Manual

Thefollowingdiagramprovidesthestructureforthemotherboardswap-takeownership:
Motherboard Swap - Take Ownership
Trusted Platform Module
Decrypted via derived AES Key
System Leaf Private Key
Store Leaf Private Key
System Leaf Public Key
Store Leaf Public Key
System Base Private Key
System Base Public Key
If Passphrase
loop n times
CSS Admin PW/PP
One-Way Hash
System Base AES
Protection Key
(derived via output
of hash algorithm)
Figure3.MotherboardSwap-TakeOwnership
Aseachuserlogsontothesystem,theUserBaseKeyisautomaticallydecryptedthroughtheUserBase
AESProtectionKeyderivedfromuserauthenticationandimportedtothenewSRKcreatedthroughthe
ClientSecuritySolutionAdministrator.Thefollowingdiagramprovidesthestructureforthemotherboard
swap-enrolluser:
Tologinaseconduserafterthechiphasbeenclearedorafteryoureplacethemotherboard,youmustlogin
asthemasteradministrator.Themasteradministratorwillbepromptedtorestorethekeys.Oncethekey
restorationhasbeencompleted,usePolicyManagertodisabletheClientSecurityWindowslogon.The
remaininguserswillbeabletorestoretheirrespectivekeys.Onceallsecondaryusershaverestoredtheir
keys,themasteradministratorcanenabletheClientSecuritySolutionWindowslogonfeature.
Thefollowingdiagramprovidesthestructureforthemotherboardswap-enrolluser:
Motherboard Swap - Enroll User
Trusted Platform Module
Decrypted via derived AES Key
Storage Root Private Key
Storage Root Public Key
User Leaf Private Key
User Leaf Public Key
Windows PW AES Key
PW Manager AES Key
User Base Private Key
User Base Public Key
If Passphrase
loop n times
User PW/PP
One-Way Hash
User Base AES
Protection Key
(derived via output
of hash algorithm)
Figure4.MotherboardSwap-EnrollUser
24ClientSecuritySolution8.3DeploymentGuide