DE Detech Procedure - Step by step
1-Install Microsof ADK
Install WinPE Add-on
Open ADK CMD console, known as Deployment and Imaging Tools Environment command prompt and do step 2 from it.
2-Create WInPE
Enter the following command into the Deployment and Imaging Tools Environment command prompt — replace C:\WinPEx64 with the path to the folder you want to stage the Windows PE files to (this should not be your USB drive, as this directory is where the files will be prepared before they are copied to it)
copype amd64 C:\WinPEx64
https://www.ninjaone.com/blog/how-to-create-a-windows-preinstallation-environment-bootable-usb-flash-drive-or-iso/
3- Install Trellix DE software (EEtech_version) onto WinPE. This can be downloaded from Software catalog in ePO , under Drive Encryption.
Download and unzipp it. Navigate to ...\EETech-8.0.1.15\WinPE from CMD as admin.
Usage:
To install DETech\DEOpalTech onto WinPE image:
WinPe_tech.cmd <winpe_root> <architecture> <encryption_provider>
winpe_root Path where the WinPE is extracted via copype.cmd.
architecture 32/64
encryption_provider pc/opal
Example below, winpe_root as created above on steps 2.
WinPe_tech.cmd C:\WinPEx64_DE7 64 PC/OPAL
WinPe_tech.cmd C:\WinPEx64 64 PC
_____________________________________________________________________________________________________________________________________________
For Opal disk only
Mount WinPE: Dism.exe /Mount-Wim /WimFile:C:\winpe_amd64\media\sources\boot.wim /index:1 /MountDir:C:\winpe_amd64\mount
Edit the WinPE environment as follows:
Open regedit, then load the system hive under [HKEY_LOCAL_MACHINE].
Click HKEY_LOCAL_MACHINE, File, then click Load Hive.
From the mounted WinPE image, navigate to this system file: C:\winpe_amd64\mount\Windows\System32\Config\SYSTEM.
Name the WinPE hive, for example, pe.
Access the [HKEY_LOCAL_MACHINE\pe\ControlSet001\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}] registry entry.
Edit the multi-string upper filters with values:
MfeEpeOpal
MfeEpePC
PartMgr
Right-click HKEY_LOCAL_MACHINE\pe\ControlSet001\services, then create the MfeEpeOpal, MfeEpePC and MfeCcde keys.
Modify the values of the [HKEY_LOCAL_MACHINE\pe\ControlSet001\services\MfeEpeOpal] key as follows:
"Type"=dword:00000001
"Start"=dword:00000000
"ErrorControl"=dword:00000003
Modify the values of the [HKEY_LOCAL_MACHINE\pe\ControlSet001\services\MfeEpePC] key as follows:
"Type"=dword:00000001
"Start"=dword:00000000
"ErrorControl"=dword:00000003
Note
The keys are still 32-bit dword even though you are using a 64-bit system.
Modify the values of the [HKEY_LOCAL_MACHINE\pe\ControlSet001\services\MfeCcde] key as follows:
"Type"=dword:00000001
"Start"=dword:00000000
"ErrorControl"=dword:00000003
"Group"=string:Primary Disk
Note
The keys are still 32-bit dword even though you are using a 64-bit system.
Click pe, then click File → Unload hive to unload the WinPE hive.
Bypass Digital Signature check!!!!!! (for OPAL only)
We can bypass the digital signature check by editing the BCD information used by WinPE using the following commands.
bcdedit /store c:\winpe_x64\media\EFI\Microsoft\boot\bcd /set {default} loadoptions DISABLE_INTEGRITY_CHECKS
bcdedit /store c:\winpe_x64\media\EFI\Microsoft\boot\bcd /set {default} testsigning on
Once the above command has been executed, please recreate the USB.
To commit changes to WIM, enter this command:
Dism.exe /Unmount-Wim /MountDir:C:\winpex64\mount\ /Commit
Close the Registry Editor.
__________________________________________________________________________________________________________________________________________________
4- Convert to ISO
From normal CMD as admin
Cd C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment
Run:
MakeWinPEMedia /ISO C:\WinPEx64 C:\WinPEx64.iso
-----------------------------------------------------------------------------------------------------
Upgrading to Trellix DE 8
https://docs.trellix.com/bundle/drive-encryption-8.0.x-on-prem-ig/page/UUID-99e8e590-4535-fc36-a77f-24781b9dda2a.html
https://docs.trellix.com/bundle/drive-encryption-8.0.x-on-prem-ig/page/UUID-afa6890e-7530-30cc-da3d-2235ec584930.html
Note location: Trellix Drive Encryption 8.x: includes Drive Encryption for windows, and Drive Encryption Host.
https://docs.trellix.com/bundle/drive-encryption-8.0.x-on-prem-ig/page/UUID-3409e7c2-4f20-0dc4-bdba-553e5d8b9bcd.html