Benchmark Цитата: А ведь по слухам есть еще и отдельные специальные сборки для военных, правительственных и крупных финансовых организаций
Специальных сборок для военных, правительственных и крупных финансовых организаций Microsoft не делает!
(Хотя возможно есть диски подготовленные для таких организаций с интегрированными сертификатами, этим занимается специальная служба по взаимодействию с такими заказчиками.)
В каждой такой организации есть ответственные лица которые головой отвечают за выделенные Microsoft сертификаты и развертывание систем в этих организациях - структурах, вот они да, могут собирать такие дистрибутивы.
Для таких организаций как (госдеп, анб, посольства, банки, биржи и.т.д) есть специальные методы активации
Soft Token,
Silent Token-based Activation,
Hard Token (Token-based Activation), Hard Token Activation - реализована через использование smartcard, а вот Soft Token Activation через специальный сертификат, Silent Token-based Activation - это самый интересный и "загадочный" способ.
Все эти способы активации возможны
ТОЛЬКО на корпоративных (
Volume) версиях продуктов!
Hard Token Activation A certificate with the private key protected by hardware. An example of a hard token is a Smart Card, which requires a PIN to allow access to the stored certificates private keys.
Soft Token Activation A software certificate with an associated private key, usually installed in the machine-certificate store, and read-accessible by users on the computer. The soft token can be issued by the customers PKI, or it can be issued by Microsoft when the customer cannot distribute PKI in the environments that require disconnected activation.
Silent Token-based Activation When possible, token-based activation will activate without any user interaction. In hard token implementations, a user PIN or other credentials are required to unlock the Private key of the certificate used for activation. Many PKI middleware implementations support PIN caching, and token-based activation makes use of this when available. If you use hard tokens and PIN caching, and if you use smart cards for logon, token-based activation will periodically use the cached PIN information to reactivate the system; the end user will transparently activate their computer periodically when they log in.
In a Soft Token implementation, no PIN is required to unlock the private key.
A soft token system will reactivate as needed, transparently.
Silent Activation is the default implementation of token-based activation. It is automatically enabled if your implementation meets the following criteria:
• Your organizations PKI supports the use of smart cards (or comparable USB devices) for logon.
• At least one certificate on the smart card is a valid activation token per the IL.
• Your organizations CSP middleware caches user personal identification numbers (PINs). Token-based activation in itself does not cache user PINs.
- Or -
• The IL specifies a software certificate (Soft Token) that does not require user input for access to the private key.
• At least one valid certificate must be installed on the computer with a private key readable by the user, which chains back to a Certificate Authority identified by the installed IL.
If these criteria are met, token-based activation will attempt to activate Windows (or renew activation) without user interaction when a user logs on and a renewal or activation is indicated by the schedule.
In the
Soft Token implementation, the digital certificate is installed on the hard drive (e.g. both public and private keys are available on the local system).
There is significant risk to Microsoft because it is possible for the certificate to be extracted and multiplied on pirated Windows systems.
The use of soft token will be approved on a case-by-case basis, dependent on the customer environment. The solution will be authorized in environments which:
•
Never connect to the internet.
•
Have no telephone capability.
•
Have policy or law that restricts the flow of any information outside of the enclave to protect national security (or similarly relevant purpose).
Exceptions to these environmental conditions will be considered individually and will require the approval of the applicable product group executive.
и на последок:
Внутри Microsoft для активации систем в том числе и в домене используются персональные смарткарты и сертификат, например для Win7 имя файла: W7_RTM_MSFT_SmartCard.xrm-ms
Документация процедур активации носит
конфиденциальный характер и ввиду особых условий я не могу их обнародовать.
Священная Корова сейчас прибежит и порвет меня :)