Fbreseal.exe does not get deleted when executed.

[Mark K Vallevand]

I thought that fbreseal.exe would delete itself after running. In my case,
after finishing setting up my image, I commit the EWF, then fbreseal, and
click the OK button. The image is then captured before it reboots. When
the image reboots, fbreseal.exe is still there. I can execute it again.
(Commit first.) This time fbreseal.exe is deleted. Any ideas?

 

[Mark K Vallevand]

I'll add that the reseal process seems to happen both times. The boot takes
a long time, in both cases, as the SID update occurs.

I'm using the existance of fbreseal.exe as a key that reseal has not
occured. Is there a better way to detect this?

Are things getting messed up because
- fbreseal is executed once and doesn't seem to stick, or
- fbreseal is executed twice?

How should I expect it to behave?

 

[srivathsan.a]

Hi Mark,

1. Check the extended properties of the System Cloning Tool component.
-> cmiResealPhase
Default setting is 12000. you can set it to 0 to disable automatic
reseal during FBA. (to avoid executing fbreseal twice.
Surely When fbreseal is executed it gets deleted.

2. It always takes a long time when u execute fbreseal again since it
resets many of the reg entries once it took 15 minutes for me to boot.

3. Using the existance of fbreseal.exe is a better way to detect the
reseal process.

Srivathsan

 

[David D]

Your running FBreseal with the EWF enabled or disabled?

David

 

[Guest]

Mark,

Try to do it with EWF disabled and let us know how it behaves.

regards
sankar

 

[Mark K Vallevand]

EWF is enabled.

I'm using stateless EWF on a CF. There is no EWF partition.

I've set cmiResealPhase to 0.

Fbreseal.exe *does not* get deleted the first time its executed.

 

[Mark K Vallevand]

I don't think its a good idea to run with EWF disabled on CF device.

I'm positive this has worked in the past. I can't see anything I've changed
that would break it.

 

[Doug Hoeffel]

Mark:

I don't see how this could of ever worked. I have accidentally run a manual
reseal then committed a ram-based ewf. My box was then in a endless reseal
on every boot.

HTH... Doug

 

[Mark K Vallevand]

Well, its worked for us for 12 months. Now, it starts acting wonky. The
reseal process takes place, but fbreseal.exe isn't deleted.

And, now, even more wierdness... We can't sign on using Remote Desktop
after the reseal. You can sign on using the local KB/Mouse/Vid. But, after
signing on locally, Remote Desktop works.

Something is messing up security, me thinks.

By the way, is there a best-practices recommendation for using fbreseal.exe
and stateless EWF on CF? (Stateless EWF == EWF RAM Reg)

 

[KM]

Mark,

http://msdn.microsoft.com/library/d...esignConsiderationsForUsingEWFWithCloning.asp

Whish is basically suggests you to have EWF disabled first.

 

[KM]

Or forget about fbreseal and switch to newsid

 

[David D]

I have a program I put into my startup folder that runs once.
I made it simple.
I put my program into the startup folder.
I then run fbreseal.
Then I shutdown.
I then make that the master clone image CF card.

A cloned image will reboot and run my program.
My program does the following:
1) Sets the computer name to a name/number based on the last 6 digits of
the MAC address plus our product name
2) Enables the EWF (to take affect on next boot up)
3) Removes itself from the statup folder
4) Places a shortcut to our production application in startup folder
5) Reboots.