Remote management of endpoint computing device with full disk encryption

1. In a computing system environment, a method of providing remote management of an endpoint computing device employing full disk encryption for data encrypted by a first key, said endpoint computing device including a pre-boot operating system that prevents a user of the endpoint computing device from accessing the encrypted data and a main operating system without providing proper authentication, comprising:

providing an information exchange partition associated with the endpoint computing device accessible from a remote location and authenticated from the remote location via a specified credential during a pre-boot phase, said information exchange partition including data encrypted using a second key, wherein the encrypted data and the second key are accessible to the pre-boot operating system and the main operating system, the second key also used for decrypting the encrypted data; and

performing at least one test, without any user action, as part of the pre-boot phase, reporting results for the at least one test over a network to a remote diagnostics module;

probing, by the remote diagnostic module in response to the results, the endpoint computing device for a current version of security policy software components, current settings on the endpoint computing device, and attributes for the settings, wherein at least one setting indicates which particular ports of the endpoint computing device are blocked; and

distributing code to repair a diagnosed problem on the endpoint computing device to the endpoint computing device, and executing the code on the endpoint computing device without any particular user interaction or intervention.

2. The method of claim 1 , further including the step of providing the data encrypted using the second key from the remote location.

3. The method of claim 1 , further including the steps of:

providing the information exchange partition with an instruction for updating the main operating system; and

upon reboot, causing the pre-boot operating system to read the instruction.

4. The method of claim 3 , further including the step of preventing the pre-boot operating system from reading the instruction during a subsequent reboot of the endpoint computing device.

5. The method of claim 3 , wherein upon reboot, performing the step of providing the main operating system with the data encrypted using the second key.

6. The method of claim 3 , wherein upon reboot, performing the step of only partially decrypting the data encrypted using the first key.

7. The method of claim 1 , wherein the data encrypted using the second key comprises software for updating the main operating system, and further including the step of rebooting the endpoint computing device upon completion of the update.

8. An endpoint computing device, comprising:

a hardware platform including a processor, memory and a disk;

first encrypted data configured for storage in the memory or disk;

a first key stored on the hardware platform to decrypt the first encrypted data;

an information exchange partition on the hardware platform;

second encrypted data on the information exchange partition;

a second key stored on the hardware platform to decrypt the second encrypted data;

a policy enforcement module on the hardware platform to carry out predefined security policies between the first key and the encrypted data and to authenticate the information exchange platform from a remote location via a specified credential during a pre-boot phase; and

a computer operating system and a pre-boot operating system configured to act on the processor such that upon launching a pre-boot phase of operation, the pre-boot operating system prevents a user of the endpoint computing device from accessing at .least the first encrypted data, and wherein the computer operating system and the pre-boot operating system are provided access to the second key for decrypting the second encrypted data on the information exchange partition, and performing at least one test, without any user action, as part of the pre-boot phase of operation, and reporting results for the at least one test over a network to a remote diagnostics module, and probing, by the remote diagnostic module in response to the results, the endpoint computing device for a current version of security policy software components, current settings on the endpoint computing device, and attributes for the settings, wherein at least one setting indicates which particular ports of the endpoint computing device are blocked; and distributing code to repair a diagnosed problem on the endpoint computing device to the endpoint computing device, and executing the code on the endpoint computing device without interaction or intervention of the user.

9. The device of claim 8 , wherein the information exchange partition and the pre-boot operating system reside on the disk of the hardware platform.

10. The device of claim 8 , wherein the information exchange partition includes an instruction for updating the main operating system during the pre-boot phase of operation.

11. The device of claim 8 , wherein the information exchange partition includes software for updating the main operating system.

12. A method residing as executable instructions in memory or a non-transitory computer-readable storage medium for execution on a computing device and when executed performing the method, comprising:

loading, via the computing device, the executable instructions on an endpoint computing device for managing or provisioning a drive that includes full disk encryption using a first key;

launching, via the computing device, a pre-boot phase of operation during which time a pre-boot operating system of the endpoint prevents a user of the endpoint from accessing the encrypted data;

accessing, via the computing device, an information exchange partition on the endpoint computing device, said information exchange partition including data encrypted using a second key accessible to both the pre-boot operating system and the main operating system and authenticating the information exchange partition from a remote location via a specified credential during a pre-boot phase;

probing, by a remote diagnostic module in response to reported results of a test executed on the endpoint computing device, the endpoint computing device for a current version of security policy software components, current settings on the endpoint computing device, and attributes for the settings, wherein at least one setting indicates which particular ports of the endpoint computing device are blocked; and

distributing code to repair a diagnosed problem on the endpoint computing device to the endpoint computing device, and executing the code on the endpoint computing device without any interaction or intervention of the user.

13. The method of claim 12 , wherein the instructions provide for pre-boot authentication according to a specified credential.

14. The method of claim 12 , wherein the information exchange partition includes software for updating the main operating system, and the instructions are configured to run the software.

15. The method of claim 14 , wherein the instructions are configured to reboot the endpoint computing device after running the software.

16. The method of claim 14 , wherein the instructions are configured to only partially decrypt the data on the drive encrypted using the first key.