Getting started with Playbooks policies

When you activate the Playbooks policy in a policy group:

• A unique passcode is generated and added to the device's Summary page in Device Details Learn more
• The PER component A lightweight software component of the Secure Endpoint Agent that is responsible for managing the supervisor password on a device when a Manage supervisor password request is processed. of the Secure Endpoint Agent is downloaded and activated on each device after the device's next successful connection to the Absolute Monitoring Center.

  Additional files are also downloaded, including:

  • Absolute Bootloader
  • Absolute WinPE Windows Preinstallation Environment (WinPE) is a lightweight version of Windows that can be used to recover offline devices. image

  These files are required to run playbooks at the firmware-level. After each device reboot, the Bootloader checks for a new playbook request. If one exists, it passes the playbook instructions to the WinPE image, which runs the playbook.

  When activating the policy in a policy group that contains many Windows devices, downloads are staggered to prevent network congestion.

The PER component then provisions the device by completing the following actions:

1. Installs the Absolute Bootloader and its supporting files to the EFI System Partition.
2. Changes the boot order to ensure that each time the device is restarted, the UEFI firmware runs the Absolute Bootloader first.
3. Restarts the device.

   If a user is logged in when the restart is triggered, a warning message is displayed. The user is given the option to restart immediately or postpone it for two hours. If they postpone, they can manually restart the device at any time during the two-hour window.

4. Downloads and applies the Playbooks policy configuration to the Absolute Bootloader.

5. Restarts the device.

   If a user is logged in when the restart is triggered, a warning message is displayed. The user is given the option to restart immediately or postpone it for two hours. If they postpone, they can manually restart the device at any time during the two-hour window.

   When this step is complete, the device's Playbooks status is updated to Enabled and the device is ready to run system-initiated playbooks.

6. Creates a recovery partition on the device's hard disk drive (HDD) and installs the Absolute WinPE Windows Preinstallation Environment (WinPE) is a lightweight version of Windows that can be used to recover offline devices. image to the partition.

   This step may take up to 24 hours to complete.

When all steps are complete, the device is ready to run both system- and user-initiated playbooks. You can view the provisioning status of a device on its Device Details page.

Going forward, the PER component ensures that the Absolute Bootloader is always present on the device, untampered, and boots first. It also maintains a secure connection to the Absolute Monitoring Center to receive playbook requests and send status updates.

The Playbooks policy is supported on Windows devices that meet the following requirements:

We recommend that you disable the Windows Fast Start-up feature on devices with an enabled Playbooks policy. If this feature is enabled, a device may become stuck in a restart loop if the Absolute Bootloader encounters an error that corrupts a file. The corrupted file would need to be deleted to stop the restart loop.

To disable fast start-up on a device, you can do one of the following:

• Go to Control Panel > Power Options > System Settings and disable the Turn on fast start-up setting, or

• Open a Command Prompt window as an administrator and run the following command:

powercfg /h off

For information about other methods for disabling fast start-up, such as in Group Policy, see Windows documentation.

Before activating the Playbooks policy in a policy group, you can check if any devices in the group do not meet the system requirements for Playbooks. You can also review a report showing the specific requirements that are not met for each device.

To check eligibility:

1. Log in to the Secure Endpoint Console as a user with the Manage permission for Policies.
2. On the navigation bar, click Policies > Policy Groups.
3. On the Policy Groups sidebar, click the policy group that you want to check. The policy group opens in the work area.

4. If a icon shows to the left of the activation slider, some devices in the policy group do not meet the system requirements for Playbooks. A device count shows next to the icon.

   To view the ineligible devices:

   1. Click the icon to open the Devices unable to run Playbooks page. The page is filtered to show Active devices in the policy group that have a Playbook > Status set to Not enabled or Not supported.

   2. Review the information in the Playbook > Status details report column for each device.

      Possible values are:

      • Not provisioned
        • The Playbooks policy is not activated, or
        • The policy is activated in the console, but the device is offline, or
        • The policy is activated, but the device is not yet provisioned to run playbooks. A restart may be required.
      • Persistence 2.0 version not met
      • Agent version update required
      • TPM 2.0 not enabled
      • 3rd-party CA must be active when Secure Boot is enabled
      • Windows 10 and above not met
      • x86_64 CPU architecture not met

   3. [Optional] To troubleshoot ineligible devices, see the next section.

   4. When you're finished reviewing the ineligible devices, click to close the page.

To help you troubleshoot ineligible (unsupported) devices, you can view additional system information about each device by adding the following columns to the Devices unable to run Playbooks page and reviewing the values. These report columns can also be added to any device report.

If the value required for Playbooks eligibility is not shown in the column, tips for resolving the issue are provided, where applicable.

To activate the Playbooks policy:

1. Log in to the Secure Endpoint Console as a user with the Manage permission for Policies.
2. On the navigation bar, click Policies > Policy Groups.
3. On the Policy Groups sidebar, click the policy group that you want to update. The policy group opens in the work area.
4. Next to Playbooks, click the activation slider to set it to On. Note that if the slider is grayed out, an agent upgrade is required before you can activate the policy.

   The policy is activated, and a Playbooks policy activated event is logged to Event History.

On each device's next connection to the Absolute Monitoring Center, the PER component is deployed and activated.

Deactivating a policy group's Playbooks policy sends deprovisioning instructions to the policy group's devices on their next connection to the Absolute Monitoring Center.

A device reboot is required to complete the deprovisioning process.

The Secure Endpoint Agent deprovisions a device by performing the following actions:

• Removes the Absolute Bootloader, the WinPE image, and all supporting files that were added during provisioning
• Restores the default boot order
• Deletes all files in the recovery partition
• Removes the PER component

When the Playbooks policy is deactivated, and a Run playbook request is pending , the request fails and a Playbook canceled or Playbook failed event is logged to Event History. If the request is already in progress on the device, the playbook continues to run and a Playbook completed event is logged.

To deactivate the Playbooks policy:

1. Log in to the Secure Endpoint Console as a user with the Manage permission for Policies.
2. On the navigation bar, click Policies > Policy Groups.
3. On the Policy Groups sidebar, click the policy group that you want to update. The policy group opens in the work area.
4. Next to Playbooks, click the Activation slider to set it to Off.

   The policy is deactivated, and a Playbooks policy deactivated event is logged to Event History.

The device is deprovisioned after its next connection to the Absolute Monitoring Center.