mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 05:47:23 +00:00
Metadata/style update BitLocker 2
This commit is contained in:
parent
a9dd8ff4db
commit
003220cc76
@ -9,15 +9,15 @@ metadata:
|
|||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: dansimp
|
author: frankroj
|
||||||
ms.author: dansimp
|
ms.author: frankroj
|
||||||
manager: aaroncz
|
manager: aaroncz
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection:
|
ms.collection:
|
||||||
- M365-security-compliance
|
- M365-security-compliance
|
||||||
- highpri
|
- highpri
|
||||||
ms.topic: faq
|
ms.topic: faq
|
||||||
ms.date: 02/28/2019
|
ms.date: 11/08/2022
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
title: BitLocker and Active Directory Domain Services (AD DS) FAQ
|
title: BitLocker and Active Directory Domain Services (AD DS) FAQ
|
||||||
summary: |
|
summary: |
|
||||||
@ -34,18 +34,18 @@ sections:
|
|||||||
answer: |
|
answer: |
|
||||||
Stored information | Description
|
Stored information | Description
|
||||||
-------------------|------------
|
-------------------|------------
|
||||||
Hash of the TPM owner password | Beginning with Windows 10, the password hash is not stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in.
|
Hash of the TPM owner password | Beginning with Windows 10, the password hash isn't stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in.
|
||||||
BitLocker recovery password | The recovery password allows you to unlock and access the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md).
|
BitLocker recovery password | The recovery password allows you to unlock and access the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md).
|
||||||
BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`.
|
BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`.
|
||||||
|
|
||||||
- question: |
|
- question: |
|
||||||
What if BitLocker is enabled on a computer before the computer has joined the domain?
|
What if BitLocker is enabled on a computer before the computer has joined the domain?
|
||||||
answer: |
|
answer: |
|
||||||
If BitLocker is enabled on a drive before Group Policy has been applied to enforce a backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS.
|
If BitLocker is enabled on a drive before Group Policy has been applied to enforce a backup, the recovery information won't be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS.
|
||||||
|
|
||||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||||
|
|
||||||
The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The `manage-bde` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt:
|
The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker doesn't automatically manage this process. The `manage-bde` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt:
|
||||||
|
|
||||||
```PowerShell
|
```PowerShell
|
||||||
$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive
|
$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive
|
||||||
@ -61,24 +61,24 @@ sections:
|
|||||||
- question: |
|
- question: |
|
||||||
Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup?
|
Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup?
|
||||||
answer: |
|
answer: |
|
||||||
Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it is also possible that the log entry could be spoofed.
|
Yes, an event log entry that indicates the success or failure of an Active Directory backup is recorded on the client computer. However, even if an event log entry says "Success," the information could have been subsequently removed from AD DS, or BitLocker could have been reconfigured in such a way that the Active Directory information can no longer unlock the drive (such as by removing the recovery password key protector). In addition, it's also possible that the log entry could be spoofed.
|
||||||
|
|
||||||
Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool.
|
Ultimately, determining whether a legitimate backup exists in AD DS requires querying AD DS with domain administrator credentials by using the BitLocker password viewer tool.
|
||||||
|
|
||||||
- question: |
|
- question: |
|
||||||
If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password?
|
If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password?
|
||||||
answer: |
|
answer: |
|
||||||
No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object.
|
No. By design, BitLocker recovery password entries don't get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object.
|
||||||
|
|
||||||
- question: |
|
- question: |
|
||||||
What happens if the backup initially fails? Will BitLocker retry it?
|
What happens if the backup initially fails? Will BitLocker retry it?
|
||||||
answer: |
|
answer: |
|
||||||
If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS.
|
If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker doesn't try again to back up the recovery information to AD DS.
|
||||||
|
|
||||||
When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization.
|
When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker can't be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization.
|
||||||
|
|
||||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||||
|
|
||||||
When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain-) to capture the information after connectivity is restored.
|
When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker won't automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain-) to capture the information after connectivity is restored.
|
||||||
|
|
||||||
|
|
||||||
|
@ -9,13 +9,13 @@ metadata:
|
|||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: dansimp
|
author: frankroj
|
||||||
ms.author: dansimp
|
ms.author: frankroj
|
||||||
manager: aaroncz
|
manager: aaroncz
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: faq
|
ms.topic: faq
|
||||||
ms.date: 02/28/2019
|
ms.date: 11/08/2022
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
title: BitLocker frequently asked questions (FAQ)
|
title: BitLocker frequently asked questions (FAQ)
|
||||||
summary: |
|
summary: |
|
||||||
|
@ -9,15 +9,15 @@ metadata:
|
|||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: dansimp
|
author: frankroj
|
||||||
ms.author: dansimp
|
ms.author: frankroj
|
||||||
manager: aaroncz
|
manager: aaroncz
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection:
|
ms.collection:
|
||||||
- M365-security-compliance
|
- M365-security-compliance
|
||||||
- highpri
|
- highpri
|
||||||
ms.topic: faq
|
ms.topic: faq
|
||||||
ms.date: 02/28/2019
|
ms.date: 11/08/2022
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
title: BitLocker frequently asked questions (FAQ) resources
|
title: BitLocker frequently asked questions (FAQ) resources
|
||||||
summary: |
|
summary: |
|
||||||
|
@ -9,13 +9,13 @@ metadata:
|
|||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: dansimp
|
author: frankroj
|
||||||
ms.author: dansimp
|
ms.author: frankroj
|
||||||
manager: aaroncz
|
manager: aaroncz
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: faq
|
ms.topic: faq
|
||||||
ms.date: 02/28/2019
|
ms.date: 11/08/2022
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
title: BitLocker Key Management FAQ
|
title: BitLocker Key Management FAQ
|
||||||
summary: |
|
summary: |
|
||||||
|
@ -7,13 +7,13 @@ metadata:
|
|||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: dansimp
|
author: frankroj
|
||||||
ms.author: dansimp
|
ms.author: frankroj
|
||||||
manager: aaroncz
|
manager: aaroncz
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: faq
|
ms.topic: faq
|
||||||
ms.date: 02/28/2019
|
ms.date: 11/08/2022
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
title: BitLocker Network Unlock FAQ
|
title: BitLocker Network Unlock FAQ
|
||||||
|
@ -9,15 +9,15 @@ metadata:
|
|||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: dansimp
|
author: frankroj
|
||||||
ms.author: dansimp
|
ms.author: frankroj
|
||||||
manager: aaroncz
|
manager: aaroncz
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection:
|
ms.collection:
|
||||||
- M365-security-compliance
|
- M365-security-compliance
|
||||||
- highpri
|
- highpri
|
||||||
ms.topic: faq
|
ms.topic: faq
|
||||||
ms.date: 07/27/2021
|
ms.date: 11/08/2022
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
title: BitLocker Overview and Requirements FAQ
|
title: BitLocker Overview and Requirements FAQ
|
||||||
summary: |
|
summary: |
|
||||||
|
@ -9,13 +9,13 @@ metadata:
|
|||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: dansimp
|
author: frankroj
|
||||||
ms.author: dansimp
|
ms.author: frankroj
|
||||||
manager: aaroncz
|
manager: aaroncz
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: faq
|
ms.topic: faq
|
||||||
ms.date: 03/14/2022
|
ms.date: 11/08/2022
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
title: BitLocker Security FAQ
|
title: BitLocker Security FAQ
|
||||||
summary: |
|
summary: |
|
||||||
|
@ -4,18 +4,18 @@ metadata:
|
|||||||
description: "Learn more about BitLocker To Go"
|
description: "Learn more about BitLocker To Go"
|
||||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
ms.author: dansimp
|
ms.author: frankroj
|
||||||
ms.prod: m365-security
|
ms.prod: m365-security
|
||||||
ms.mktglfcycl: deploy
|
ms.mktglfcycl: deploy
|
||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: dansimp
|
author: frankroj
|
||||||
manager: aaroncz
|
manager: aaroncz
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: faq
|
ms.topic: faq
|
||||||
ms.date: 07/10/2018
|
ms.date: 11/08/2022
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
title: BitLocker To Go FAQ
|
title: BitLocker To Go FAQ
|
||||||
summary: |
|
summary: |
|
||||||
|
@ -7,13 +7,13 @@ metadata:
|
|||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: dansimp
|
author: frankroj
|
||||||
ms.author: dansimp
|
ms.author: frankroj
|
||||||
manager: aaroncz
|
manager: aaroncz
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: faq
|
ms.topic: faq
|
||||||
ms.date: 02/28/2019
|
ms.date: 11/08/2022
|
||||||
ms.reviewer:
|
ms.reviewer:
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
title: BitLocker Upgrading FAQ
|
title: BitLocker Upgrading FAQ
|
||||||
|
@ -9,13 +9,13 @@ metadata:
|
|||||||
ms.sitesec: library
|
ms.sitesec: library
|
||||||
ms.pagetype: security
|
ms.pagetype: security
|
||||||
ms.localizationpriority: medium
|
ms.localizationpriority: medium
|
||||||
author: dansimp
|
author: frankroj
|
||||||
ms.author: dansimp
|
ms.author: frankroj
|
||||||
manager: aaroncz
|
manager: aaroncz
|
||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: faq
|
ms.topic: faq
|
||||||
ms.date: 02/28/2019
|
ms.date: 11/08/2022
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
title: Using BitLocker with other programs FAQ
|
title: Using BitLocker with other programs FAQ
|
||||||
summary: |
|
summary: |
|
||||||
|
@ -11,6 +11,7 @@ ms.reviewer: kaushika
|
|||||||
ms.collection: Windows Security Technologies\BitLocker
|
ms.collection: Windows Security Technologies\BitLocker
|
||||||
ms.topic: troubleshooting
|
ms.topic: troubleshooting
|
||||||
ms.custom: bitlocker
|
ms.custom: bitlocker
|
||||||
|
ms.date: 11/08/2022
|
||||||
---
|
---
|
||||||
|
|
||||||
# BitLocker network unlock: known issues
|
# BitLocker network unlock: known issues
|
||||||
|
Loading…
x
Reference in New Issue
Block a user