SMS、OSD和Bitlocker（2）

Moving the Boot Files

This is not so hard as it might seem. We use a slightly modified version of the normal BDEHDCfg.vbs script to do this. Although when it runs you see an error in the BDD.log file saying it wanted to reboot but OSD blocked it. That is fine. The boot files have been moved to the system partition and the partition marked as active.

这个步骤远不如看上去那么难，我们使用一个修改过的BDEHDCfg.vbs来完成这个任务。尽管你会在BDD.log中看到一个错误，说想要重新启动但是被OSD组织了，但不用担心，引导文件已经被移动到系统分区里并被标识为活动的。

Re-Boot and start BitLocker

So this gets pretty complex and even, may I say, a little messy. I have already covered off forcing OSD to reboot in a previous blog. We are now going to build on that process. In the previous post I described how we setup the system to autologon and run a job to reboot the system. Now we need to go one step further and have it run a script once it has rebooted. We have to copy the script down from the framework location (on the SMS Deployment Point Server) to a location on the hard disk that will not get deleted when OSD completes. In fact we need everything that will be required post reboot to be on the local hard disk. Remember OSD has completed so there is no BDD/MDT framework to use any more. In the previous blog post the second script that ran cleaned out the auto-logon entries before forcing the reboot - we need to do other things. So in the second script configure the system to run the third script once the machine has logged back on. This carries out all the tasks we need to initialise BitLocker running. Once BitLocker has started running we reboot the system again.

这个步骤十分复杂，甚至于让人厌倦。我在之前的blog里谈到过强行让OSD重新启动，现在我们在那篇blog的基础上继续前进。在之前的帖子中，我描述了我们如何让系统自动登录并重新启动。现在我们要更进一步，当他重新启动后我们需要运行一个脚本。我们把脚本从DP上下载到本地硬盘上。事实上，我们在重启之前要把所有需要的文件都放在硬盘上。记住当OSD结束的时候，你将没有任何BDD/MDT的构架来继续使用。在之前的帖子中，第二个脚本在重新启动之前把自动登录脚本删除了――而我们需要做些其他事情。所以在第二个脚本配置系统在登录后，运行第三个脚本。这让我们可以运行所有需要的任务来初始化Bitlocker。一旦Bitlocker已经运行，再次重新启动系统。

NOTE: We changed the shell at reboot to be the third script - this helps to make to solution a bit more secure in that there is no desktop for the user to interact with. However while you are developing the solution you might want to place a shortcut in the start up folder as this will make debugging easier. We also show a warning dialogue on the screen, BuildWarning.hta, informing the user that the system is still building.

注意：我们在第三个脚本处修改了启动的shell，这让我们的解决方案更加安全。

 

Scripts and Task Sequence

Partitioning the disk

Because we needed to support an OEM solution we re-worked the disk partitioning script quite a bit. The script ZTIDiskPartOSD.wsf, in the zip linked below, actually has to be run twice. Each time it is run you need to specify a switch on the command line. This switch tells it if it is going to create the OS partition or the BitLocker partition. So in your task sequence you need to create two tasks - one to create the OS partition to other to create the BitLocker Partition. The screen shot below shows the two task sequences. The zipped file, link at the end of this post, has a file TS-snippets.txt that contains these two steps that you can cut and paste into your task sequence.

因为我们需要支持OEM方案，所以我们重新修改了分区脚本。ZTIdiskPartOSD.wsf，实际上需要运行两次。你需要在命令行里设置每一次脚本运行。这个开关用来控制船舰OS分区或者是Bitlocker分区。所以在TS中，你需要创建两个任务，一个用来创建系统分区，一个创建Bitlocker分区。第二张截图显示了两个人物。

NOTE: You could use the normal script that comes with BDD however you still need to make sure this writes to a network location.

注意：尽管你可以用BDD的普通脚本来运行任务，但你仍需要把文件放在网络上

So now we have the two partitions created. The OS image is laid down onto the disk and mini-setup runs before rebooting to start the Zerotouch part of setup.现在我们已经创建好两个任务。OS镜像已经应用到硬盘上，mini-setup在重启之前运行来开始Zero投产安装