Compaq dc5000 - Microtower PC Management Manual

Desktop Management Guide

Business Desktops

Document Part Number: 312947-002

September 2003

This guide provides definitions and instructions for using security and

Intelligent Manageability features that are preinstalled on select models.

© 200 3 Hewlett-Packard Development Company, L.P.

HP, Hewlett Packard, and the Hewlett-Packard logo are trademarks of

Hewlett-Packard Company in the U.S. and other countries.

Compaq and the Compaq logo are trademarks of Hewlett-Packard Development

Company, L.P. in the U.S. and other countries.

Microsoft, MS-DOS, Windows, and Windows NT are trademarks of Microsoft

Corporation in the U.S. and other countries.

All other product names mentioned herein may be trademarks of their respective companies.

Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material. The information in this document is provided “as is” without warranty of any kind, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose, and is subject to change without notice. The warranties for HP products are set forth in the express limited warranty statements accompanying such products. Nothing herein should be construed as constituting an additional warranty.

This document contains proprietary information that is protected by copyright.

No part of this document may be photocopied, reproduced, or translated to another language without the prior written consent of Hewlett-Packard

Company.

Å WARNING: Text set off in this manner indicates that failure to follow directions could result in bodily harm or loss of life.

Ä CAUTION: Text set off in this manner indicates that failure to follow directions could result in damage to equipment or loss of information.

Desktop Management Guide

Business Desktops

Second Edition (September 2003)

Document Part Number: 312947-002

Contents

Desktop Management Guide

Initial Configuration and Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

Remote System Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

Software Updating and Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

HP Client Manager Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Altiris Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Altiris PC Transplant Pro . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

System Software Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Proactive Change Notification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

ActiveUpdate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

ROM Flash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Remote ROM Flash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

HPQFlash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

FailSafe Boot Block ROM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Replicating the Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Dual-State Power Button . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

World Wide Web Site. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Building Blocks and Partners . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Asset Tracking and Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Password Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

Establishing a Setup Password Using Computer Setup . . . . . . . . . . . . . . . . . . . . . . . 25

Establishing a Power-On Password Using

Computer Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Embedded Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

DriveLock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

Smart Cover Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Smart Cover Lock . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

Master Boot Record Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

Before You Partition or Format the Current Bootable Disk . . . . . . . . . . . . . . . . . . . . 47

Cable Lock Provision . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47

Desktop Management Guide www.hp.com

iii

Contents

Fingerprint Identification Technology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Fault Notification and Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Drive Protection System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

Surge-Tolerant Power Supply. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Thermal Sensor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

Index

iv www.hp.com

Desktop Management Guide

Desktop Management Guide

HP Intelligent Manageability provides standards-based solutions for managing and controlling desktops, workstations, and notebook

PCs in a networked environment. HP pioneered desktop manageability in 1995 with the introduction of the industry’s first fully manageable desktop personal computers. HP holds a patent on the manageability technology. Since then, HP has led an industry-wide effort to develop the standards and infrastructure required to effectively deploy, configure, and manage desktops, workstations, and notebook PCs. HP works closely with leading management software solution providers in the industry to ensure compatibility between Intelligent Manageability and these products.

Intelligent Manageability is an important aspect of our broad commitment to providing you with PC Lifecycle Solutions that assist you during the four phases of the desktop PC lifecycle—planning, deployment, management, and transitions.

The key capabilities and features of desktop management are:

■

■

■

■

■

■

Initial configuration and deployment

Remote system installation

Software updating and management

ROM flash

Asset tracking and security

Fault notification and recovery

✎

Support for specific features described in this guide may vary by model or software version.

Desktop Management Guide www.hp.com

1

Desktop Management Guide

Initial Configuration and Deployment

The computer comes with a preinstalled system software image. After a brief software “unbundling” process, the computer is ready to use.

You may prefer to replace the preinstalled software image with a customized set of system and application software. There are several methods for deploying a customized software image. They include:

■ Installing additional software applications after unbundling the preinstalled software image.

■

Using software deployment tools, such as Altiris Deployment

Solution™, to replace the preinstalled software with a customized software image.

■ Using a disk cloning process to copy the contents from one hard drive to another.

The best deployment method depends on your information technology environment and processes. The PC Deployment section of the HP Lifecycle Solutions Web site

( http://h18000.www1.hp.com/solutions/pcsolutions ) provides information to help you select the best deployment method.

The Restore Plus!

CD, ROM-based setup, and ACPI hardware provide further assistance with recovery of system software, configuration management and troubleshooting, and power management.

2 www.hp.com

Desktop Management Guide

Desktop Management Guide

Remote System Installation

Remote System Installation allows you to start and set up the system using the software and configuration information located on a network server by initiating the Preboot Execution Environment

(PXE). The Remote System Installation feature is usually used as a system setup and configuration tool, and can be used for the following tasks:

■

■

■

Formatting a hard drive

Deploying a software image on one or more new PCs

Remotely updating the system BIOS in flash ROM ( “Remote

ROM Flash” on page 7 )

■ Configuring the system BIOS settings

To initiate Remote System Installation, press F12 when the

F12 = Network Service Boot message appears in the lower-right corner of the HP logo screen. Follow the instructions on the screen to continue the process. The default boot order is a BIOS configuration setting that can be changed to always attempt to PXE boot.

HP and Altiris, Inc. have partnered to provide tools designed to make the task of corporate PC deployment and management easier and less time-consuming, ultimately lowering the total cost of ownership and making HP PCs the most manageable client PCs in the enterprise environment.

Desktop Management Guide www.hp.com

3

4

Desktop Management Guide

Software Updating and Management

HP provides several tools for managing and updating software on desktops and workstations—Altiris; Altiris PC Transplant Pro; HP

Client Manager Software, an Altiris solution; System Software

Manager; Proactive Change Notification; and ActiveUpdate.

HP Client Manager Software

■

■

■

■

Intelligent HP Client Manager Software (HP CMS) tightly integrates

HP Intelligent Manageability technology within Altiris to provide superior hardware management capabilities for HP access devices that include:

Detailed views of hardware inventory for asset management

PC health check monitoring and diagnostics

Proactive notification of changes in the hardware environment

Web-accessible reporting of business critical details such as machines with thermal warnings, memory alerts, and more

■ Remote updating of system software such as device drivers and

ROM BIOS

■ Remote changing of boot order

For more information on the HP Client Manager, visit http://h18000.www1.hp.com/im/client_mgr.html

.

Altiris Solutions

HP Client Management Solutions provide centralized hardware management of HP client devices for all IT lifecycle areas.

■ Inventory and Asset Management

❏

❏

❏

SW license compliance

PC tracking and reporting

Lease contract, fixing asset tracking

■ Deployment and Migration

❏ Microsoft Windows 2000 or Windows XP Professional or

Home Edition migration www.hp.com

Desktop Management Guide

Desktop Management Guide

■

■

❏

❏

❏

❏

❏

❏

System deployment

Personality migrations

Help Desk and Problem Resolution

Managing help desk tickets

Remote troubleshooting

Remote problem resolution

Client disaster recovery

Software and Operations Management

❏

❏

❏

Ongoing desktop management

HP system SW deployment

Application self-healing

On selected desktop and notebook models, an Altiris management agent is included as part of the factory loaded image. This agent enables communication with the Altiris Development Solution which can be used to complete new hardware deployment or personality migration to a new OS using easy-to-follow wizards. Altiris solutions provide easy-to-use software distribution capabilities. When used in conjunction with System Software Manager, or the HP Client

Manager, administrators can also update ROM BIOS and device driver software from a central console.

For more information, visit http://www.hp.com/go/easydeploy .

Altiris PC Transplant Pro

Altiris PC Transplant Pro offers painless PC migration by preserving old settings, preferences, and data and migrating them to the new environment quickly and easily. Upgrades take minutes rather than hours or days, and the desktop looks and works just as the users expect.

For more information and details on how to download a fully-functional 30-day evaluation version, visit http://h18000.www1.hp.com/im/prodinfo.html#deploy .

Desktop Management Guide www.hp.com

5

Desktop Management Guide

System Software Manager

System Software Manager (SSM) is a utility that lets you update system-level software on multiple systems simultaneously. When executed on a PC client system, SSM detects both hardware and software versions, then updates the appropriate software from a central repository, also known as a file store. Driver versions that are supported by SSM are denoted with a special icon on the driver download Web site and on the Support Software CD. To download the utility or to obtain more information on SSM, visit http://h18000.www1.hp.com/im/ssmwp.html

.

Proactive Change Notification

The Proactive Change Notification program uses the Subscriber's

Choice Web site in order to proactively and automatically:

■ Send you Proactive Change Notification (PCN) e-mails informing you of hardware and software changes to most commercial computers and servers, up to 60 days in advance.

■ Send you e-mail containing Customer Bulletins, Customer

Advisories, Customer Notes, Security Bulletins, and Driver alerts for most commercial computers and servers.

You create your own profile to ensure that you only receive the information relevant to a specific IT environment. To learn more about the Proactive Change Notification program and create a custom profile, visit http://www.hp.com/go/pcn.

ActiveUpdate

ActiveUpdate is a client-based application from HP. The

ActiveUpdate client runs on the local system and uses the user-defined profile to proactively and automatically download software updates for most HP commercial computers and servers.

These downloaded software updates can be intelligently deployed to the machines for which they are intended by HP Client Manager

Software and System Software Manager.

To learn more about ActiveUpdate, download the application, and create a custom profile, visit http://h18000.www1.hp.com/products/servers/management/active update/index.html

.

6 www.hp.com

Desktop Management Guide

Desktop Management Guide

ROM Flash

■

■

The computer comes with a programmable flash ROM (read only memory). By establishing a setup password in the Computer Setup

(F10) Utility, you can protect the ROM from being unintentionally updated or overwritten. This is important to ensure the operating integrity of the computer. Should you need or want to upgrade the

ROM, you may:

Order an upgraded ROMPaq diskette from HP.

Download the latest ROMPaq images from http://h18000.www1.hp.com/im/ssmwp.html

.

Ä CAUTION: For maximum ROM protection, be sure to establish a setup password. The setup password prevents unauthorized ROM upgrades.

System Software Manager allows the system administrator to set the setup password on one or more PCs simultaneously. For more information, visit http://h18000.www1.hp.com/im/ssmwp.html

.

Remote ROM Flash

Remote ROM Flash allows the system administrator to safely upgrade the ROM on remote HP computers directly from the centralized network management console. Enabling the system administrator to perform this task remotely, on multiple computers and personal computers, results in a consistent deployment of and greater control over HP PC ROM images over the network. It also results in greater productivity and lower total cost of ownership.

✎

The computer must be powered on, or turned on through Remote

Wakeup, to take advantage of Remote ROM Flash.

For more information on Remote ROM Flash, refer to the HP Client

Manager Software or System Software Manager at http://h18000.www1.hp.com/im/prodinfo.html

.

Desktop Management Guide www.hp.com

7

Desktop Management Guide

HPQFlash

The HPQFlash utility is used to locally update or restore the System

ROM on individual PCs through a Windows operating system.

For more information on HPQFlash, visit http://h18000.www1.hp.com/support/files/hpcpqdt/us/download/

18607.html

.

FailSafe Boot Block ROM

■

■

The FailSafe Boot Block ROM allows for system recovery in the unlikely event of a ROM flash failure, for example, if a power failure were to occur during a ROM upgrade. The Boot Block is a flash-protected section of the ROM that checks for a valid system

ROM flash when power to the system is turned on.

If the system ROM is valid, the system starts normally.

If the system ROM fails the validation check, the FailSafe Boot

Block ROM provides enough support to start the system from a

ROMPaq diskette, which will program the system ROM with a valid image.

When the bootblock detects an invalid system ROM, the System

Power LED blinks RED 8 times, one every second, followed by a

2-second pause. Also 8 simultaneous beeps will be heard. A Boot

Block recovery mode message is displayed on the screen (some models).

To recover the system after it enters Boot Block recovery mode, complete the following steps:

1. If there is a diskette in the diskette drive, remove the diskette and turn off the power.

2. Insert a ROMPaq diskette into the diskette drive.

3. Turn on power to the system.

4. If no ROMPaq diskette is found, you will be prompted to insert one and restart the computer.

5. If a setup password has been established, the Caps Lock light will turn on and you will be prompted to enter the password.

6. Enter the setup password.

8 www.hp.com

Desktop Management Guide

Desktop Management Guide

7. If the system successfully starts from the diskette and successfully reprograms the ROM, then the three keyboard lights will turn on. A rising tone series of beeps also signals successful completion.

8. Remove the diskette and turn the power off.

9. Turn the power on again to restart the computer.

The following table lists the various keyboard light combinations used by the Boot Block ROM (when a PS/2 keyboard is attached to the computer), and explains the meaning and action associated with each combination.

Keyboard Light Combinations Used by Boot Block ROM

FailSafe Boot

Block Mode

Keyboard

LED Color

Keyboard

LED Activity State/Message

Num Lock Green On ROMPaq diskette not present, is bad, or drive not ready.

Enter password.

Keyboard locked in network mode.

Caps Lock

Num, Caps,

Scroll Lock

Green

Green

On

Blink On in sequence, one at a time—N, C, SL

Num, Caps,

Scroll Lock

Green On

✎

Diagnostic lights do not flash on USB keyboards.

Boot Block ROM Flash successful.

Turn power off, then on to reboot.

Desktop Management Guide www.hp.com

9

Desktop Management Guide

Replicating the Setup

The following procedures give an administrator the ability to easily copy one setup configuration to other computers of the same model.

This allows for faster, more consistent configuration of multiple computers.

✎

Both procedures require a diskette drive or a supported USB flash media device, such as an HP Drive Key.

Copying to Single Computer

Ä CAUTION: A setup configuration is model-specific. File system corruption may result if source and target computers are not the same model. For example, do not copy the setup configuration from a D510

Ultra-slim Desktop to a D510 e-pc.

1. Select a setup configuration to copy. Turn on or restart the computer. If you are in Windows, click Start > Shut Down >

Restart the Computer.

2. Press the F10 key as soon as the monitor light turns green. Press

Enter to bypass the title screen, if necessary.

✎

If you do not press the the computer off, then on again, and press the F10 key again to access the utility.

F10 key at the appropriate time, you must turn

3. Insert a diskette or USB flash media device.

4. Click File > Save to Diskette . Follow the instructions on the screen to create the configuration diskette or USB flash media device.

5. Turn off the computer to be configured and insert the configuration diskette or USB flash media device.

6. Turn on the computer to be configured. Press the F10 key as soon as the monitor light turns green. Press Enter to bypass the title screen, if necessary.

7. Click File > Restore from Diskette , and follow the instructions on the screen.

10 www.hp.com

Desktop Management Guide

Desktop Management Guide

8. Restart the computer when the configuration is complete.

Copying to Multiple Computers

Ä CAUTION: A setup configuration is model-specific. File system corruption may result if source and target computers are not the same model. For example, do not copy the setup configuration from a D510

Ultra-slim Desktop to a D510 e-pc.

This method takes a little longer to prepare the configuration diskette or USB flash media device, but copying the configuration to target computers is significantly faster.

✎

A bootable diskette cannot be created in Windows 2000. A bootable diskette is required for this procedure or to create a bootable USB flash media device. If Windows 9x or Windows XP is not available to use to create a bootable diskette, use the method for copying to a single computer instead (see “Copying to Single Computer” on page 10 ).

1. Create a bootable diskette or USB flash media device. See

“Bootable Diskette” on page 12 , “Supported USB Flash Media

Device” on page 13 on page 16.

, or “Unsupported USB Flash Media Device”

Ä CAUTION: Not all computers can be booted from a USB flash media device. If the default boot order in the Computer Setup (F10) Utility lists the USB device before the hard drive, the computer can be booted from a

USB flash media device. Otherwise, a bootable diskette must be used.

2. Select a setup configuration to copy. Turn on or restart the computer. If you are in Windows, click Start > Shut Down >

Restart the Computer.

3. Press the F10 key as soon as the monitor light turns green. Press

Enter to bypass the title screen, if necessary.

✎

If you do not press the F10 key at the appropriate time, you must turn the computer off, then on again, and press the F10 key again to access the utility.

Desktop Management Guide www.hp.com

11

Desktop Management Guide

4. Insert the bootable diskette or USB flash media device.

5. Click File > Save to Diskette.

Follow the instructions on the screen to create the configuration diskette or USB flash media device.

6. Download a BIOS utility for replicating setup (repset.exe) and copy it onto the configuration diskette or USB flash media device. This utility can be found at http://h18000.www1.hp.com/support/files/hpcpqdt/us/downlo ad/18040.html

.

7. On the configuration diskette or USB flash media device, create an autoexec.bat file containing the following command: repset.exe

8. Turn off the computer to be configured. Insert the configuration diskette or USB flash media device and turn the computer on.

The configuration utility will run automatically.

9. Restart the computer when the configuration is complete.

Creating a Bootable Device

Bootable Diskette

✎

These instructions are for Windows XP Professional and Home

Edition. Windows 2000 does not support the creation of bootable diskettes.

1. Insert a diskette into the diskette drive.

2. Click Start , then click My Computer .

3. Right-click the diskette drive, then click Format .

4. Select the Create an MS-DOS startup disk check box, then click Start .

Return to “Copying to Multiple Computers” on page 11.

12 www.hp.com

Desktop Management Guide

Desktop Management Guide

Supported USB Flash Media Device

Supported devices, such as an HP Drive Key or a DiskOnKey, have a preinstalled image to simplify the process of making them bootable.

If the Drive Key being used does not have this image, use the procedure later in this section (see “Unsupported USB Flash Media

Device” on page 16 ).

Ä CAUTION: Not all computers can be booted from a USB flash media device. If the default boot order in the Computer Setup (F10) Utility lists the USB device before the hard drive, the computer can be booted from a

USB flash media device. Otherwise, a bootable diskette must be used.

To create a bootable USB flash media device, you must have:

■ One of the following systems:

❏

❏

Compaq Evo D510 Ultra-slim Desktop

Compaq Evo D510 Convertible Minitower/Small Form

Factor

❏ HP Compaq Business Desktop d530 Series - Ultra-slim

Desktop, Small Form Factor, or Convertible Minitower

❏ Compaq Evo N400c, N410c, N600c, N610c, N620c, N800c, or N1000c Notebooks

❏ Compaq Presario 1500 or 2800 Notebooks

Depending on the individual BIOS, future systems may also support booting to the HP Drive Key.

Ä CAUTION: If you are using a computer other than one named above, make sure the default boot order in the Computer Setup (F10) Utility lists the USB device before the hard drive.

■ One of the following storage modules:

❏

❏

❏

❏

❏

16MB HP Drive Key

32MB HP Drive Key

32MB DiskOnKey

64MB HP Drive Key

64MB DiskOnKey

Desktop Management Guide www.hp.com

13

Desktop Management Guide

■

❏

❏

128MB HP Drive Key

128MB DiskOnKey

A bootable DOS diskette with the FDISK and SYS programs. If

SYS is not available, FORMAT may be used, but all existing files on the Drive Key will be lost.

1. Turn off the computer.

2. Insert the Drive Key into one of the computer's USB ports and remove all other USB storage devices except USB diskette drives.

3. Insert a bootable DOS diskette with FDISK.COM and either

SYS.COM or FORMAT.COM into a diskette drive and turn on the computer to boot to the DOS diskette.

4. Run FDISK from the A:\ prompt by typing FDISK and pressing

Enter. If prompted, click Yes ( Y ) to enable large disk support.

5. Enter Choice [ 5 ] to display the drives in the system. The Drive

Key will be the drive that closely matches the size of one of the drives listed. It will usually be the last drive in the list. Note the letter of the drive.

Drive Key drive: __________

Ä CAUTION: If a drive does not match the Drive Key, do not proceed.

Data loss can occur. Check all USB ports for additional storage devices.

If any are found, remove them, reboot the computer, and proceed from step 4. If none are found, either the system does not support the Drive

Key or the Drive Key is defective. DO NOT proceed in attempting to make the Drive Key bootable.

6. Exit FDISK by pressing the Esc key to return to the A:\ prompt.

7. If your bootable DOS diskette contains SYS.COM, go to step 8.

Otherwise, go to step 9.

8. At the A:\ prompt, enter SYS x: where x represents the drive letter noted above. Go to step 13.

Ä CAUTION: Be sure that you have entered the correct drive letter for the

Drive Key.

14 www.hp.com

Desktop Management Guide

Desktop Management Guide

After the system files have been transferred, SYS will return to the A:\ prompt.

9. Copy any files you want to keep from your Drive Key to a temporary directory on another drive (for example, the system's internal hard drive).

10. At the A:\ prompt, enter FORMAT /S X: where X represents the drive letter noted before.

Ä CAUTION: Be sure that you have entered the correct drive letter for the

Drive Key.

FORMAT will display one or more warnings and ask you each time whether you want to proceed. Enter y each time. FORMAT will format the Drive Key, add the system files, and ask for a

Volume Label.

11. Press Enter for no label or enter one if desired.

12. Copy any files you saved in step 9 back to your Drive Key.

13. Remove the diskette and reboot the computer. The computer will boot to the Drive Key as drive C.

✎

The default boot order varies from computer to computer, and it can be changed in the Computer Setup (F10) Utility.

If you have used a DOS version from Windows 9x, you may see a brief Windows logo screen. If you do not want this screen, add a zero-length file named LOGO.SYS to the root directory of the Drive

Key.

Return to “Copying to Multiple Computers” on page 11.

Desktop Management Guide www.hp.com

15

Desktop Management Guide

16

Unsupported USB Flash Media Device

Ä CAUTION: Not all computers can be booted from a USB flash media device. If the default boot order in the Computer Setup (F10) Utility lists the USB device before the hard drive, the computer can be booted from a

USB flash media device. Otherwise, a bootable diskette must be used.

To create a bootable USB flash media device, you must have:

■ One of the following systems:

❏

❏

Compaq Evo D510 Ultra-slim Desktop

Compaq Evo D510 Convertible Minitower/Small Form

Factor

❏ HP Compaq Business Desktop d530 Series - Ultra-slim

Desktop, Small Form Factor, or Convertible Minitower

❏ Compaq Evo N400c, N410c, N600c, N610c, N620c, N800c, or N1000c Notebooks

❏ Compaq Presario 1500 or 2800 Notebooks

Depending on the individual BIOS, future systems may also support booting to a USB flash media device.

Ä CAUTION: If you are using a computer other than one named above, make sure the default boot order in the Computer Setup (F10) Utility lists the USB device before the hard drive.

■ A bootable DOS diskette with the FDISK and SYS programs. If

SYS is not available, FORMAT may be used, but all existing files on the Drive Key will be lost.

1. If there are any PCI cards in the system that have SCSI, ATA

RAID or SATA drives attached, turn off the computer and unplug the power cord.

Ä CAUTION: The power cord MUST be unplugged.

2. Open the computer and remove the PCI cards.

3. Insert the USB flash media device into one of the computer's

USB ports and remove all other USB storage devices except USB diskette drives. Close the computer cover.

www.hp.com

Desktop Management Guide

Desktop Management Guide

4. Plug in the power cord and turn on the computer. As soon as the monitor light turns green, press the F10 key to go into the computer setup utility.

5. Go to Advanced/PCI devices to disable both the IDE and SATA controllers. When disabling the SATA controller, note the IRQ to which the controller is assigned. You will need to reassign the

IRQ later. Exit setup, confirming the changes.

SATA IRQ: __________

6. Insert a bootable DOS diskette with FDISK.COM and either

SYS.COM or FORMAT.COM into a diskette drive and turn on the computer to boot to the DOS diskette.

7. Run FDISK and delete any existing partitions on the USB flash media device. Create a new partition and mark it active. Exit

FDISK by pressing the Esc key.

8. If the system did not automatically restart when exiting FDISK, press Ctrl + Alt + Del to reboot to the DOS diskette.

9. At the A:\ prompt, type FORMAT C: /S and press Enter . Format will format the USB flash media device, add the system files, and ask for a Volume Label.

10. Press Enter for no label or enter one if desired.

11. Turn off the computer and unplug the power cord. Open the computer and re-install any PCI cards that were previously removed. Close the computer cover.

12. Plug in the power cord, remove the diskette, and turn on the computer.

13. As soon as the monitor light turns green, press the F10 key to go into the computer setup utility.

14. Go to Advanced/PCI Devices and re-enable the IDE and SATA controllers that were disabled in step 5. Put the SATA controller on its original IRQ.

15. Save the changes and exit. The computer will boot to the USB flash media device as drive C.

Desktop Management Guide www.hp.com

17

Desktop Management Guide

✎

The default boot order varies from computer to computer, and it can be changed in the Computer Setup (F10) Utility.

If you have used a DOS version from Windows 9x, you may see a brief Windows logo screen. If you do not want this screen, add a zero-length file named LOGO.SYS to the root directory of the Drive

Key.

Return to “Copying to Multiple Computers” on page 11.

18 www.hp.com

Desktop Management Guide

Desktop Management Guide

Dual-State Power Button

With Advanced Configuration and Power Interface (ACPI) enabled for Windows 2000 and Windows XP Professional and Home Edition, the power button can function either as an on/off switch or as a suspend button. The suspend feature does not completely turn off power, but instead causes the computer to enter a low-power standby.

This allows you to power down quickly without closing applications and to return quickly to the same operational state without any data loss.

To change the power button’s configuration, complete the following steps:

1. In Windows 2000, left click on the Start Button, then select

Settings > Control Panel > Power Options.

In Windows XP Professional and Home Edition, left click on the

Start Button, then select Control Panel > Performance and

Maintenance > Power Options.

2. In the Power Options Properties, select the Advanced tab.

3. In the Power Button section, select the desired power button setting.

After configuring the power button to function as a suspend button, press the power button to put the system in a very low power state

(suspend). Press the button again to quickly bring the system out of suspend to full power status. To completely turn off all power to the system, press and hold the power button for four seconds.

Ä CAUTION: Do not use the power button to turn off the computer unless the system is not responding; turning off the power without operating system interaction could cause damage to or loss of data on the hard drive.

Desktop Management Guide www.hp.com

19

Desktop Management Guide

World Wide Web Site

HP engineers rigorously test and debug software developed by HP and third-party suppliers, and develop operating system specific support software, to ensure performance, compatibility, and reliability for HP computers.

When making the transition to new or revised operating systems, it is important to implement the support software designed for that operating system. If you plan to run a version of Microsoft Windows that is different from the version included with the computer, you must install corresponding device drivers and utilities to ensure that all features are supported and functioning properly.

HP has made the task of locating, accessing, evaluating, and installing the latest support software easier. You can download the software from http://www.hp.com/support .

The Web site contains the latest device drivers, utilities, and flashable

ROM images needed to run the latest Microsoft Windows operating system on the HP computer.

Building Blocks and Partners

HP management solutions integrate with other systems management applications, and are based on industry standards, such as:

■

■

■

■

■

Desktop Management Interface (DMI) 2.0

Wake on LAN Technology

ACPI

SMBIOS

Pre-boot Execution (PXE) support

20 www.hp.com

Desktop Management Guide

Desktop Management Guide

Asset Tracking and Security

Asset tracking features incorporated into the computer provide key asset tracking data that can be managed using HP Insight Manager,

HP Client Manager or other system management applications.

Seamless, automatic integration between asset tracking features and these products enables you to choose the management tool that is best suited to the environment and to leverage the investment in existing tools.

HP also offers several solutions for controlling access to valuable components and information. ProtectTools Embedded Security, if installed, p revents unauthorized access to data and checks system integrity and authenticates third-party users attempting system access.

Security features such as ProtectTools, the Smart Cover Sensor and the Smart Cover Lock, available on select models, help to prevent unauthorized access to the internal components of the personal computer. By disabling parallel, serial, or USB ports, or by disabling removable media boot capability, you can protect valuable data assets. Memory Change and Smart Cover Sensor alerts can be automatically forwarded to system management applications to deliver proactive notification of tampering with a computer’s internal components.

✎

Protect Tools, the Smart Cover Sensor, and the Smart Cover Lock are available as options on select systems.

Use the following utilities to manage security settings on the HP computer:

■ Locally, using the Computer Setup Utilities. See the Computer

Setup (F10) Utility Guide included with the computer for additional information and instructions on using the Computer

Setup Utilities.

■ Remotely, using HP Client Manager or System Software

Manager. This software enables the secure, consistent deployment and control of security settings from a simple command-line utility.

Desktop Management Guide www.hp.com

21

Desktop Management Guide

The following table and sections refer to managing security features of the computer locally through the Computer Setup (F10) Utilities.

Security Features Overview

Feature

Removable Media Boot

Control

Serial, Parallel, USB, or

Infrared Interface Control

Power-On Password

Purpose

Prevents booting from the removable media drives.

(available on select drives)

Prevents transfer of data through the integrated serial, parallel, USB (universal serial bus), or infrared interface.

Prevents use of the computer until the password is entered.

This can apply to both initial system startup and restarts.

How It Is Established

From the Computer Setup

(F10) Utilities menu.

From the Computer Setup

(F10) Utilities menu.

From the Computer Setup

(F10) Utilities menu.

Setup Password

Embedded Security Device

Prevents reconfiguration of the computer (use of the

Computer Setup Utilities) until the password is entered.

Prevents unauthorized access to data using encryption and password protection. Checks system integrity and authenticates third-party users attempting system access.

From the Computer Setup

(F10) Utilities menu.

From the Computer Setup

(F10) Utilities menu.

DriveLock Prevents unauthorized access to the data on MultiBay hard drives. This feature is available on select models only.

From the Computer Setup

(F10) Utilities menu.

✎

For more information about Computer Setup, see the Computer Setup (F10) Utility Guide .

Support for security features may vary depending on the specific computer configuration.

22 www.hp.com

Desktop Management Guide

Desktop Management Guide

Security Features Overview (Continued)

Feature Purpose How It Is Established

Smart Cover Sensor Indicates that computer cover or side panel has been removed. Can be set to require the setup password to restart the computer, after the cover or side panel has been removed. Refer to the

Hardware Reference Guide on the Documentation Library

CD for more information about this feature. This feature is available on select models only.

Master Boot Record Security May prevent unintentional or malicious changes to the

Master Boot Record of the current bootable disk, and provides a means of recovering the “last known good” MBR.

From the Computer Setup

(F10) Utilities menu.

From the Computer Setup

(F10) Utilities menu.

Memory Change Alerts Detects when memory modules have been added, moved, or removed; notifies user and system administrator.

For information on enabling

Memory Change Alerts, refer to the online Intelligent

Manageability Guide .

✎

For more information about Computer Setup, see the Computer Setup (F10) Utility Guide .

Support for security features may vary depending on the specific computer configuration.

Desktop Management Guide www.hp.com

23

Desktop Management Guide

Security Features Overview (Continued)

Feature Purpose How It Is Established

Ownership Tag Displays ownership information, as defined by the system administrator, during system startup (protected by setup password).

From the Computer Setup

(F10) Utilities menu.

Cable Lock Provision Inhibits access to the interior of the computer to prevent unwanted configuration changes or component removal. Can also be used to secure the computer to a fixed object to prevent theft.

Install a cable lock to secure the computer to a fixed object.

Security Loop Provision Inhibits access to the interior of the computer to prevent unwanted configuration changes or component removal.

Install a lock in the security loop to prevent unwanted configuration changes or component removal.

✎

For more information about Computer Setup, see the Computer Setup (F10) Utility Guide

Support for security features may vary depending on the specific computer configuration.

.

24 www.hp.com

Desktop Management Guide

Desktop Management Guide

Password Security

The power-on password prevents unauthorized use of the computer by requiring entry of a password to access applications or data each time the computer is turned on or restarted. The setup password specifically prevents unauthorized access to Computer Setup, and can also be used as an override to the power-on password. That is, when prompted for the power-on password, entering the setup password instead will allow access to the computer.

A network-wide setup password can be established to enable the system administrator to log in to all network systems to perform maintenance without having to know the power-on password, even if one has been established.

Establishing a Setup Password Using Computer Setup

If the system is equipped with an embedded security device, refer to

“Embedded Security” on page 30.

Establishing a setup password through Computer Setup prevents reconfiguration of the computer (use of the Computer Setup (F10) utility) until the password is entered.

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

2. Press the F10 key as soon as the monitor light turns green. Press

Enter to bypass the title screen, if necessary.

✎

If you do not press the F10 key at the appropriate time, you must turn the computer off, then on again, and press the F10 key again to access the utility.

3. Select Security, then select Setup Password and follow the instructions on the screen.

4. Before exiting, click File > Save Changes and Exit.

Desktop Management Guide www.hp.com

25

Desktop Management Guide

Establishing a Power-On Password Using

Computer Setup

Establishing a power-on password through Computer Setup prevents access to the computer when power is turned on, unless the password is entered. When a power-on password is set, Computer Setup presents Password Options under the Security menu. Password options include Password Prompt on Warm Boot. When Password

Prompt on Warm Boot is enabled, the password must also be entered each time the computer is rebooted.

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

2. Press the F10 key as soon as the monitor light turns green. Press

Enter to bypass the title screen, if necessary.

✎

If you do not press the the computer off, then on again, and press the F10 key again to access the utility.

F10 key at the appropriate time, you must turn

3. Select Security, then Power-On Password and follow the instructions on the screen.

4. Before exiting, click File > Save Changes and Exit.

Entering a Power-On Password

To enter a power-on password, complete the following steps:

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

2. When the key icon appears on the monitor, type the current password, then press Enter.

✎

Type carefully; for security reasons, the characters you type do not appear on the screen.

If you enter the password incorrectly, a broken key icon appears. Try again. After three unsuccessful tries, you must turn off the computer, then turn it on again before you can continue.

26 www.hp.com

Desktop Management Guide

Desktop Management Guide

Entering a Setup Password

If the system is equipped with an embedded security device, refer to

“Embedded Security” on page 30.

If a setup password has been established on the computer, you will be prompted to enter it each time you run Computer Setup.

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

2. Press the F10 key as soon as the monitor light turns green.

✎

If you do not press the F10 key at the appropriate time, you must turn the computer off, then on again, and press the F10 key again to access the utility.

3. When the key icon appears on the monitor, type the setup password, then press the Enter key.

✎

Type carefully; for security reasons, the characters you type do not appear on the screen.

If you enter the password incorrectly, a broken key icon appears. Try again. After three unsuccessful tries, you must turn off the computer, then turn it on again before you can continue.

Desktop Management Guide www.hp.com

27

Desktop Management Guide

Changing a Power-On or Setup Password

If the system is equipped with an embedded security device, refer to

“Embedded Security” on page 30.

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

To change the setup password, run Computer Setup.

2. When the key icon appears, type the current password, a slash (/) or alternate delimiter character, the new password, another slash

(/) or alternate delimiter character, and the new password again as shown: current password/new password/new password

✎

Type carefully; for security reasons, the characters you type do not appear on the screen.

3. Press the Enter key.

The new password takes effect the next time you turn on the computer.

✎

Refer to the “National Keyboard Delimiter Characters” on page 29 for information about the alternate delimiter characters. The power-on password and setup password may also be changed using the Security options in Computer Setup.

28 www.hp.com

Desktop Management Guide

Desktop Management Guide

Deleting a Power-On or Setup Password

If the system is equipped with an embedded security device, refer to

“Embedded Security” on page 30.

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

To delete the setup password, run Computer Setup.

2. When the key icon appears, type the current password followed by a slash (/) or alternate delimiter character as shown: current password/

3. Press the Enter key.

✎

Refer to “National Keyboard Delimiter Characters” for information about the alternate delimiter characters. The power-on password and setup password may also be changed using the Security options in

Computer Setup.

National Keyboard Delimiter Characters

Each keyboard is designed to meet country-specific requirements.

The syntax and keys that you use to change or delete the password depend on the keyboard that came with the computer.

National Keyboard Delimiter Characters

Arabic

Belgian

BHCSY*

Brazilian

Chinese

Czech

Danish

French

French

Canadian

-

/

=

!

é

Greek

Hebrew

Hungarian

/ Italian

/ Japanese

Korean

Norwegian

Polish

-

.

-

-

-

Russian

Slovakian

Spanish

Swedish/Finnish /

/ Swiss

/ Taiwanese

Latin American Thai

Turkish

U.K. English

German Portuguese U.S. English

* For Bosnia-Herzegovina, Croatia, Slovenia, and

Yugoslavia

-

.

/

/

/

/

-

-

/

Desktop Management Guide www.hp.com

29

Desktop Management Guide

Clearing Passwords

If you forget the password, you cannot access the computer. Refer to the Troubleshooting Guide for instructions on clearing passwords.

If the system is equiped with an embedded security device, refer to

“Embedded Security.”

Embedded Security

ProtectTools Embedded Security combines encryption and password protection to provide enhanced security for Embedded File System

(EFS) file/folder encryption and secure e-mail with Microsoft

Outlook and Outlook Express. ProtectTools is available for selected business desktops as Configured-To-Order (CTO) options. It is intended for HP customers for whom compromised data is the paramount concern: unauthorized access to data presents a far greater danger than the loss of the data. ProtectTools uses four passwords:

■ (F10) Setup—to enter Computer Setup (F10) Utility and enable/disable ProtectTools

■ Take Ownership—to be set and used by a system administrator, who will authorize users and set security parameters

■ Emergency Recovery Token—to be set by the system administrator, will permit recovery in the event of computer or

ProtectTools chip failure

■ Basic User—to be set and used by the end user.

✎

If the end user's password is lost, the encrypted data cannot be recovered. Therefore, ProtectTools is most safely used when the data contained on the user's drive is replicated on a system information system or is regularly backed up.

ProtectTools Embedded Security is a TCPA 1.1-compliant security chip optionally installed on the system board of selected business desktops. Each ProtectTools Embedded Security chip is unique and is bound to a specific computer. Each chip performs key security processes independent of other computer components (such as processor, memory or operating system).

30 www.hp.com

Desktop Management Guide

Desktop Management Guide

A ProtectTools Embedded Security-enabled computer complements and enhances the security capabilities inherent in Microsoft Windows

2000 or Windows XP Professional or Home Edition. For example, while the operating system can encrypt local files and folders based on an EFS, ProtectTools Embedded Security offers an additional layer of security by creating encryption keys from the platform's root key (which is stored in silicon). This process is known as "wrapping" the encryption keys. ProtectTools does not prevent network access to a computer without ProtectTools.

Key capabilities of ProtectTools Embedded Security include:

■

■

■

Platform authentication

Protected storage

Data integrity

CAUTION: Safeguard the passwords. Encrypted data cannot be accessed or recovered without the passwords .

Setting up Passwords

Setup

A Setup password can be created and the embedded security device can be enabled with the F10 setup utility.

1. Press the F10 key as soon as the monitor light turns green.

✎

If you do not press the F10 key at the appropriate time, you must turn the computer off, then on again, and press the F10 key again to access the utility.

2. Use the up or down arrow key to select a language, then press

Enter .

3. Use the left or right arrow key to move to the Security tab, then use the up or down arrow key to move to Setup Password .

Press

Enter .

Desktop Management Guide www.hp.com

31

Desktop Management Guide

4. Type and confirm a password. Press F10 to accept the password.

✎

Type carefully; for security reasons, the characters typed do not appear on the screen.

5. Use the up or down arrow key to move to Embedded Security

Device . Press Enter .

6. If the selection in the dialog box is Embedded Security

Device—Disable , use the left or right arrow key to change it to

Embedded Security Device—Enable . Press F10 to accept the change.

Ä CAUTION: If you select Reset to Factory Settings—Reset , all keys will be cleared and encrypted data will not be recoverable unless the keys have been backed up (see “Take Ownership and Emergency Recovery Token” ).

Only select Reset when instructed to do so in the procedure to recover encrypted data (see “Recovering Encrypted Data” on page 35 ).

7. Use the left or right arrow key to move to File . Use the up or down arrow key to move to Save Changes and Exit . Press

Enter , then press F10 to confirm.

Take Ownership and Emergency Recovery Token

The Take Ownership Password is required to enable or disable the security platform and to authorize users. If the embedded security device fails, the Emergency Recovery mechanism allows users to be authorized and data to be accessed.

1. If you are using Windows XP Professional or Home Edition, click Start > All Programs > HP ProtectTools Embedded

Security Tools > Embedded Security Initialization Wizard .

If you are using Windows 2000, click Start > Programs > HP

ProtectTools Embedded Security Tools > Embedded Security

Initialization Wizard .

2. Click Next .

3. Type and confirm a Take Ownership password, then click Next .

32 www.hp.com

Desktop Management Guide

Desktop Management Guide

✎

Type carefully; for security reasons, the characters typed do not appear on the screen.

4. Click Next to accept the default Recovery archive location.

5. Type and confirm an Emergency Recovery Token password, then click Next .

6. Insert a diskette on which to store the Emergency Recovery

Token Key. Click Browse and select the diskette.

Ä CAUTION: The Emergency Recovery Token Key is used to recover encrypted data in the event of a computer or embedded security chip failure. The data cannot be recovered without the key . (The data still cannot be accessed without the Basic User password.) Store this diskette in a safe place.

7. Click Save to accept the location and the default file name, then click Next .

8. Click Next to confirm settings before the Security Platform is initialized.

✎

A message may be displayed to say that the Embedded Security features are not initialized. Do not click in the message; this is addressed later in the procedure and the message will close after a few seconds.

9. Click Next to bypass configuring local policies.

10. Make sure the Start Embedded Security User Initialization

Wizard check box is selected, then click Finish .

The User Initialization Wizard starts now automatically.

Desktop Management Guide www.hp.com

33

Desktop Management Guide

Basic User

During user initialization, the Basic User Password is created. This password is required to enter and access encrypted data.

Ä CAUTION: Safeguard the Basic User password. Encrypted data cannot be accessed or recovered without this password .

1. If the User Initialization Wizard is not open:

If you are using Windows XP Professional or Home Edition, click Start > All Programs > HP ProtectTools Embedded

Security Tools > User Initialization Wizard .

If you are using Windows 2000, click Start > Programs > HP

ProtectTools Embedded Security Tools > User Initialization

Wizard .

2. Click Next .

3. Type and confirm a Basic User Key password, then click Next .

✎

Type carefully; for security reasons, the characters typed do not appear on the screen.

4. Click Next to confirm settings.

5. Select the appropriate Security Features and click Next .

6. Click the appropriate e-mail client to select it, then click Next .

7. Click Next to apply the Encryption Certificate.

8. Click Next to confirm settings.

9. Click Finish .

10. Restart the computer.

34 www.hp.com

Desktop Management Guide

Desktop Management Guide

Recovering Encrypted Data

To recover data after replacement of the ProtectTools chip, you must have the following:

■

■

SPEmRecToken.xml—the Emergency Recovery Token Key

SPEmRecArchive.xml—hidden folder, default location:

C:\Documents and Settings\All Users\Application

Data\Infineon\TPM Software\Recovery Archive

■ ProtectTools passwords

❏

❏

❏

❏

Setup

Take Ownership

Emergency Recovery Token

Basic User

1. Restart the computer.

2. Press the F10 key as soon as the monitor light turns green.

✎

If you do not press the the computer off, then on again, and press the F10 key again to access the utility.

F10 key at the appropriate time, you must turn

3. Type the Setup password, then press Enter .

4. Use the up or down arrow key to select a language, then press

Enter .

5. Use the left or right arrow key to move to the Security tab, then use the up or down arrow key to move to Embedded Security

Device . Press Enter .

6. If only one selection, Embedded Security Device—Disable , is available: a.

Use the left or right arrow key to change it to Embedded

Security Device—Enable . Press F10 to accept the change.

b.

Use the left or right arrow key to move to File . Use the up or down arrow key to move to Save Changes and Exit . Press

Enter , then press F10 to confirm.

c.

Go to step 1.

Desktop Management Guide www.hp.com

35

Desktop Management Guide

If two selections are available, go to step 7.

7. Use the up or down arrow key to move to Reset to Factory

Settings—Do Not Reset . Press the left or right arrow key once.

A message is displayed stating: Performing this action will reset the embedded security device to factory settings if settings are saved on exit. Press any key to continue.

Press Enter .

8. The selection will now read Reset to Factory Settings—Reset .

Press F10 to accept the change.

9. Use the left or right arrow key to move to File . Use the up or down arrow key to move to Save Changes and Exit . Press

Enter , then press F10 to confirm.

10. Restart the computer.

11. Press the F10 key as soon as the monitor light turns green.

✎

If you do not press the the computer off, then on again, and press the F10 key again to access the utility.

F10 key at the appropriate time, you must turn

12. Type the Setup password, then press Enter .

13. Use the up or down arrow key to select a language, then press

Enter .

14. Use the left or right arrow key to move to the Security tab, then use the up or down arrow key to move to Embedded Security

Device . Press Enter .

15. If the selection in the dialog box is Embedded Security

Device—Disable , use the left or right arrow key to change it to

Embedded Security Device—Enable . Press F10 .

16. Use the left or right arrow key to move to File . Use the up or down arrow key to move to Save Changes and Exit . Press

Enter , then press F10 to confirm.

36 www.hp.com

Desktop Management Guide

Desktop Management Guide

17. After Windows opens:

If you are using Windows XP Professional or Home Edition, click Start > All Programs > HP ProtectTools Embedded

Security Tools > Embedded Security Initialization Wizard .

If you are using Windows 2000, click Start > Programs > HP

ProtectTools Embedded Security Tools > Embedded Security

Initialization Wizard .

18. Click Next .

19. Type and confirm a Take Ownership password. Click Next .

✎

Type carefully; for security reasons, the characters typed do not appear on the screen.

20. Make sure that Create a new recovery archive is selected. Under

Recovery archive location , click Browse .

21. Do not accept the default file name. Type a new file name to avoid replacing the original file.

22. Click Save , then click Next .

23. Type and confirm an Emergency Recovery Token password, then click Next .

24. Insert a diskette on which to store the Emergency Recovery

Token Key. Click Browse and select the diskette.

25. Do not accept the default key name. Type a new key name to avoid replacing the original key.

26. Click Save , then click Next .

27. Click Next to confirm settings before the Security Platform is initialized.

✎

A message may be displayed to say that the Basic User Key cannot be loaded. Do not click in the message; this is addressed later in the procedure and the message will close after a few seconds.

28. Click Next to bypass configuring local policies.

29. Click to clear the Start Embedded Security User Initialization

Wizard check box. Click Finish .

Desktop Management Guide www.hp.com

37

Desktop Management Guide

38

30. Right-click the ProtectTools icon in the Tool bar and click

Initialize Embedded Security restoration .

This will start the HP ProtectTools Embedded Security

Initialization Wizard.

31. Click Next .

32. Insert the diskette on which the original Emergency Recovery

Token Key is stored. Click Browse , then locate and double-click the token to enter the name in the field. The default is

A:\SPEmRecToken.xml.

33. Type the original Token password and click Next .

34. Click Browse , then locate and double-click the original recovery archive to enter the name in the field. The default is

C:\Documents and Settings\All Users\Application

Data\Infineon\TPM

Software\RecoveryArchive\SPEmRecArchive.xml.

35. Click Next .

36. Click the machine to be restored and click Next .

37. Click Next to confirm the settings.

38. If the wizard announces that the security platform has been restored, go to step 39.

If the wizard announces that the restore failed, return to step 10.

Carefully check passwords, token location and name, and archive location and name.

39. Click Finish.

40. If you are using Windows XP Professional or Home Edition, click Start > All Programs > HP ProtectTools Embedded

Security Tools > User Initialization Wizard .

If you are using Windows 2000, click Start > Programs > HP

ProtectTools Embedded Security Tools > User Initialization

Wizard .

41. Click Next .

42. Click Recover your basic user key and click Next .

43. Select a user, type the original Basic User Key password for that user, then click Next .

www.hp.com

Desktop Management Guide

DriveLock

Desktop Management Guide

44. Click Next to confirm settings and accept the default recovery data location.

✎

Steps 45 through 49 reinstall the original Basic User configuration.

45. Select the appropriate Security Features and click Next .

46. Click the appropriate e-mail client to select it, then click Next .

47. Click the the Encryption Certificate and click Next to apply it.

48. Click Next to confirm settings.

49. Click Finish .

50. Restart the computer.

Ä CAUTION: Safeguard the Basic User password. Encrypted data cannot be accessed or recovered without this password .

DriveLock is an industry-standard security feature that prevents unauthorized access to the data on MultiBay hard drives. DriveLock has been implemented as an extension to Computer Setup. It is only available when DriveLock-capable hard drives are detected.

DriveLock is intended for HP customers for whom data security is the paramount concern. For such customers, the cost of the hard drive and the loss of the data stored on it is inconsequential when compared with the damage that could result from unauthorized access to its contents. In order to balance this level of security with the practical need to accomodate a forgotten password, the HP implementation of

DriveLock employs a two-password security scheme. One password is intended to be set and used by a system administrator while the other is typically set and used by the end-user. There is no

“back-door” that can be used to unlock the drive if both passwords are lost. Therefore, DriveLock is most safely used when the data contained on the hard drive is replicated on a corporate information system or is regularly backed up.

Desktop Management Guide www.hp.com

39

Desktop Management Guide

In the event that both DriveLock passwords are lost, the hard drive is rendered unusable. For users who do not fit the previously defined customer profile, this may be an unacceptable risk. For users who do fit the customer profile, it may be a tolerable risk given the nature of the data stored on the hard drive.

Using DriveLock

The DriveLock option appears under the Security menu in Computer

Setup. The user is presented with options to set the master password or to enable DriveLock. A user password must be provided in order to enable DriveLock. Since the initial configuration of DriveLock is typically performed by a system administrator, a master password should be set first. HP encourages system administrators to set a master password whether they plan to enable DriveLock or keep it disabled. This will give the administrator the ability to modify

DriveLock settings if the drive is locked in the future. Once the master password is set, the system administrator may enable

DriveLock or choose to keep it disabled.

If a locked hard drive is present, POST will require a password to unlock the device. If a power-on password is set and it matches the device’s user password, POST will not prompt the user to re-enter the password. Otherwise, the user will be prompted to enter a DriveLock password. Either the master or the user password may be used. Users will have two attempts to enter a correct password. If neither attempt succeeds, POST will continue but the drive will remain inaccessible.

DriveLock Applications

The most practical use of the DriveLock security feature is in a corporate environment where a system administrator provides users with MultiBay hard drives for use in some computers. The system administrator would be responsible for configuring the MultiBay hard drive which would involve, among other things, setting the

DriveLock master password. In the event that the user forgets the user password or the equipment is passed on to another employee, the master password can always be used to reset the user password and regain access to the hard drive.

HP recommends that corporate system administrators who choose to enable DriveLock also establish a corporate policy for setting and maintaing master passwords. This should be done to prevent a

40 www.hp.com

Desktop Management Guide

Desktop Management Guide situation where an employee intentionally or unintentionally sets both

DriveLock passwords before leaving the company. In such a scenario, the hard drive would be rendered unusable and require replacement.

Likewise, by not setting a master password, system administrators may find themselves locked out of a hard drive and unable to perform routine checks for unauthorized software, other asset control functions, and support.

For users with less stringent security requirements, HP does not recommend enabling DriveLock. Users in this category include personal users or users who do not maintain sensitive data on their hard drives as a common practice. For these users, the potential loss of a hard drive resulting from forgetting both passwords is much greater than the value of the data DriveLock has been designed to protect. Access to Computer Setup and DriveLock can be restricted through the Setup password. By specifying a Setup password and not giving it to end users, system administrators are able to restrict users from enabling DriveLock.

Smart Cover Sensor

Smart Cover Sensor, available on select models, is a combination of hardware and software technology that can alert you when the computer cover or side panel has been removed. There are three levels of protection, as described in the following table.

Smart Cover Sensor Protection Levels

Level Setting Description

Level 0

Level 1

Disabled

Notify User

Smart Cover Sensor is disabled (default).

When the computer is restarted, the screen displays a message indicating that the computer cover or side panel has been removed.

Level 2 Setup Password When the computer is restarted, the screen displays a message indicating that the computer cover or side panel has been removed. You must enter the setup password to continue.

✎

These settings can be changed using Computer Setup. For more information about Computer

Setup, see the Computer Setup (F10) Utility Guide.

Desktop Management Guide www.hp.com

41

Desktop Management Guide

Setting the Smart Cover Sensor Protection Level

To set the Smart Cover Sensor protection level, complete the following steps:

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

2. Press the F10 key as soon as the monitor light turns green. Press

Enter to bypass the title screen, if necessary.

✎

If you do not press the F10 key at the appropriate time, you must turn the computer off, then on again, and press the F10 key again to access the utility.

3. Select Security, then Smart Cover, and follow the instructions on the screen.

4. Before exiting, click File > Save Changes and Exit.

Smart Cover Lock

The Smart Cover Lock is a software-controllable cover lock featured on select HP computers. This lock prevents unauthorized access to the internal components. Computers ship with the Smart Cover Lock in the unlocked position.

Ä CAUTION: For maximum cover lock security, be sure to establish a setup password. The setup password prevents unauthorized access to the

Computer Setup utility.

✎

The Smart Cover Lock is available as an option on select systems.

42 www.hp.com

Desktop Management Guide

Desktop Management Guide

Locking the Smart Cover Lock

To activate and lock the Smart Cover Lock, complete the following steps:

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

2. Press the F10 key as soon as the monitor light turns green. Press

Enter to bypass the title screen, if necessary.

✎

If you do not press the F10 key at the appropriate time, you must turn the computer off, then on again, and press the F10 key again to access the utility.

3. Select Security, then select Smart Cover and the Locked option.

4. Before exiting, click File > Save Changes and Exit.

Unlocking the Smart Cover Lock

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

2. Press the F10 key as soon as the monitor light turns green. Press

Enter to bypass the title screen, if necessary.

✎

If you do not press the F10 key at the appropriate time, you must turn the computer off, then on again, and press the F10 key again to access the utility.

3. Select Security > Smart Cover > Unlocked.

4. Before exiting, click File > Save Changes and Exit.

Desktop Management Guide www.hp.com

43

Using the Smart Cover FailSafe Key

■

■

■

■

If you enable the Smart Cover Lock and cannot enter the password to disable the lock, you will need a Smart Cover FailSafe Key to open the computer cover. You will need the key in any of the following circumstances:

Power outage

Startup failure

PC component failure (such as processor or power supply)

Forgotten password

Ä CAUTION: The Smart Cover FailSafe Key is a specialized tool available from HP. Be prepared; order this key before you need one at an authorized reseller or service provider.

To obtain the FailSafe Key, do any one of the following:

■

■

Contact an authorized HP reseller or service provider.

Call the appropriate number listed in the warranty.

For more information about using the Smart Cover FailSafe Key, consult the Hardware Reference Guide.

Desktop Management Guide

Master Boot Record Security

The Master Boot Record (MBR) contains information needed to successfully boot from a disk and to access the data stored on the disk. Master Boot Record Security may prevent unintentional or malicious changes to the MBR, such as those caused by some computer viruses or by the incorrect use of certain disk utilities.

It also allows you to recover the “last known good” MBR, should changes to the MBR be detected when the system is restarted.

To enable MBR Security, complete the following steps:

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

2. Press the F10 key as soon as the monitor light turns green. Press

Enter to bypass the title screen, if necessary.

✎

If you do not press the the computer off, then on again, and press the F10 key again to access the utility.

F10 key at the appropriate time, you must turn

3. Select Security > Master Boot Record Security > Enabled.

4. Select Security > Save Master Boot Record.

5. Before exiting, click File > Save Changes and Exit.

When MBR Security is enabled, the BIOS prevents any changes being made to the MBR of the current bootable disk while in

MS-DOS or Windows Safe Mode.

✎

Most operating systems control access to the MBR of the current bootable disk; the BIOS cannot prevent changes that may occur while the operating system is running.

Each time the computer is turned on or restarted, the BIOS compares the MBR of the current bootable disk to the previously saved MBR. If changes are detected and if the current bootable disk is the same disk from which the MBR was previously saved, the following message is displayed:

1999—Master Boot Record has changed.

Press any key to enter Setup to configure MBR Security.

Desktop Management Guide www.hp.com

45

Desktop Management Guide

Upon entering Computer Setup, you must

■

■

■

Save the MBR of the current bootable disk;

Restore the previously saved MBR; or

Disable the MBR Security feature.

You must know the setup password, if one exists.

If changes are detected and if the current bootable disk is not the same disk from which the MBR was previously saved, the following message is displayed:

2000—Master Boot Record Hard Drive has changed.

Press any key to enter Setup to configure MBR Security.

Upon entering Computer Setup, you must

■

■

Save the MBR of the current bootable disk; or

Disable the MBR Security feature.

You must know the setup password, if one exists.

In the unlikely event that the previously saved MBR has been corrupted, the following message is displayed:

1998—Master Boot Record has been lost.

Press any key to enter Setup to configure MBR Security.

Upon entering Computer Setup, you must

■

■

Save the MBR of the current bootable disk; or

Disable the MBR Security feature.

You must know the setup password, if one exists.

46 www.hp.com

Desktop Management Guide

Desktop Management Guide

Before You Partition or Format the Current Bootable Disk

Ensure that MBR Security is disabled before you change partitioning or formatting of the current bootable disk. Some disk utilities, such as

FDISK and FORMAT, attempt to update the MBR. If MBR Security is enabled when you change partitioning or formatting of the disk, you may receive error messages from the disk utility or a warning from MBR Security the next time the computer is turned on or restarted. To disable MBR Security, complete the following steps:

1. Turn on or restart the computer. If you are in Windows, click

Start > Shut Down > Restart the Computer.

2. Press the F10 key as soon as the monitor light turns green. Press

Enter to bypass the title screen, if necessary.

✎

If you do not press the F10 key at the appropriate time, you must turn the computer off, then on again, and press the F10 key again to access the utility.

3. Select Security > Master Boot Record Security > Disabled.

4. Before exiting, click File > Save Changes and Exit.

Cable Lock Provision

The rear panel of the computer accommodates a cable lock so that the computer can be physically secured to a work area.

For illustrated instructions, please see the Hardware Reference Guide on the Documentation Library CD.

Desktop Management Guide www.hp.com

47

Desktop Management Guide

Fingerprint Identification Technology

Eliminating the need to enter user passwords, HP Fingerprint

Identification Technology tightens network security, simplifies the login process, and reduces the costs associated with managing corporate networks. Affordably priced, it is not just for high-tech, high-security organizations anymore.

✎

Support for Fingerprint Identification Technology varies by model.

For more information, visit: http://h18000.www1.hp.com/solutions/security .

Fault Notification and Recovery

Fault Notification and Recovery features combine innovative hardware and software technology to prevent the loss of critical data and minimize unplanned downtime.

When a fault occurs, the computer displays a Local Alert message containing a description of the fault and any recommended actions.

You can then view current system health by using the HP Client

Manager. If the computer is connected to a network managed by HP

Insight Manager, HP Client Manager, or other sytem management applications, the computer also sends a fault notice to the network management application.

Drive Protection System

The Drive Protection System (DPS) is a diagnostic tool built into the hard drives installed in select HP computers. DPS is designed to help diagnose problems that might result in unwarranted hard drive replacement.

When HP computers are built, each installed hard drive is tested using

DPS, and a permanent record of key information is written onto the drive. Each time DPS is run, test results are written to the hard drive.

The service provider can use this information to help diagnose conditions that caused you to run the DPS software. Refer to the

Troubleshooting Guide for instructions on using DPS.

48 www.hp.com

Desktop Management Guide

Desktop Management Guide

Surge-Tolerant Power Supply

An integrated surge-tolerant power supply provides greater reliability when the computer is hit with an unpredictable power surge. This power supply is rated to withstand a power surge of up to 2000 volts without incurring any system downtime or data loss.

Thermal Sensor

The thermal sensor is a hardware and software feature that tracks the internal temperature of the computer. This feature displays a warning message when the normal range is exceeded, which gives you time to take action before internal components are damaged or data is lost.

Desktop Management Guide www.hp.com

49

Desktop Management Guide

50 www.hp.com

Desktop Management Guide

Index

A

access to computer, controlling 21

ActiveUpdate 6

Altiris 4

Altiris PC Transplant Pro 5 asset tracking 21

B

bootable device creating 12 to 17 diskette 12

DiskOnKey 13 to 18

HP Drive Key 13 to 18

USB flash media device 13 to 18 bootable disk, important information 47

C

cable lock provision 47 cautions cover lock security 42

FailSafe Key 44 protecting ROM 7 change notification 6 changing operating systems, important information 20 changing password 28 clearing password 30 cloning tools, software 2

Computer Setup Utilities 10 configuring power button 19 controlling access to computer 21 cover lock security, caution 42

Desktop Management Guide www.hp.com

cover lock, smart 42 customizing software 2

D

deleting password 29 delimiter characters, table 29 deployment tools, software 2 diagnostic tool for hard drives 48 disk, cloning 2

DiskOnKey see also HP Drive Key bootable 13 to 18 drive, protecting 48

Drivelock 39 to 41 dual-state power button 19

E

embedded security, ProtectTools 30 to 39 emergency recovery, ProtectTools 35 to 39 entering power-on password 26 setup password 27

F

FailSafe Boot Block ROM 8

FailSafe Key caution 44 ordering 44 fault notification 48 fingerprint identification technology 48 formatting disk, important information 47

Index–1

Index

H

hard drives, diagnostic tool 48

HP Client Manager 4

HP Drive Key see also DiskOnKey bootable 13 to 18

I

initial configuration 2 internal temperature of computer 49

Internet addresses, See Web sites invalid system ROM 8

K

keyboard delimiter characters, national 29 keyboard lights, ROM, table 9

L

locking Smart Cover Lock 43

M

Master Boot Record Security 45 to 46

Multibay security 39 to 41

N

national keyboard delimiter characters 29 notification of changes 6

O

operating systems, important information about 20 ordering FailSafe Key 44

P

partitioning disk, important information 47 password changing 28 clearing 30 deleting 29 power-on 26

ProtectTools 31 to 34 security 25

Index–2 setup 25 , 27

PCN (Proactive Change Notification) 6 power button configuring 19 dual-state 19 power supply, surge-tolerant 49 power-on password changing 28 deleting 29 entering 26

Preboot Execution Environment (PXE) 3 preinstalled software image 2

Proactive Change Notification (PCN) 6 protecting hard drive 48 protecting ROM, caution 7

ProtectTools Embedded Security 30 to 39 emergency recovery 35 to 39

Emergency Recovery Key 32 passwords

Basic User 34

Emergency Recovery Token 32

Setup 31

Take Ownership 32

PXE (Preboot Execution Environment) 3

R

recovering encrypted data 35 to 39 recovering system 8 recovery, software 2

Remote ROM Flash 7 remote setup 3

Remote System Installation, accessing 3

ROM invalid 8 keyboard lights, table 9

Remote Flash 7 upgrading 7

S

security www.hp.com

Desktop Management Guide

DriveLock 39 to 41 features, table 22

Master Boot Record 45 to 46

MultiBay 39 to 41 password 25

ProtectTools 30 to 39 settings, setup of 21

Smart Cover Lock 42 to 44

Smart Cover Sensor 41 setup initial 2 replicating 10 setup password changing 28 deleting 29 entering 27

ProtectTools 31 setting 25

Smart Cover FailSafe Key, ordering 44

Smart Cover Lock 42 to 44 locking 43 unlocking 43

Smart Cover Sensor 41 protection levels 41 setting 42 software asset tracking 21

Computer Setup Utilities 10

Drive Protection System 48

FailSafe Boot Block ROM 8

Fault Notification and Recovery 48 integration 2

Master Boot Record Security 45 to 46 recovery 2

Remote ROM Flash 7

Index

Remote System Installation 3

System Software Manager 6 updating multiple machines 6

SSM (System Software Manager) 6 surge-tolerant power supply 49 system recovery 8

System Software Manager (SSM) 6

T

temperature, internal computer 49 thermal sensor 49

U

unlocking Smart Cover Lock 43 upgrading ROM 7

URLs (Web sites). See Web sites

USB flash media device, bootable 13 to 18

W

Web sites

ActiveUpdate 6

Altiris 5

Altiris PC Transplant Pro 5

Fingerprint Identification Technology 48

Finterprint Identification Technology 48

HP Client Manager 4

HPQFlash 8

PC deployment 2

Proactive Change Notification 6

Remote ROM Flash 7 replicating setup 12

ROM Flash 7

ROMPaq images 7 software support 20

System Software Manager (SSM) 6

Desktop Management Guide www.hp.com

Index–3

Index

Index–4 www.hp.com

Desktop Management Guide