This setting determines the exemption status which is specified by the assigned hardware profile This setting specifies the interval in which the MBAM client will re-check its hardware exemption status.Ġ = unknown1 = incompatible2 = compatible The registry keys listed here are responsible for these actions. The downside to this is that when a system checks in and the hardware profile is listed as unknown, the system then waits 24 hours before checking in again. This allows for control of encryption on system that may or may not meet your organization’s hardware standards for encryption. When using Hardware Compatibility Checking with MBAM systems, validate their hardware profile against the policies within MBAM. If the Windows7 or Server2008 systems do not trust the CA that issued these certificates, you may need to add that CA, or its root CA, to the system’s Trusted Publishers Certificate Store. Please note: In order for these two certificates to be useful, it is required that they chain up to a CA that that your computer trusts. The second certificate is used to encrypt the communication between the Administration and Monitoring server and the MBAM client agent. The first certificate is used to encrypt the communication between the SQL Server hosting the databases and the Administration and Monitoring Server. Two certificates should be issued for use with MBAM. These two EKU’s are typically found together in the default Computer certificate template of an Enterprise CA, but can easily be added to any computer template you wish. The Extended Key Usage (EKU) requirements of the certificates are as follows:Ĭlient Authentication (1.3.6.1.5.5.7.3.2) The requirements for the certificates relating to MBAM are straightforward and typically do not require significant modifications to an organization’s PKI.

Mbamclient