is often the case, missing some crucial piece > of information. > > Thanks for any help. > > Ken Dibble > www.stic-cil.org > > > [excessive quoting removed by server]

1 0

VFP9 and Blat
by Desmond Lloyd 28 Jun '18

28 Jun '18

Good Morning all, Have been using Blat here at work for years. Essentially modifying the code as the need arose. now have a client that I would like to use it on, but for some reason it always returns a code 1 in the new environment but works fine here at work... Would someone please look at the sample below to see what I might be missing? LPARAMETERS lcsubject, lcbody, lcrecipient, lcfrom, lccopyto lcFrom = 'dlloyd(a)wow.com' *lcfrom = 'dlloyd(a)test.com' lcSubject = 'Email Test' set Safety off lcBody = 'This is a Test of an automated email system. Third Test. Would you Please reply if received'+ CHR(13) + CHR(10) + CHR(13) + CHR(10) lcRecipient = 'desmond.lloyd(a)gmail.com' STRTOFILE(lcbody, "Body.txt") lcstring = 'C:\Body.txt -s "' + lcsubject + '" -to ' + lcrecipient + ' -f ' + lcfrom + ' -u '+'dlloyd'+' -pw '+'password'+ ' -server '+'192.168.999..62' dll_name = "blat.dll" DECLARE INTEGER Send in &dll_name STRING blatstring lnresult = send(lcstring) IF lnresult > 0 wait window 'Result: '+alltrim(str(lnREsult)) ENDIF --- StripMime Report -- processed MIME parts --- multipart/alternative text/plain (text body -- kept) text/html ---

5 5

Re: [ADMIN] Filter Redux
by Ed Leafe 27 Jun '18

27 Jun '18

On Jun 27, 2018, at 2:05 PM, Ken Dibble <krdibble(a)stny.rr.com> wrote: > > Message sent 12:53 PM EDT. Not received by 3:04 PM EDT, and not in the archives. > > Ed? Please check the filter again. I don't know why it doesn't like your email, but it rated it as 90% spam and held it. If this happens again, no need to send to the list - just send an email directly to me: ed(a)leafe.com -- Ed Leafe --- StripMime Report -- processed MIME parts --- multipart/signed text/plain (text body -- kept) application/pgp-signature ---

1 0

[ADMIN] Filter Redux
by Ken Dibble 27 Jun '18

27 Jun '18

Message sent 12:53 PM EDT. Not received by 3:04 PM EDT, and not in the archives. Ed? Please check the filter again. Thanks. Ken Dibble www.stic-cil.org

1 0

[NF] "Modern Standby", Win 10, and Bitlocker with Azure
by Ken Dibble 27 Jun '18

27 Jun '18

Perhaps someone here can answer this question. I have a Windows 10 Pro laptop. It is part of an Azure AD domain, in which InTune is being used for a variety of management functions. It is supposed to have Bitlocker full disk encryption enabled, and the Bitlocker key is stored in InTune. I do not connect any cables to this laptop. I simply turn it on. I do not manually connect it to any wireless internet source. The machine displays a standard Windows 10 login screen. Having local admin credentials, I log in and get full access to the machine. What is wrong with this picture? As I understand Win 10 Bitlocker disk encryption, I don't need to supply pre-boot credentials if the computer can see the internet, or if the machine has "Modern Standby" enabled. I understand the latter to mean that the laptop has never been fully turned off since somebody unlocked the encryption. If I am correct, since I did not connect the laptop to any internet source, yet I still am able to get into the machine using only the local admin credentials, if Bitlocker full-disk encryption is actually implemented, then the machine must be in "Modern Standby". I don't use Windows 10 but to me this situation is analogous to having set up full disk encryption on a Win 7 box, submitted a PIN to get to the login screen, and then closed the lid to force hibernation mode. If I open the lid I don't need to put in the pre-boot PIN again but I have to log into Windows. As I see it, if somebody steals this laptop as well as the local admin credentials, the alleged Bitlocker "full disk encryption" will do absolutely nothing to prevent the thief from gaining full control of the machine. Is this correct, or am I, as is often the case, missing some crucial piece of information. Thanks for any help. Ken Dibble www.stic-cil.org

1 0

[NF] Tool to help you monitor mySQL/Marina
by Stephen Russell 26 Jun '18

26 Jun '18

Looks similar to tools I use to check on SQL Server. Not sure the $$ just ging you a heads up on it. https://www.webyog.com/product/monyog -- Stephen Russell Sr. Analyst Ring Container Technology Oakland TN 901.246-0159 cell --- StripMime Report -- processed MIME parts --- multipart/alternative text/plain (text body -- kept) text/html ---

5 8

CAN You Hear the Silence???
by Kurt at VR-FX 26 Jun '18

26 Jun '18

Wow - was surprised not to receive ANY Forum postings since 6/16! Has it really been that silent - or have I been unsubscribed for some reason? Hmmm... -K-

2 1

VFP in Windows on a Mac
by john＠johnweller.co.uk 26 Jun '18

26 Jun '18

I have had a nightmare installing the latest Win 10 update. The only thing stopping me from throwing the PC out of the window and going out and buying a Mac was the fact that I have a number of apps still in use written in VFP which I need to maintain. I was told recently that I could run Windows on a Mac - has anyone any experience of running VFP under Windows on a Mac? John John Weller 01380 723235 07976393631 --- StripMime Report -- processed MIME parts --- multipart/alternative text/plain (text body -- kept) text/html ---

11 20

Nothing like a cryptic error to start the work week!
by mbsoftwaresolutions＠mbsoftwaresolutions.com 25 Jun '18

25 Jun '18

VFP9SP2, Win7Pro, MySQL backend Screenshot: https://www.screencast.com/t/QKA2etzLnW I've searched frmEditJob.scx in the Code References for any text of IMG and it found nothing. Ugh. Now how to track down this new mystery?

4 7

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

ProFox