HP 413742-001 User manual

HP ProtectTools Troubleshooting
Guide
HP Compaq Business Desktops
Document Part Number: 413742-001
January 2006
This document contains information and recommendations for the
ProtectTools administrator concerning questions that may arise in the
administration and operation of HP ProtectTools.

© Copyright 2006 Hewlett-Packard Development Company, L.P.
The information contained herein is subject to change without notice.
Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation in the U.S. and other countries.
The only warranties for HP products and services are set forth in the express warranty statements accompanying
such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall
not be liable for technical or editorial errors or omissions contained herein.
This document contains proprietary information that is protected by copyright. No part of this document may be
photocopied, reproduced, or translated to another language without the prior written consent of Hewlett-Packard
Company.
ÅWARNING: Text set off in this manner indicates that failure to follow directions could result in bodily
harm or loss of life.
ÄCAUTION: Text set off in this manner indicates that failure to follow directions could result in damage to
equipment or loss of information.
HP ProtectTools Troubleshooting Guide
HP Compaq Business Desktops
First Edition (January 2006)
Document Part Number: 413742-001

Technical Reference Guide www.hp.com 1
HP ProtectTools Troubleshooting Guide
Overview
HP ProtectTools Security is a new technology offered by HP on some Business PCs. This
technology offers enhanced security support for file/folder encryption, user identity and
protection, Single Sign On, multi-factor authentication, smart card, smart card preboot, token
and biometric support and works natively with the operating system to enhance security aware
applications, such as secure e-mail. The enhanced security is achieved through both hardware
and software. Windows-based management of the BIOS is also incorporated through a BIOS
Configuration module. All software is centrally managed through an HP Security Manager
interface, which can be accessed from the task tray, start menu, or control panel. A properly
enabled security system requires a TPM-enabled BIOS, versions 1.54 or greater, obtainable
through www.hp.com support, and security software available via purchase.
Administrators are encouraged to perform “best practices” in restricting end-user privileges and
restrictive access to users.
Hardware
The hardware consists of a Trusted Platform Module (TPM) which meets the Trusted Computing
Group requirements of TPM 1.2 standards. The card is integrated with the system board and is
part of the NIC. The NIC and TPM solution contains on-chip memory and off-chip memory,
functions and firmware are located on an external flash integrated with the system board. All
TPM functions are encrypted or protected to ensure secure flash or communications.
Software
The software, HP ProtectTools, has two parts: HP ProtectTools Security Manager and HP
plug-in modules. Security Manager is the interface (shell) that centralizes all security
applications (plug-ins). The computer offers security in both configure-to-order and aftermarket
configurations. Both offerings provide a CD which can be used in Microsoft Windows to install
the HP ProtectTools security products. Customers using a non-HP corporate image are
encouraged to use the provided CD to install security software. Some HP Web-based downloads
(SoftPaqs) will not install unless previous versions of security software are already installed on
the target PC.
HP ProtectTools security applications for the computer are:
■HP ProtectTools Security Manager: The software is preinstalled on the hard drive and can be
accessed from the Start Menu or Control Panel applet. The Security Manager shell interface
provides a central point for administering all security plug-in modules. Security plug-ins like
the TPM, Smart Card, and future security products cannot be installed unless the Security
Manager interface is present.
■HP ProtectTools Embedded Security: This supports the TPM 1.2 hardware directly and is
preinstalled on the imaged drive for desktop. In Windows 2000 and Windows XP
environments, this software supports enhanced security for secure e-mail with Microsoft

2 www.hp.com Technical Reference Guide
HP ProtectTools Troubleshooting Guide
Outlook or Outlook Express, and it supports enhanced security for Microsoft EFS file/folder
encryption. The software also provides a function called Personal Secure Drive (PSD). The
PSD is a function in addition to the EFS-based file/folder encryption, and it uses the
Advanced Encryption Standard (AES) encryption algorithm. It is important to note that HP
ProtectTools Personal Secure Drive cannot function unless the TPM is unhidden, enabled
with appropriate software installed with ownership, and the user configuration initialized.
Additionally, the TPM also supports data management functions, such as backing up and
restoring the key hierarchy, support for third-party applications that use MSCAPI (such as
Microsoft Outlook and Internet Explorer) and applications that use PKCS#11 (such as
Netscape) for protected digital certificate operations when using the Embedded Security
software.
■HP ProtectTools TPM Firmware Update Utility: This utility is a Web-based SoftPaq for
updating your TPM firmware.
■HP Credential Manager for ProtectTools: This tool provides identity management and has
security features that protect against unauthorized access to your computer. These features
include the following:
❏Alternatives login capability as opposed to passwords when logging on to Windows,
such as using a smart card or biometric reader to log on to Windows
❏Single Sign On feature that automatically remembers credentials for Web sites,
applications, and protected network resources
❏Support for optional security devices, such as smart cards and biometric readers
❏Support for additional security settings, such as requiring authentication with an optional
security device to unlock the computer and access applications
❏Enhanced encryption for stored passwords, when implemented with a TPM Embedded
Security chip
■Smart Card Security for ProtectTools: This tool manages the smart card setup and
configuration for computers equipped with an optional smart card reader. The smart card
BIOS security mode is available on some models. When enabled, this mode requires you to
use a smart card to log on to the computer.
■BIOS Configuration for ProtectTools: This configuration provides access to the Computer
Setup Utility security and configuration settings. This allows users to access system security
features managed by Computer Setup through Windows.
Please consult the HP ProtectTools Security Manager Guide that shipped with the computer or
access this online at http://www.hp.com along with the latest software, firmware, driver, and
support materials. Help files provided with the installed product contain a variety of
troubleshooting, configuration, and functional product data, and they are considered the first
direct source of information.
Table A Glossary of HP ProtectTools Embedded Security Related Terminology
Acronym Term Detail
AES Advanced Encryption
Standard
A symmetric 128-bit block data encryption technique
API Application Programming
Interface
A series of internal operating system functions that applications
can use to perform various tasks
CSP Cryptographic Service
Provider
A software component that interfaces with the MSCAPI

Technical Reference Guide www.hp.com 3
HP ProtectTools Troubleshooting Guide
EFS Encryption File System A transparent file encryption service provided by Microsoft for
Windows 2000 or later
LPC Low Pin Count Defines an interface used by the HP ProtectTools Embedded
Security device to connect with the platform chipset. The bus
consists of 4 bits of Address/Data pins, along with a 33Mhz
clock and several control/status pins.
MSCAPI: Microsoft Cryptographic
API, or CryptoAPI
An API from Microsoft that provides an interface to the
Windows operating system for cryptographic applications
PKCS Public Key Cryptographic
Standards
Standards generated that govern definition and use of Public
Key/Private Key means of encryption and decryption.
PKI Public Key Infrastructure A general term defining the implementation of security systems
that use Public Key/Private Key encryption and decryption
PSD Personal Secure Drive A feature that is provided by HP ProtectTools Embedded
Security. This application creates a virtual drive on the user's
machine that automatically encrypts files/folders that are moved
into the virtual drive.
S/MIME Secure Multipurpose
Internet Mail Extensions
A specification for secure electronic messaging using PKCS.
S/MIME offers authentication via digital signatures and privacy
via encryption
TCG Trusted Computing Group Industry association set up to promote the concept of a “Trusted
PC.” TCG supersedes TCPA
TCPA Trusted Computing Platform
Alliance
Trusted computing alliance; now superseded by TCG
TPM Trusted Platform Module TPM hardware and software enhances the security of EFS and
the Personal Secure Drive by protecting the keys used by EFS
and the Personal Secure Drive.
In systems without the TPM, the keys used for EFS and the PSD
are normally stored on the hard drive. This makes the keys
potentially vulnerable. In systems with the TPM card, the TPM's
private Storage Root Keys, which never leave the TPM chip, are
used to “wrap” or protect the keys used by EFS and by the PSD.
Breaking into the TPM to extract the private keys is much more
difficult than hacking onto the system's hard drive to obtain the
keys.
The TPM also enhances the security of secure e-mail via
S/MIME in Microsoft Outlook and Outlook Express. The TPM
functions as a Cryptographic Service Provider (CSP). Keys and
certificates are generated and/or supported by the TPM
hardware, providing significantly greater security than
software-only implementations.
Acronym Term Detail

4 www.hp.com Technical Reference Guide
HP ProtectTools Troubleshooting Guide
Software
Impacted-Short
description
Details Solution / Workaround
HP ProtectTools Embedded
Security—Encrypting
folders, sub folders, and
files on PSD cause error
message
If the user copies files and
folders to the PSD and tries to
encrypt folders/files or
folders/subfolders, the Error
Applying Attributes
message appears. The user
can encrypt the same files on
the C:\ drive on an extra
installed hard drive.
This is as designed.
Moving files/folders to the PSD automatically
encrypts them. There is no need to
“double-encrypt” the files/folders. Attempting to
double-encrypt them using on the PSD using EFS
will produce this error message.
HP ProtectTools Embedded
Security—Cannot Take
Ownership With Another
OS In Multi-Boot Platform
If a drive is set up for multiple
OS boot, ownership can only
be taken with the platform
initialization wizard in one
operating system.
This is as designed.
For security reasons, the Embedded Security is
designed to work with only one OS per system.
HP ProtectTools Embedded
Security—Unauthorized
administrator can view,
delete, rename, or move
the contents of encrypted
EFS folders
Encrypting a folder does not
stop an unauthorized user
with administrative rights to
view, delete, or move
contents of the folder.
This is as designed.
It is a feature of EFS, not the Embedded Security
TPM. Embedded Security uses Microsoft EFS
software, and EFS preserves file/folder access
rights for all administrators.
HP ProtectTools Embedded
Security—Encrypted folders
with EFS in Windows 2000
are not shown highlighted
in green
Encrypted folders with EFS
are highlighted in green in
Windows XP, but not in
Windows 2000.
This is as designed.
It is a feature of EFS that it does not highlight
encrypted folders in Windows 2000, but it does
in Windows XP. This is true whether or not an
Embedded Security TPM is installed.
HP ProtectTools Embedded
Security—EFS does not
require a password to view
encrypted files in Windows
2000
If a user sets up the
Embedded Security, logs on
as an administrator, then logs
off and back on as the
administrator, the user can
subsequently see files/folders
in Windows 2000 without a
password.
This is as designed.
It is a feature of EFS in Windows 2000. EFS in
Windows XP, by default, will not let the user
open files/folders without a password.
HP ProtectTools Embedded
Security—Software should
not be installed on a restore
with FAT32 partition
If the user attempts to restore
the hard drive using FAT32,
there will be no encrypt
options for any files/folders
using EFS.
This is as designed.
Microsoft EFS is supported only on NTFS and
will not function on FAT32. This is a feature of
Microsoft's EFS and is not related to HP
ProtectTools software.

Technical Reference Guide www.hp.com 5
HP ProtectTools Troubleshooting Guide
HP ProtectTools Embedded
Security—Initialization fails
for TPM module after
system restore.
If the user restores the hard
drive from the restore CD,
initialization of the TPM fails.
This is as designed.
The TPM must be reset and enabled again in
Computer Setup (F10) Utility prior to
initialization.
HP ProtectTools Embedded
Security—Windows 2000
User can share to the
network any PSD with the
hidden ($) share
Windows 2000 User can
share to the network any PSD
with the hidden ($) share. The
hidden share can be
accessed over the network
using the hidden ($) share.
The PSD is not normally shared on the network,
but it can be through the hidden ($) share in
W2K only. HP recommends always having the
built-in Administrator account
password-protected.
HP ProtectTools Embedded
Security—User is able to
encrypt or delete the
recovery archive XML file
By design, the ACLs for this
folder is not set; therefore, a
user can inadvertently or
purposely encrypt or delete
the file, making it
inaccessible. Once this file
has been encrypted or
deleted, no one can use the
TPM software.
This is as designed.
Users have access rights to an emergency
archive in order to save/update their basic user
key backup copy. Customers should adopt a
'best practices' security approach and instruct
users never to encrypt or delete the recovery
archive files.
HP ProtectTools Embedded
Security—HP ProtectTools
Embedded Security EFS
interaction with Norton
Antivirus produces longer
encryption/decryption and
scan times
Encrypted files interfere with
Norton Anti Virus 2005 virus
scan. During the scan
process, the Basic User Key
password prompt asks the
user for a password every
10 files or so. If the user does
not enter a password, the
Basic User Key password
prompt times out, allowing
NAV2005 to continue with
the scan. Encrypting files
using HP ProtectTools
Embedded Security EFS takes
longer when Norton Antivirus
is running.
To reduce the time required to scan HP
ProtectTools Embedded Security EFS files, the
user can either enter the encryption password
before scanning or decrypt before scanning.
To reduce the time required to encrypt/decrypt
data using HP ProtectTools Embedded Security
EFS, the user should disable Auto-Protect on
Norton Antivirus.
HP ProtectTools Embedded
Security—Cannot save
emergency recovery
archive to removable
media
If the user inserts an MMC or
SD card when creating the
emergency recovery archive
path during Embedded
Security Initialization, an
error message is displayed.
This is as designed.
Storage of the recovery archive on removable
media is not supported. The recovery archive
can be stored on a network drive or another
local drive other than the C drive.
Software
Impacted-Short
description
Details Solution / Workaround

6 www.hp.com Technical Reference Guide
HP ProtectTools Troubleshooting Guide
HP ProtectTools Embedded
Security—Cannot encrypt
any data in the Windows
2000 French (France)
environment.
There is no Encrypt selection
when right-clicking a file icon.
This is a Microsoft operating system limitation. If
the locale is changed to anything else (French
(Canada), for example), then the Encrypt
selection will appear.
To work around the problem, encrypt the file as
follows: right-click the file icon and select
Property > Advanced > Encrypt
Contents.
HP ProtectTools Embedded
Security—Errors occur after
experiencing a power loss
while taking ownership
during the Embedded
Security Initialization
If there is a power loss while
initializing the Embedded
Security chip, the following
issues will occur:
• When attempting to
launch the Embedded
Security Initialization
Wizard, the following
error is displayed:
The Embedded
security cannot be
initialized since the
Embedded Security
chip has already an
Embedded Security
owner.
• When attempting to
launch the User
Initialization Wizard, the
following error is
displayed:
The Embedded
security is not
initialized. To use the
wizard, the
Embedded Security
must be initialized
first.
Perform the following procedure to recover from
the power loss:
✎Use the Arrow keys to select various menus,
menu items, and to change values (unless
otherwise specified).
1. Start or restart the computer.
2. Press F10 when the F10=Setup message
appears on screen (or as soon as the
monitor LED turns green).
3. Select the appropriate language option.
4. Press Enter.
5. Select Security > Embedded Security.
6. Set the Embedded Security Device option to
Enable.
7. P r e s s F10 to accept the change.
8. Select File > Save Changes and Exit.
9. Press ENTER.
10. Press F10 to save the changes and exit the
F10 Setup utility.
HP ProtectTools Embedded
Security—Computer Setup
(F10) Utility password can
be removed after enabling
TPM Module
Enabling the TPM module
requires a Computer Setup
(F10) Utility password. Once
the module has been
enabled, the user can remove
the password. This allows
anyone with direct access to
the system to reset the TPM
module and cause possible
loss of data.
This is as designed.
The Computer Setup (F10) Utility password can
only be removed by a user who knows the
password. However, HP strongly recommends
having the Computer Setup (F10) Utility
password protected at all times.
Software
Impacted-Short
description
Details Solution / Workaround

Technical Reference Guide www.hp.com 7
HP ProtectTools Troubleshooting Guide
HP ProtectTools Embedded
Security—The PSD
password box is no longer
displayed when the system
becomes active after
Standby status
When a user logs on the
system after creating a PSD,
the TPM asks for the basic
user password. If the user
does not enter the password
and the system goes into
Standby, the password
dialog box is no longer
available when the user
resumes.
This is by design.
The user has to log off and back on to view the
PSD password box again.
HP ProtectTools Embedded
Security—No password
required to change the
Security Platform Policies
Access to Security Platform
Policies (both Machine and
User) does not require a TPM
password for users who have
administrative rights on the
system.
This is by design.
Any administrator can modify the Security
Platform Policies with or without TPM user
initialization.
HP ProtectTools Embedded
Security—Microsoft EFS
does not fully work in
Windows 2000
An administrator can access
encrypted information on the
system without knowing the
correct password. If the
administrator enters an
incorrect password or cancels
the password dialog, the
encrypted file will open as if
the administrator had entered
the correct password. This
happens regardless of the
security settings used when
encrypting the data.
The Data Recovery Policy is automatically
configured to designate an administrator as a
recovery agent. When a user key cannot be
retrieved (as in the case of entering the wrong
password or canceling the Enter Password
dialog), the file is automatically decrypted with
a recovery key.
This is due to the Microsoft EFS. Please refer to
Microsoft Knowledge Base Technical Article
Q257705 for more information.
The documents cannot be opened by a
non-administrator user.
HP ProtectTools Embedded
Security—When viewing a
certificate, it shows as
non-trusted.
After setting up HP
ProtectTools and running the
User Initialization Wizard,
the user has the ability to
view the certificate issued;
however, when viewing the
certificate, it shows as
non-trusted. While the
certificate can be installed at
this point by clicking the
install button, installing it
does not make it trusted.
Self-signed certificates are not trusted. In a
properly configured enterprise environment, EFS
certificates are issued by online Certification
Authorities and are trusted.
Software
Impacted-Short
description
Details Solution / Workaround

8 www.hp.com Technical Reference Guide
HP ProtectTools Troubleshooting Guide
HP ProtectTools Embedded
Security—Intermittent
encrypt and decrypt error
occurs: The process
cannot access the file
because it is being
used by another
process.
Extremely intermittent error
during file encryption or
decryption occurs due to the
file being used by another
process, even though that file
or folder is not being
processed by the operating
system or other applications.
To resolve the failure, the user can log off and
back on to the system. Restart, log off, and log
back in to resolve the issue.
HP ProtectTools Embedded
Security—Data loss in
removable storage occurs if
storage is removed prior to
new data generation or
transfer
Removing storage mediums
such as a MultiBay hard drive
still shows PSD availability
and does not generate errors
while adding/modifying data
to the PSD. After system
restart, the PSD does not
reflect file changes that
occurred while the removable
storage was not available.
The issue is only experienced if the user
accesses the PSD, then removes the hard drive
before completing new data generation or
transfer. If the user attempts to access the PSD
when the removable hard drive is not present,
an error message is displayed stating that the
device is not ready.
HP ProtectTools Embedded
Security—During uninstall,
if user has not initialized
the Basic User Key and
opens the Administration
tool, the Disable option is
not available and
Uninstaller will not continue
until the Administration tool
is closed.
During uninstallation, the user
has the option of uninstalling
either without disabling the
TPM or by first disabling the
TPM (through Admin. tool),
then uninstalling. Accessing
the Admin tool requires Basic
User Key initialization. If
basic initialization has not
occurred, all options are
inaccessible to the user.
Since the user has explicitly
chosen to open the Admin
tool (by clicking Yes in the
dialog box prompting Click
Yes to open Embedded
Security Administration
tool), uninstall waits until the
Admin tool is closed. If user
clicks No in that dialog box,
then the Admin tool does not
open at all and uninstall
proceeds.
The Admin tool is used for disabling the TPM
chip, but that option is not available unless the
Basic User Key has already been initialized. If it
has not, then select Ok or Cancel in order to
continue with the uninstallation process.
Software
Impacted-Short
description
Details Solution / Workaround