Deploying MBAM on a Single Server

  • Article

The procedures in this topic describe the full installation of the Microsoft BitLocker Administration and Monitoring (MBAM) features on a single server. Each server feature has certain prerequisites. To verify that you have met the prerequisites, see MBAM Supported Configurations. In addition, some features also have information that must be provided during the installation process to successfully deploy the feature. You should also review Planning the Server Infrastructure for MBAM before beginning MBAM deployment.

Note

In order to obtain the setup log files, you have to install Microsoft BitLocker Administration and Monitoring by using the msiexec package and the /L <location> option. Log files are created in the location specified.

Additional setup log files are created in the installing user’s %temp% folder.

Deploying the MBAM Server

The following steps describe how to install general Microsoft BitLocker Administration and Monitoring features.

Note

Make sure that you use the 32-bit setup on 32-bit servers and the 64-bit setup on 64-bit servers.

Starting the MBAM Server Install

  1. Start the Microsoft BitLocker Administration and Monitoring installation wizard. Click Install at the welcome screen.

  2. Read and accept the Microsoft Software License Terms, and then click Next to continue the installation.

  3. By default, all Microsoft BitLocker Administration and Monitoring features are selected for installation. Features that will be installed on the same computer must be installed together at the same time. Clear features that you want to install elsewhere. Microsoft BitLocker Administration and Monitoring components must be installed in the following order:

    • Recovery and Hardware Database

    • Compliance Status Database

    • Compliance Audit and Reports

    • Administration and Monitoring Server

    • Policy Template

    For more information about how to plan the Microsoft BitLocker Administration and Monitoring server infrastructure, see Planning the Server Infrastructure for MBAM. For prerequisites of each MBAM server feature, see MBAM Supported Configurations.

    The installation wizard checks the prerequisites for your installation and displays prerequisites that are missing. If all the prerequisites are met, the installation continues. If a missing prerequisite is detected, you have to resolve the missing prerequisites, and then click Check prerequisites again. If all prerequisites are met this time, the installation will resume.

  4. You are prompted to configure network communication security. MBAM can encrypt the communication between the Recovery and Hardware Database, the Administration and Monitoring servers, and the clients. If you decide to encrypt the communication, you are asked to select the certification authority-provisioned certificate that will be used for encryption.

  5. Click Next to continue.

  6. The Microsoft BitLocker Administration and Monitoring Setup wizard will display installation pages for the selected features.

Deploying the MBAM Server Features

  1. In the Configure the Recovery and Hardware database window, specify the instance of SQL Server and name of the database that will store the recovery and hardware data. You must also specify both where the database files will be located and where the log information will be located.

  2. Click Next to continue.

  3. In the Configure the Compliance and Audit database window, specify the instance of SQL Server and name of the database that will store the compliance and audit data. You must also specify where the database files will be located and where the log information will be located.

  4. Click Next to continue.

  5. In the Compliance and Audit Reports window, specify the report service instance that will be used and provide a domain user account for accessing the database. This should be a user account provisioned specifically for this use. The user account should be able to access all data available to the MBAM Reports Users group.

  6. Click Next to continue.

  7. In the Configure the Administration and Monitoring Server window, enter the Port Binding, the Host Name (optional), and the Installation Path for the MBAM Administration and Monitoring server.

    Warning

    The port number that is specified must be an unused port number on the Administration and Monitoring server unless a unique host header name is specified.

  8. Click Next to continue.

  9. Specify whether to use Microsoft Updates to help keep your computer secure, and then click Next. This does not turn on Automatic Updates in Windows.

  10. As soon as the Setup wizard has collected the necessary feature information, the Microsoft BitLocker Administration and Monitoring installation is ready to start. Click Back to move back through the wizard if you have to review or change your installation settings. Click Install to being the installation. Click Cancel to exit Setup. Setup installs the Microsoft BitLocker Administration and Monitoring features and notifies you that the installation is completed.

  11. Click Finish to exit the wizard.

  12. Now that the Microsoft BitLocker Administration and Monitoring server components have now been installed, users have to be added to the Microsoft BitLocker Administration and Monitoring roles. For more information, see How to Manage MBAM Administrator Roles.

Post Installation Configuration

  1. After setup is finished, you must add users Roles before users have access to features in the MBAM management console. On the Administration and Monitoring Server, add users to the following local groups to give them access to the features in the management console.

    • MBAM Hardware Users =

      Members of this local group will have access to the Hardware feature in the management console.

    • MBAM Helpdesk Users

      Members of this local group will have access to the Drive Recovery and Manage TPM features in the management console. All fields in Drive Recovery and Manage TPM are required fields for a Helpdesk User.

    • MBAM Advanced Helpdesk Users

      Members of this local group will have advanced access to the Drive Recovery and Manage TPM features in the management console. For Advanced Helpdesk Users, only the “Key ID” field is required in Drive Recovery. In Manage TPM, only the “Computer Domain” and “Computer Name” fields are required.

  2. On the Administration and Monitoring, Compliance Status Database, Compliance and Audit Reports Server and add users to the following local group to enable them access the Reports feature in the management console.

    • MBAM Report Users: Members of this local group will have access to the Reports features in the management console.

    Note

    Identical user or group membership of the MBAM Report Users local group must be maintained on all computers where the MBAM Administration and Monitoring, Compliance Status Database, Compliance and Audit Reports Server features are installed.

    The recommended way to do this is to create a domain security group and add that domain group to each local MBAM Report Users group. As soon as you do this, manage the group memberships by way of the domain group.

Validating the MBAM Server Feature Installations

As soon as the Microsoft BitLocker Administration and Monitoring installation is complete, we recommend that you validate the installation has successfully set up all the necessary features for BitLocker. Use the following procedure to confirm that the Microsoft BitLocker Administration and Monitoring service is functional.

To validate an MBAM installation

  1. On each server where a Microsoft BitLocker Administration and Monitoring feature is deployed, open the Control Panel. Select Programs, and then select Programs and Features. Verify that Microsoft BitLocker Administration and Monitoring appears in the Programs and Features list.

    Note

    To validate the installation, you must use a Domain Account that has local computer administrative credentials on each server.

  2. On the server where the Recovery and Hardware Database feature is installed, open SQL Server Management Studio and verify that the MBAM Recovery and Hardware database is installed.

  3. On the server where the Compliance Status Database feature is installed, open SQL Server Management Studio and verify that the MBAM Compliance Status Database is installed.

  4. On the server where the Compliance and Audit Reports feature is installed, open a web browser with administrative privileges and browse to the “Home” of the SQL Server Reporting Services site.

    The default Home location of a SQL Server Reporting Services site instance can be found at https://<NameofMBAMReportsServer>/Reports. The actual URL can be found by using the Reporting Services Configuration Manager tool and selecting the instances specified during setup.

    Confirm that a reports folder named Malta Compliance Reports is listed and that it contains five Reports and one Data Source.

    Note

    If SQL Server Reporting Services was configured as a named instance, the URL should resemble the following:https://<NameofMBAMReportsServer>/Reports_<SRSInstanceName>

  5. On the server where the Administration and Monitoring feature is installed, run Server Manager and browse to Roles, select Web Server (IIS), and click Internet Information Services (IIS) Manager

  6. . In Connections browse to <machinename>, select Sites, and select Microsoft BitLocker Administration and Monitoring. Verify that MBAMAdministrationService, MBAMComplianceStatusService, and MBAMRecoveryAndHardwareService are listed.

  7. On the server where the Administration and Monitoring feature is installed, open a web browser with administrative privileges and browse to the following locations in the MBAM website to verify they load successfully:

    • https://<computername>/default.aspx and confirm each of the links for navigation and reports

    • https://<computername>/MBAMAdministrationService/AdministrationService.svc

    • https://<computername>/MBAMComplianceStatusService/StatusReportingService.svc

    • https://<computername>/MBAMRecoveryAndHardwareService/CoreService.svc

    Note

    This list assumes the services are installed on the default port 80 without network encryption. If the services were installed on a different port, change the URLs to include the appropriate port. For example, https://<computername>:<port>/default.aspx or https://<hostheadername>/default.aspx.

    If the services were installed with network encryption, change https:// to https://.

    Verify that each web page loads successfully.

See Also

Concepts

Deploying MBAM