Virtual Architects Support Wiki

User Tools

Site Tools

You are here: start » computing » security » windows_bitlocker
Trace: • freepbx_find_me_follow_me • virtualmin_spam_troubleshoot • zimbra_password_policy
computing:security:windows_bitlocker

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision 		Previous revision
computing:security:windows_bitlocker [2021/05/13 11:29]
gcooper 		computing:security:windows_bitlocker [2021/05/13 14:38] (current)
gcooper
Line 8: Line 8:
  
 Bitlocker has been available since Windows Vista but only in Professional and Enterprise versions. Bitlocker has been available since Windows Vista but only in Professional and Enterprise versions.
 +
 +===== Control Panel =====
 +
 +{{ :computing:security:bitlocker_control_panel.png?direct&650 |Bitlocker Control Panel Applet}}
  
 ===== CLI ===== ===== CLI =====
Line 19: Line 23:
 Get-BitlockerVolume -MountPoint "E:" Get-BitlockerVolume -MountPoint "E:"
 </file> </file>
- 
-{{ :computing:security:bitlocker_control_panel.png?direct&650 |Bitlocker Control Panel Applet}} 
  
 ==== Enable Bitlocker ==== ==== Enable Bitlocker ====
  
 :!: These commands will allow you to specify a startup key on most any drive, not just USB drives. :!: These commands will allow you to specify a startup key on most any drive, not just USB drives.
 +
 +:!: The ''-usedspaceonly'' switch is needed for thinly provisioned storage.
  
 Add protectors and encrypt drive C: Add protectors and encrypt drive C:
  
 <file> <file>
-manage-bde -protectors -add C: -recoverypassword --startupkey E: +manage-bde -protectors -add C: -recoverypassword -password -startupkey E: 
-manage-bde -protectors -add C: -password +manage-bde -status 
-manage-bde -on C:+manage-bde -on C: -usedspaceonly
 </file> </file>
  
Line 46: Line 50:
 When enabling Bitlocker it will check to see if your computer has TPM.  If not, it will throw a message that you can use Bitlocker without it but need to change a Local Group Policy. When enabling Bitlocker it will check to see if your computer has TPM.  If not, it will throw a message that you can use Bitlocker without it but need to change a Local Group Policy.
  
-  - In the Windows 10 Search box type gpedit.msc and press Enter to start the Local Group Policy Editor. +  - In the Windows 10 Search box type ''gpedit.msc'' and press Enter to start the Local Group Policy Editor. 
-  - Go to Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives. +  - Go to **Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives**. 
-  - In the right-hand pane double-click Require additional authentication at startup. +  - In the right-hand pane double-click **Require additional authentication at startup**. 
-  - Check the Enabled radio button and make sure that the box Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive) box is checked. Then click OK. +  - Check the **Enabled** radio button and make sure that the box **Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)** box is checked. Then click OK. 
  
 ===== Enable Bitlocker ===== ===== Enable Bitlocker =====
Line 86: Line 90:
  
 ====== Active Directory ====== ====== Active Directory ======
 +
 +<note tip>Use ''adsiedit.msc'' to delete keys from AD if they are no longer needed.</note>
  
 {{ :computing:security:bitlocker_ad_1.png?direct&600|Bitlocker Info Stored in AD}} {{ :computing:security:bitlocker_ad_1.png?direct&600|Bitlocker Info Stored in AD}}
Line 102: Line 108:
  
 https://www.experts-exchange.com/articles/33289/How-to-create-a-file-based-bitlocker-protector-for-recovery-and-support-purposes.html https://www.experts-exchange.com/articles/33289/How-to-create-a-file-based-bitlocker-protector-for-recovery-and-support-purposes.html
 +
 +<file>
 +Import-module ActiveDirectory
 +Get-ADObject -SearchBase ((GET-ADRootDSE).SchemaNamingContext) -Filter {Name -like 'ms-FVE-*'}
 +Get-ADComputer 'some-computer-name'| Get-ADObject -properties * | Select-Object distinguishedname, msFVE-REcoveryPassword, whencreated
 +</file>
computing/security/windows_bitlocker.1620926989.txt.gz · Last modified: 2021/05/13 11:29 by gcooper

Page Tools

Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki