Virtual Architects Support Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Windows Bitlocker ======

**Bitlocker vs. EFS**: https://www.howtogeek.com/236719/whats-the-difference-between-bitlocker-and-efs-encrypting-file-system-on-windows/

**Auto Unlock**: https://petri.com/how-to-configure-bitlocker-auto-unlock

:!: Keep in mind that if enabled, and using the password option, you will not be able to access the PC via RDP if it is rebooted.

Bitlocker has been available since Windows Vista but only in Professional and Enterprise versions.

===== Control Panel =====

{{ :computing:security:bitlocker_control_panel.png?direct&650 |Bitlocker Control Panel Applet}}

===== CLI =====

==== Show Bitlocker Info ====

<file>
manage-bde -status
manage-bde -protectors -get e:
Get-BitLockerVolume
Get-BitlockerVolume -MountPoint "E:"
</file>

==== Enable Bitlocker ====

:!: These commands will allow you to specify a startup key on most any drive, not just USB drives.

:!: The ''-usedspaceonly'' switch is needed for thinly provisioned storage.

Add protectors and encrypt drive C:

<file>
manage-bde -protectors -add C: -recoverypassword -password -startupkey E:
manage-bde -status
manage-bde -on C: -usedspaceonly
</file>

==== Manage Bitlocker ====

Delete a protector:

<file>
manage-bde -protectors -delete c: -id {Protector-ID}
</file>

===== Bitlocker without TPM (Trusted Platform Module) =====

When enabling Bitlocker it will check to see if your computer has TPM.  If not, it will throw a message that you can use Bitlocker without it but need to change a Local Group Policy.

  - In the Windows 10 Search box type ''gpedit.msc'' and press Enter to start the Local Group Policy Editor.
  - Go to **Computer Configuration -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives**.
  - In the right-hand pane double-click **Require additional authentication at startup**.
  - Check the **Enabled** radio button and make sure that the box **Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)** box is checked. Then click OK. 

===== Enable Bitlocker =====

  - Login to your PC as administrator
  - Go to the File Explorer, right-click drive C and select Turn on BitLocker.
  - You are given a choice to either Insert a USB flash drive or Enter a password.
  - If you choose the option to insert a removable USB flash drive, it will save the startup key on the USB flash drive. This will be used to unlock the operating system drive after each reboot. NOTE: Unlike the recovery key, the startup key is not a text file. It has the file extension .BEK.
  - If you select the option to enter a password, you will enter the password and confirm it. Make sure you use a long, secure pass phrase. This password will be required each time the computer is rebooted.  
  - Next, you will be given several options for storing the recovery key.The easiest thing to do is to use the option Save to a file.
  - After you have saved the recovery key to a file, click Next.
  - If you are setting up BitLocker on a new drive, you only need to encrypt the part of drive that is being used. When you add additional data, BitLocker will automatically encrypt that data.
  - If you have already been using your computer for a while, select the second option Encrypt entire drive (Slower but best for PCs and drives already in use).
  - Depending on the size of the hard drive and the amount of data, the encryption process can take a long time so be patient.
  - You will be prompted to restart the computer. 
  - After the computer reboots, it will start encrypting the drive. You won’t see any progress bar unless you click the icon in the system tray for Bitlocker.

===== Change the Bitlocker Password =====

You may want to change the password that unlocks your hard drive for various reasons.  If you know the current password you can change it.  A minimum of 8 characters is required and a mixture of upper case, lower case, numeric and special characters is recommended.

:!: DO NOT FORGET YOUR NEW PASSWORD.

  - In File Explorer right click the drive that is encrypted.
  - Choose Change Bitlocker Password.
  - Enter the current password and then the new password twice.
  - Click Change Password.

====== FIPS 140-2 Compliance ======

**Install Bitlocker Feature**: https://abouconde.com/2019/05/20/encrypt-drives-with-bitlocker-on-windows-server-2019/

**Enable FIPS Compliance Policy**: https://blogs.oracle.com/cloud-infrastructure/windows-server-fips-compliance-v2

**Video Howto**: https://www.youtube.com/watch?v=Ujac3q_yBrc

====== Active Directory ======

<note tip>Use ''adsiedit.msc'' to delete keys from AD if they are no longer needed.</note>

{{ :computing:security:bitlocker_ad_1.png?direct&600|Bitlocker Info Stored in AD}}

**Group Policy Settings**: https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings

https://theitbros.com/config-active-directory-store-bitlocker-recovery-keys/

https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer

https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#active-directory-domain-services-considerations

https://www.rootusers.com/deploy-bitlocker-without-a-trusted-platform-module-tpm/

https://techdirectarchive.com/2020/12/30/backup-bitlocker-recovery-keys-to-ad-how-to-enable-bitlocker-via-the-local-group-policy-editor-and-the-group-policy-management-console-2/

https://www.experts-exchange.com/articles/33289/How-to-create-a-file-based-bitlocker-protector-for-recovery-and-support-purposes.html

<file>
Import-module ActiveDirectory
Get-ADObject -SearchBase ((GET-ADRootDSE).SchemaNamingContext) -Filter {Name -like 'ms-FVE-*'}
Get-ADComputer 'some-computer-name'| Get-ADObject -properties * | Select-Object distinguishedname, msFVE-REcoveryPassword, whencreated
</file>
Virtual Architects Support Wiki

User Tools

Site Tools

Page Tools
