Disk Size Management in Windows

If you are working with a Windows data disk or a Windows boot disk on which the HyTrust Bootloader is not installed, you can extend or shrink that disk as desired using your hypervisor tools. For encrypted data disks, you then need to update the disk size in KeyControl using the hcl extend command.

After you install the HyTrust Bootloader on a Windows boot disk, however, the associated boot partition must be extended using the following procedure even if you have not yet encrypted the boot disk.

Resizing an Encrypted Windows Data Disk

This is an online procedure, which means that the disk and its contents will remain available during the resize. However, you cannot resize a disk that is detached or that is in the process of being rekeyed.

Warning:

If you resize the disk with Windows Disk Manager, you may be prompted to convert from a basic disk into a dynamic disk. Windows dynamic disks are not supported. If you select this option, you will not be able to access this disk through DataControl and all existing data will be lost.

Resize the underlying disk using your hypervisor tools.
Log into the VM as a System Administrator and open a Command Prompt or start Windows PowerShell.

Enter the command hcl extend diskname, where diskname is the drive letter or folder mount you want to resize. For example:

C:\>hcl extend f:
extending partition for f:
extending filesystem for f:the new filesystem is 2146369536 bytes long

Tip: If the hcl extend command fails with the message that there are too many partitions on the disk, see Detecting and Removing a Windows Snapshot Partition.

Extending a Boot Partition After Installing the Bootloader

The Bootloader installation creates a new MBR partition labeled HTBOOTLDR immediately following the boot partition on the disk. If you want to extend the MBR boot partition at any time after you have installed the Bootloader, you need to make sure the unallocated space you want to use is immediately adjacent to the boot partition by extending the disk and then using the HyTrust-provided PowerShell script that moves the HTBOOTLDR partition to the end of the disk and then extends the boot partition into the unallocated space. (For details about the HyTrust Bootloader, see Windows Boot Drive Encryption.)

Important:

The VM will need to be rebooted twice during this procedure.

Extend the MBR disk containing the boot partition using your hypervisor tools.
Log into PowerShell on the Windows VM.
Locate the main Policy Agent installation directory. The PowerShiell scripts are located in the bin folder under this main directory. The default directory is C:\Program Files\hcs.

Run the PowerShell script MoveHTBootloader.ps1 by entering the command powershell -File "C:\hytrust-install-dir\MoveHTBootloader.ps1".

The script creates a new Bootloader partition at the end of the recently extended disk and reboots the virtual machine. On reboot, MoveHTBootloader.ps1 will again be executed automatically and will delete the old Bootloader partition and then extend the boot partition to take up the available free space. The VM will be rebooted a second time to complete this process.

Note: This operation changes the drive letter for the HTBOOTLDR drive. The original drive letter can be restored by either using the htblconf.exe GUI utility or the ChangeHTBootloaderDrive.ps1 PowerShell script.

If desired, log into the KeyControl webGUI and verify that the new boot drive size is displayed correctly. If it is not, go back to the Windows VM and enter the hcl updateavail command.