다음을 통해 공유

Configuration.mof 파일 편집

  • 아티클

클라이언트 컴퓨터가 MBAM Configuration Manager 보고서를 통해 BitLocker 준수 세부 정보를 보고할 수 있도록 하려면 Configuration Manager 2007 또는 System Center 2012 Configuration Manager 사용하든 Configuration.mof 파일을 편집해야 합니다. 사용 중인 Configuration Manager 버전에 대한 다음 지침을 완료합니다.

중요 새 설치를 수행하거나 이전 버전에서 업그레이드하여 Microsoft BitLocker 관리 및 모니터링(MBAM) 2.0 SP1(서비스 팩 1)을 설치하는 경우 다음 글머리 기호에 설명된 대로 About MBAM 2.0 SP1 의 적절한 항목을 참조하세요.

  • 새 MBAM 2.0 SP1 설치의 경우 Configuration Manager MBAM을 사용하는 경우 MBAM 2.0 SP1을 설치하는 데 필요한 파일을 참조하세요.

  • MBAM 2.0 SP1로 업그레이드하려면 MBAM 2.0 SP1로 업그레이드하고 Configuration Manager 2007에서 MBAM을 사용하는 경우 configuration.mof 파일 업데이트를 참조하세요.

Configuration Manager 함께 MBAM 2.0 SP1을 사용하는 경우 configuration.mof 파일을 만들려면

  • MBAM 2.0 SP1에 대한 적절한 지침은 이 항목의 앞부분에 있는 MBAM 2.0 SP1에 대한 "중요" 참고 사항을 참조하세요.

System Center 2012 Configuration Manager 대한 Configuration.mof 파일을 편집하려면

  1. Configuration Manager 서버에서 Configuration.mof 파일의 위치를 찾습니다.

    <CMInstallLocation>\Inboxes\clifiles.src\hinv\

    기본 설치에서 설치 위치는 %systemdrive%\Program Files \Microsoft Configuration Manager.

  2. Configuration.mof 파일을 편집하여 다음 MBAM 클래스를 추가합니다.

    //===================================================
// Microsoft BitLocker Administration and Monitoring 
//===================================================
#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL)
[Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")]
class Win32_BitLockerEncryptionDetails
{
    [PropertySources{"DeviceId"},key]
    String     DeviceId;
    [PropertySources{"BitlockerPersistentVolumeId"}]
    String     BitlockerPersistentVolumeId;
    [PropertySources{"BitLockerManagementPersistentVolumeId"}]
    String     MbamPersistentVolumeId;
    //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3
    [PropertySources{"BitLockerManagementVolumeType"}]
    SInt32     MbamVolumeType;
    [PropertySources{"DriveLetter"}]
    String     DriveLetter;
    //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2
    [PropertySources{"Compliant"}]
    SInt32     Compliant;
    [PropertySources{"ReasonsForNonCompliance"}]
    SInt32     ReasonsForNonCompliance[];
    [PropertySources{"KeyProtectorTypes"}]
    SInt32     KeyProtectorTypes[];
    [PropertySources{"EncryptionMethod"}]
    SInt32     EncryptionMethod;
    [PropertySources{"ConversionStatus"}]
    SInt32     ConversionStatus;
    [PropertySources{"ProtectionStatus"}]
    SInt32     ProtectionStatus;
    [PropertySources{"IsAutoUnlockEnabled"}]
    Boolean     IsAutoUnlockEnabled;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL)
 [DYNPROPS]
Class Win32Reg_MBAMPolicy
{
    [key]
    string KeyName;

    //General encryption requirements
    UInt32    OsDriveEncryption;
    UInt32    FixedDataDriveEncryption;
    UInt32    EncryptionMethod;

    //Required protectors properties
    UInt32    OsDriveProtector;
    UInt32    FixedDataDriveAutoUnlock;
    UInt32    FixedDataDrivePassphrase;

    //MBAM agent fields
    Uint32    MBAMPolicyEnforced;
    string    LastConsoleUser;
    datetime  UserExemptionDate;
    UInt32    MBAMMachineError;

    // Encoded computer name
    string    EncodedComputerName;
};

[DYNPROPS]
Instance of Win32Reg_MBAMPolicy
{
KeyName="BitLocker policy";

    //General encryption requirements
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")]
    OsDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")]
    EncryptionMethod;

    //Required protectors properties
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")]
    OsDriveProtector;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveAutoUnlock;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")]
    FixedDataDrivePassphrase;

    //MBAM agent fields
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")]
    MBAMPolicyEnforced;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")]
    LastConsoleUser;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")]
    UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")]
    MBAMMachineError;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")]
    EncodedComputerName;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL)
[Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"},
dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")]
class CCM_OperatingSystemExtended
{
    [PropertySources{"Name"},key]
    string     Name;
    [PropertySources{"OperatingSystemSKU"}]
    uint32     SKU;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL)
[Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"},
dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")]
class CCM_ComputerSystemExtended
{
    [PropertySources{"Name"},key]
    string     Name;
    [PropertySources{"PCSystemType"}]
    uint16     PCSystemType;
};

//=======================================================
// Microsoft BitLocker Administration and Monitoring end
//=======================================================

Configuration Manager 2007에 대한 Configuration.mof 파일을 편집하려면

  1. Configuration Manager 서버에서 Configuration.mof 파일의 위치를 찾습니다.

    <CMInstallLocation>\Inboxes\clifiles.src\hinv\

    기본 설치에서 설치 위치는 %systemdrive%\Program Files (x86)\Microsoft Configuration Manager.

  2. Configuration.mof 파일을 편집하여 다음 MBAM 클래스를 추가합니다.

    //===================================================
// Microsoft BitLocker Administration and Monitoring 
//===================================================

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) 
[Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")]
class Win32_BitLockerEncryptionDetails
{
    [PropertySources{"DeviceId"},key]
    String     DeviceId;
    [PropertySources{"BitlockerPersistentVolumeId"}]
    String     BitlockerPersistentVolumeId;
    [PropertySources{"BitLockerManagementPersistentVolumeId"}]
    String     MbamPersistentVolumeId;
    //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3
    [PropertySources{"BitLockerManagementVolumeType"}]
    SInt32     MbamVolumeType;
    [PropertySources{"DriveLetter"}]
    String     DriveLetter;
    //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2
    [PropertySources{"Compliant"}]
    SInt32     Compliant;
    [PropertySources{"ReasonsForNonCompliance"}]
    SInt32     ReasonsForNonCompliance[];
    [PropertySources{"KeyProtectorTypes"}]
    SInt32     KeyProtectorTypes[];
    [PropertySources{"EncryptionMethod"}]
    SInt32     EncryptionMethod;
    [PropertySources{"ConversionStatus"}]
    SInt32     ConversionStatus;
    [PropertySources{"ProtectionStatus"}]
    SInt32     ProtectionStatus;
    [PropertySources{"IsAutoUnlockEnabled"}]
    Boolean     IsAutoUnlockEnabled;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL)
 [DYNPROPS]
Class Win32Reg_MBAMPolicy
{
    [key]
    string KeyName;

    //General encryption requirements
    UInt32    OsDriveEncryption;
    UInt32    FixedDataDriveEncryption;
    UInt32    EncryptionMethod;

    //Required protectors properties
    UInt32    OsDriveProtector;
    UInt32    FixedDataDriveAutoUnlock;
    UInt32    FixedDataDrivePassphrase;

    //MBAM agent fields
    Uint32    MBAMPolicyEnforced;
    string    LastConsoleUser;
    datetime  UserExemptionDate;
    UInt32    MBAMMachineError;

    // Encoded computer name
    string    EncodedComputerName;
};

 [DYNPROPS]
Instance of Win32Reg_MBAMPolicy
{
    KeyName="BitLocker policy";

    //General encryption requirements
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")]
    OsDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")]
    EncryptionMethod;

    //Required protectors properties
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")]
    OsDriveProtector;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveAutoUnlock;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")]
    FixedDataDrivePassphrase;

    //MBAM agent fields
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")]
    MBAMPolicyEnforced;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")]
    LastConsoleUser;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")]
    UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")]
    MBAMMachineError;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")]
    EncodedComputerName;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL)
[DYNPROPS]
Class Win32Reg_MBAMPolicy_64
{
    [key]
    string KeyName;

    //General encryption requirements
    UInt32    OsDriveEncryption;
    UInt32    FixedDataDriveEncryption;
    UInt32    EncryptionMethod;

    //Required protectors properties
    UInt32    OsDriveProtector;
    UInt32    FixedDataDriveAutoUnlock;
    UInt32    FixedDataDrivePassphrase;

    //MBAM agent fields
    Uint32    MBAMPolicyEnforced;
    string    LastConsoleUser;
    datetime  UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU
    UInt32    MBAMMachineError;

    // Encoded computer name
    string    EncodedComputerName;
};

[DYNPROPS]
Instance of Win32Reg_MBAMPolicy_64
{
    KeyName="BitLocker policy";

    //General encryption requirements
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")]
    OsDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")]
    EncryptionMethod;

    //Required protectors properties
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")]
    OsDriveProtector;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveAutoUnlock;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")]
    FixedDataDrivePassphrase;

    //MBAM agent fields
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")]
    MBAMPolicyEnforced;
     [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")]
    LastConsoleUser;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")]
    UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")]
    MBAMMachineError;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")]
    EncodedComputerName;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL)
[Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"},
dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")]
class CCM_OperatingSystemExtended
{
    [PropertySources{"Name"},key]
    string     Name;
    [PropertySources{"OperatingSystemSKU"}]
    uint32     SKU;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL)
[Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"},
dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")]
class CCM_ComputerSystemExtended
{
    [PropertySources{"Name"},key]
    string     Name;
    [PropertySources{"PCSystemType"}]
    uint16     PCSystemType;
};

//=======================================================
// Microsoft BitLocker Administration and Monitoring end
//=======================================================

mof 파일을 만들거나 편집하는 방법

Configuration Manager에서 MBAM 배포