CSS 7 ?

[xcoll2001]

Zvi: I never had the problem with changing passwords with my secureDrive. Not having certificates shouldn't pose any problems. Have you installed the hotfix? And i do think it makes sense that it can be mounted only afer the user logged in.

The considerations listed here have some info that may help: ftp://ftp.software.ibm.com/pc/pccbbs/th ... 1017ww.txt

As far as deleting, does dragging the secure volume to the trash won't delete it? But if you meant uninstall secureDrive the application then you have to uninstall CSS7 using the control panel from the Start menu not from ThinkVantage Software install. I'd recommend uninstall R7R 3.1 too if you have that in your machine.[/url]

[Zvi]

Well, I have no certificates that I know of... but I am UNABLE to change the password for the SecureDrive. This is actually what happens. I have it set to "Mount Manually" rather than "Mount after User has logged in". So, I log in and the system starts up and I get a password prompt for the "private drive". I enter the password and there is no problem. The SecureDrive gets mounted. However, if I want to CHANGE that password, I am unable to do so! When I enter the SAME password that I used when the SecureDrive was mounted, I get a password authentication error!
By the way, at one point (because I misunderstood the "hints and tips", I set the option to "Mount after User has logged on" and then I was UNABLE to respond with a valid password prompt AT ALL!! When I entered the password that I specified when the SecureDrive was created, it REJECTED it. Apparently, the only time that I can get my password accepted is if I specify "Mount Manually". I am sur that there is some sort of generated password involved and it is infuriating to me that this does not apear to be addressed or adequately documented.

I did not try dragging the SecureDrive to the trash... I thought that you had to formally uninstall it. I can try that and see what happens.

I am a bit frustrated by the lack of "simple" user documentation for CSS. Apparently, the ONLY up-to-date docunent (dated the beginning of June!) is the massive deployment guide.

Any other ideas?

TIA

--Zvi

[Zvi]

One other item... I installed the Hotfix as soon as prompted to do so.

--Zvi

[xcoll2001]

It is possible that you may have the wrong administrator password for your secured volume. Your Windows log-in administrator password does not necessarily be the same as your administrator password for your secure volume. Trash the old try creating another volume and for testing type an easy password like "hello." See if you still have the same problem.

Look in the menubar and select Help you'll find your documents and directions there.

[Zvi]

The Password issue is a bit odd. I currently have the option set to "Mount Manually". When the system comes up, I get prompted for a password for "Private Drive". When I enter the password, it gets ACCEPTED and the the "Private Drive" get mounted. However, if I go into the CSS Wizard in order to change the Password, I am prompted for the "old" 'Administrator' password and WHATEVER password I enter is not accepted!

In addition, when I changed the option to "Mount after User is Logged on", I was prompted for the password and -- again -- the passowrd was not accepted making it impossible for me to "mount" the "private volume"! When I reverted back to "Mount manually", then the password WAS accepted and I could then mount the "private volume". This is really odd! I believe that at some point there really is some sort of "System-generated password" which is messing this stuff up.

Anyway, that is the story....

--Zvi

[Zvi]

I do not recall seeing in the "Help" how to delete the old "Private Disk". However, one of the members of the Forum told me that I can just drag the Drive to the Trash.
If it works, then I am OK with that!

--Zvi

[Cassirer]

thanks for the help,

CCS 7 is gone and CCS 6 back ....

started a new thread to explain what I did so that people would find it quickly ....

Steve

[pphilipko]

Well, I'd just like to say that I successfully installed CSS 7 on my X40 with no problems whatsoever. Everything is working as intended.

However, before installing it, I restored my computer to "factory pre-installed" condition without any CSS installed.

I simply patched up my system first from Microsoft Update, and then downloaded Software Installer. After applying all the new software, voila! Everything works as intended.

I think the problem arises when one already has a previous CSS installed before applying the new CSS 7. From my empirical observations, the only solution is to wipe the hard drive to factory contents, and THEN install the CSS software while the computer is "fresh", so to speak.

[JPOESQ]

Did someone allready try CSS 7?=

Daniel

CSS 7 isn't working for me. The password manager will not recall passwords any longer and the transfer and type tool will not insert passwords.

I gave it a good try, but had to go back to CSS 6 which works just great.

[Shammyh]

I've been using CSS 5.43 for the past 1.5 years, and haven't had a single problem. Although it's a bit more complicated to get working, it's definately more powerful. It works perfectly with the latest fingerprint software too. And from my completly non informed biased opinion, I think it's a bit more professional and inspires more confidence in it's security than CSS6/7. That's just my two cents. Sometimes the latest is far from the greatest.

- Sam

[tsfisher]

I have a T41p and am having the exact same problem as Chazas described in his 6/12/06 post. When trying to logon to WindowsXP I get a message "checking the status of the embedded security chip" This goes on and on and on...... When I click "ok" I then get a Press "Cntl-alt-del" to logon. I cannot get past this message. I am locked out of my computer. I simply used the Software Installer to update various components. Has anyone found a work around for this. Thanks for any help!

[Nick Y]

I have a T41p and am having the exact same problem as Chazas described in his 6/12/06 post. ...

Try 'Cannot logon after CSS V7 install' at:
http://forum.thinkpads.com/viewtopic.ph ... 9461424d25

[Tony's X60s]

I have got an increasingly frequent problem (gone from once per week to once per day) of resuming from suspend only to get trapped in the following loop:

- swipe finger => "fingerprint not enrolled for this user"
- click OK to go to windows logon using password
- enter password => "password not configured for this user"
- repeat until patience lost, then hold down power button until PC stops, then restart.

Any one else seeing this? If it's just me, I guess I'll have to uninstall/reinstall as per Dkunkle's recipe.

[Tony's X60s]

I finally took the plunge and uninstalled CSS7 and FPS5.5 to see if I could get rid of the intermittment bugs - and it all worked!

I logged on as administrator and used DKunkle's recipe for uninstalling CSS7 (except I found that the security chip must be set to "inactive" not "disabled" to get back into Windows to uninstall it). I also uninstalled FPS5.5. I left Rescue & Recovery 3.1 in place.

I then:
- logged on as administrator
- downloaded and installed FPS5.5 (I didn't use software installer or system update - I no longer trust them to do it right)
- rebooted and set the security chip to "active"
- rebooted and logged back in as administrator (NB: I did not enroll any passwords or use FPS5.5 at this stage)
- downloaded and installed CSS7, rebooted
- started CSS7 and went through the settings wizard process (which established the administrator ID as "owner" of the chip), rebooted. In this step I got a few "please swipe finger" messages which I ignored or closed to get to the password entry box
- started FPS5.5 and checked that it had been integrated with CSS7 (the sign of this is that the logon tab under settings offers no options - it just tells you that CSS7 is managing this)
- deleted the administrator passport (click on "delete" - if "delete is not there, either the passport does not exist or FPS5.5 and CSS7 have not integrated properly)
- re-enrolled administrator's fingerprints (I use thumbs for administrator, fingers for other IDs)
- rebooted, swiping a thumb and entering my power-on password to associate it with the ID
- rebooted and logged on as myself, started CSS7 and enrolled myself as a user
- started FPS5.5 and deleted my passport and re-enrolled my fingerprints

After all that, everything works.

The deficiency appears not to be the software, but the lack of a simple guide to getting started as a single user of a personal notebook PC. There are 200 pages on how to deploy these products in enterprises but zip on how to do it for yourself.

The root cause of my problems was that CSS7 and FPS5.5 were not properly linked and were both trying to work independent of each other - it worked OK 99% of the time, but was a real [censored] on that last 1%.

In my research I found that the fingerprint reader technology (hardware by Amtel and Upek, software by Upek) actually has much of the same embedded security technology as the embedded security chip - unless they are linked, they can occasionally give problems. When they are properly linked, the fingerprint chip becomes subordinate to the security chip in the chain of keys used to authenicate users and encrypt stuff.

I hope all this is useful to fellow sufferers out there. I still think CSS7/FPS5.5. is a marvellous piece of technology (now that it's working).

[darkmoon]

I have got an increasingly frequent problem (gone from once per week to once per day) of resuming from suspend only to get trapped in the following loop:

- swipe finger => "fingerprint not enrolled for this user"
- click OK to go to windows logon using password
- enter password => "password not configured for this user"
- repeat until patience lost, then hold down power button until PC stops, then restart.

Any one else seeing this? If it's just me, I guess I'll have to uninstall/reinstall as per Dkunkle's recipe.

Hi Tony,

Thanks for posting this. I'm experiencing the same problem (only with one of my 2 accounts though). I thought I was being thorough in downloading and installing upgrades just after getting my new Thinkpad (Z60m) ; seems I was wrong !

I'll try uninstalling/reinstalling as you did ; I'm really surprised there isn't any official support for this though.

[beaker]

The Client Security Solution 7 Password Manager does work correctly. What you have to do is this:

Use the Type and Transfer Tool to make your entries. When prompted to save your username and password entry into the password manager, DON'T.

Click on the submission screen (where you entered in the username and password). Hit the submit button.

The password manager will then prompt you a 2nd time to save your entry. Now save it.

When the password manager prompts to save your entries the first time, the window with your entries does not have the focus. If the window does not have the focus, it is not properly saved by the password manager.

Try it again. It does work

[davidspalding]

I ran Software Installer today on my T43 ... and neither the newer FPR or CSS 7 were offered.

HUGE sigh of relief. I hope it never shows up. These anecdotal reports are obscene.

[CapitanRon]

More CSS 7 woes.

The brief history:
1. Received the update via the Software installer.
2. During install get dialog saying that the new version was not compatible with old version, uninsatall old version and try again.
3. Did that.
4. On second install it hangs with dialog: Error 1920. Service TSS Core Service(TSSCoreService) failed to start. Verify that you have sufficient privileges to start system
services.
5. After some research I solved that problem and install completes.

Now the real trouble begins.

When I open the Client Security Solution interface, the left side is grayed out. On the right side all are colored but only the Fingerprint Software button works.
I then go to C:\Program Files\Lenovo\Client Security Solution to look for a help file. All of the files are green indicating encryption and access is denied to the files i.e. C:\Program Files\Lenovo\Client Security Solution\css_wizard.exe
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

I try to uninstall CSS 7 via Control Panel/ Add Remove after disabling and clearing the embedded security chip in the BIOS. Get the same song and dance about access and appropriate permissions. Log on as Administrator. Same messages. Log on as user with Administrator privileges. SameO! SameO!

I've read and reread all of the posts on this forum re CSS 7, searched MS Knowledge base, searched IBM/Lenovo. No solutions. My problem seems to be unique.

The good news is that my system boots OK and all works except the CSS 7 software. My Fingerprint software is working great. I'd just like to get the pesky CSS 7 software off of my machine without Recovering to the original installation.

I can delete the folders and files, and I have tried on a file or two and then restored them. The system will let me send them to the Recycle bin with no fuss. I just hate to uninstall a program like that.

Any ideas? Anybody?

[Tony's X60s]

The only thought I have is to check if there is a new user account on your machine (possibly created by the installer) that might own the files. It seems very strange that you can't (even when an administrator) give yourself full access. I'm probably grasping at straws.

[darkmoon]

Hi everyone.

I think I'm stuck here : I tried uninstalling CSS 7 (which went OK using dkunkle recipe) ; I then uninstalled FPS 5.5.

Since then I can't logon into Windows anymore : the system tells me he can't find vrlogon.dll (which I think is part of FPS), and offers me to reboot. Not good.

I guess the uninstall of FPS didn't go all the way, and for some reason Windows expects FPS to handle the logon process.

I tried Last Known Good and Safe Mode with no success.

Help anyone ?

Thanks.

[darkmoon]

Hi everyone ;

my problem is solved, i'll post the solution here just in case anybody runs into the same problem.

I finally managed to log in in Safe Mode with command prompt ; launched explorer from the prompt ; launched regedit ; went to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon and deleted the key GinaDLL, thus restoring standard Windows logon behaviour.

I'm happier now

[cyberjas]

The Password issue is a bit odd. I currently have the option set to "Mount Manually". When the system comes up, I get prompted for a password for "Private Drive". When I enter the password, it gets ACCEPTED and the the "Private Drive" get mounted. However, if I go into the CSS Wizard in order to change the Password, I am prompted for the "old" 'Administrator' password and WHATEVER password I enter is not accepted!

In addition, when I changed the option to "Mount after User is Logged on", I was prompted for the password and -- again -- the passowrd was not accepted making it impossible for me to "mount" the "private volume"! When I reverted back to "Mount manually", then the password WAS accepted and I could then mount the "private volume". This is really odd! I believe that at some point there really is some sort of "System-generated password" which is messing this stuff up.

Anyway, that is the story....

--Zvi

Hi !

I have the same problem and the reason the password is incorrect is because it's randomly generated by the software, here's an explantion:
https://www.utimaco.com/internet/Uti_Kn ... enDocument

The problem is now I upgraded RnR3.1 and CSS7 and it lost my password so i can't mount my volume and I need those data back !! Can anyone help ??

Also before I knew this thread existed I posted this:
http://forum.thinkpads.com/viewtopic.ph ... 120#175120

any ideas what to do now ??

Jason

[nonyNony]

Background - The default configuration for CSS 7.0 is to generate a random password to access the default Securedrive.

Then, at logon, cssauth.exe issues the following command line to mount the drive -

PDCMD.exe MOUNT Path\SecureDrive.vol /pwd "yourRandom Password" /pt 0.

If you are able to inspect the command line you will be able to see the password in the clear.

1) Get hold of Process Explorer from sysinternals.com.
.
2) Launch Process Explorer (after SecureDrive has been mounted)

3) Kill the current cssauth.exe process.

4) Invoke a new instance of cssauth from a command prompt

5) The new instance will attempt to mount secureDrive.vol, and this will generate a popup with verbiage "The disk is already in use. do you want to mount it for read only access?"

6) Do not respond to the popup - (we need PDCMD to be running)

7) Locate PDCMD using Process Explorer, go into Properties [image tab] and you will be able to see your cleartext password in the command line section.

The above procedure worked for me.

nN

[xcoll2001]

beaker : when you mount a secure drive, the password manager dialog box remained focus and you can't bring the submission screen to focus.

[cyberjas]

Background - The default configuration for CSS 7.0 is to generate a random password to access the default Securedrive.

Then, at logon, cssauth.exe issues the following command line to mount the drive -

PDCMD.exe MOUNT Path\SecureDrive.vol /pwd "yourRandom Password" /pt 0.

If you are able to inspect the command line you will be able to see the password in the clear.

1) Get hold of Process Explorer from sysinternals.com.
.
2) Launch Process Explorer (after SecureDrive has been mounted)

3) Kill the current cssauth.exe process.

4) Invoke a new instance of cssauth from a command prompt

5) The new instance will attempt to mount secureDrive.vol, and this will generate a popup with verbiage "The disk is already in use. do you want to mount it for read only access?"

6) Do not respond to the popup - (we need PDCMD to be running)

7) Locate PDCMD using Process Explorer, go into Properties [image tab] and you will be able to see your cleartext password in the command line section.

The above procedure worked for me.

nN

Thanks for the tip. I tried that but the command line does not contain any password maybe if the password is not lost this is a good way to have a backdoor access. I wonder if there's anything that can be done to locate the 'lost' password....

Jason

[xcoll2001]

just reading support pages for CSS 7 and RR3.1, the document mentioned the user SHOULD install RR 3.1 first before CSS 7. I've done it the other way and now after a reinstallation it seemed all the problems are gone. So perhaps this is one solution albeit a granular one.

[Nick Y]

just reading support pages for CSS 7 and RR3.1, the document mentioned the user SHOULD install RR 3.1 first before CSS 7.

Although CSS7, RR3.1 and the F/Print s/w all have the same issue date on Lenovo's site, I am pretty certain that CSS7 was only made available a few days after the other two. If I am correct, their order of release did not help matters.

[mr_anime]

To all users who couldn't install the Client Security Solution or Rescue and Recovery administrative template from the (poorly worded) Lenovo Article, I finally got it to work.

Follow Lenovo's instructions:

Add the template to the Active Directory policy or apply the (.adm) file to the local machine Group Policy by completing the following steps:

1. Click Start, then click Run.
2. Type gpedit.msc, then click OK.
3. Within the Group Policy window, go to the Local Computer Policy/Computer Configuration directory. Right-click the Administrative Templates folder and select Add/Remove Templates, then click Add and select the Client Security Solution and/or Rescue and Recovery .adm file, as appropriate.
4. Click Close to import the selected template. The ThinkVantage folder is now available within the Administrative Templates directory.

The two administrative templates are located C:\SWTOOLS\TOOLS\Admin017 directory.

[levbo]

Hey darkmoon - just wanted to thank you. Your solution below worked for me.

It's sad that IBM's security software on the Thinkpad, when uninstalled doesn't clean up after itself. I guess they assume nobody would dare uninstall their utilities.

So be careful unistalling the fingerprint security package - or you will have to fight the "missing VRLOGON.DLL" beast.
=====================================

Hi everyone ;

my problem is solved, i'll post the solution here just in case anybody runs into the same problem.

I finally managed to log in in Safe Mode with command prompt ; launched explorer from the prompt ; launched regedit ; went to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon and deleted the key GinaDLL, thus restoring standard Windows logon behaviour.

I'm happier now

[IdeaDirect]

The Client Security Solution 7 Password Manager does work correctly. What you have to do is this:

Use the Type and Transfer Tool to make your entries. When prompted to save your username and password entry into the password manager, DON'T.

Click on the submission screen (where you entered in the username and password). Hit the submit button.

The password manager will then prompt you a 2nd time to save your entry. Now save it.

When the password manager prompts to save your entries the first time, the window with your entries does not have the focus. If the window does not have the focus, it is not properly saved by the password manager.

Try it again. It does work

I'm a little lost... I am following your instructions but the second prompt to save never appears. Just so I'm clear.
1. I use Type and Transfer to enter my login and password.
2. I click "OK" in the Type and Transfer tool and am given three options. Save, Don't Save, Never Save. I click on "No".
3. I then click on Submit and I log in but I never get another Password Manager notice.

In step 2, I also tried to "Cancel" instead of clicking on "OK" but get the same problem.

I am using Firefox which might be the problem. I tried IE but the Type and Transfer tool won't even let me drag text to a field.
Am I doing something wrong.