mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-21 21:33:38 +00:00
Merge branch 'master' into v-smandalika-rcvy-issues-4491111
This commit is contained in:
Daniel Simpson
GitHub
@ -29,16 +29,16 @@ ms.custom: bitlocker
|
||||
Stored information | Description
|
||||
-------------------|------------
|
||||
Hash of the TPM owner password | Beginning with Windows 10, the password hash is not stored in AD DS by default. The password hash can be stored only if the TPM is owned and the ownership was taken by using components of Windows 8.1 or earlier, such as the BitLocker Setup Wizard or the TPM snap-in.
|
||||
BitLocker recovery password | The recovery password allows you to unlock and access the drive in the event of a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md).
|
||||
BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, Repair-bde.
|
||||
BitLocker recovery password | The recovery password allows you to unlock and access the drive after a recovery incident. Domain administrators can view the BitLocker recovery password by using the BitLocker Recovery Password Viewer. For more information about this tool, see [BitLocker: Use BitLocker Recovery Password Viewer](bitlocker-use-bitlocker-recovery-password-viewer.md).
|
||||
BitLocker key package | The key package helps to repair damage to the hard disk that would otherwise prevent standard recovery. Using the key package for recovery requires the BitLocker Repair Tool, `Repair-bde`.
|
||||
|
||||
## What if BitLocker is enabled on a computer before the computer has joined the domain?
|
||||
|
||||
If BitLocker is enabled on a drive before Group Policy has been applied to enforce backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered** and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require that the computer be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS.
|
||||
If BitLocker is enabled on a drive before Group Policy has been applied to enforce a backup, the recovery information will not be automatically backed up to AD DS when the computer joins the domain or when Group Policy is subsequently applied. However, you can use the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed drives can be recovered**, and **Choose how BitLocker-protected removable drives can be recovered** Group Policy settings to require the computer to be connected to a domain before BitLocker can be enabled to help ensure that recovery information for BitLocker-protected drives in your organization is backed up to AD DS.
|
||||
|
||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt:
|
||||
The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The `manage-bde` command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt:
|
||||
|
||||
```PowerShell
|
||||
$BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive
|
||||
@ -61,13 +61,13 @@ Ultimately, determining whether a legitimate backup exists in AD DS requires qu
|
||||
|
||||
No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object.
|
||||
|
||||
## What happens if the backup initially fails? Will BitLocker retry the backup?
|
||||
## What happens if the backup initially fails? Will BitLocker retry it?
|
||||
|
||||
If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS.
|
||||
|
||||
When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, **Choose how BitLocker-protected removable data drives can be recovered** policy settings, this prevents users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization.
|
||||
When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, and **Choose how BitLocker-protected removable data drives can be recovered** policy settings, users can't enable BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization.
|
||||
|
||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a script for the backup, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored.
|
||||
When an administrator clears these check boxes, the administrator is allowing a drive to be BitLocker-protected without having the recovery information successfully backed up to AD DS; however, BitLocker will not automatically retry the backup if it fails. Instead, administrators can create a backup script, as described earlier in [What if BitLocker is enabled on a computer before the computer has joined the domain?](#what-if-bitlocker-is-enabled-on-a-computer-before-the-computer-has-joined-the-domain) to capture the information after connectivity is restored.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker basic deployment (Windows 10)
|
||||
description: This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption.
|
||||
description: This article for the IT professional explains how BitLocker features can be used to protect your data through drive encryption.
|
||||
ms.assetid: 97c646cb-9e53-4236-9678-354af41151c4
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
@ -24,7 +24,7 @@ ms.custom: bitlocker
|
||||
|
||||
- Windows 10
|
||||
|
||||
This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption.
|
||||
This article for the IT professional explains how BitLocker features can be used to protect your data through drive encryption.
|
||||
|
||||
## Using BitLocker to encrypt volumes
|
||||
|
||||
@ -39,12 +39,12 @@ BitLocker encryption can be done using the following methods:
|
||||
|
||||
- BitLocker control panel
|
||||
- Windows Explorer
|
||||
- manage-bde command line interface
|
||||
- manage-bde command-line interface
|
||||
- BitLocker Windows PowerShell cmdlets
|
||||
|
||||
### Encrypting volumes using the BitLocker control panel
|
||||
|
||||
Encrypting volumes with the BitLocker control panel (click **Start**, type **bitlocker**, click **Manage BitLocker**) is how many users will utilize BitLocker. The name of the BitLocker control panel is BitLocker Drive Encryption. The BitLocker control panel supports encrypting operating system, fixed data and removable data volumes. The BitLocker control panel will organize available drives in the appropriate category based on how the device reports itself to Windows. Only formatted volumes with assigned drive letters will appear properly in the BitLocker control panel applet.
|
||||
Encrypting volumes with the BitLocker control panel (select **Start**, type *bitlocker*, select **Manage BitLocker**) is how many users will utilize BitLocker. The name of the BitLocker control panel is BitLocker Drive Encryption. The BitLocker control panel supports encrypting operating system, fixed data, and removable data volumes. The BitLocker control panel will organize available drives in the appropriate category based on how the device reports itself to Windows. Only formatted volumes with assigned drive letters will appear properly in the BitLocker control panel applet.
|
||||
To start encryption for a volume, select **Turn on BitLocker** for the appropriate drive to initialize the BitLocker Drive Encryption Wizard. BitLocker Drive Encryption Wizard options vary based on volume type (operating system volume or data volume).
|
||||
|
||||
### Operating system volume
|
||||
@ -54,7 +54,7 @@ Upon launch, the BitLocker Drive Encryption Wizard verifies the computer meets t
|
||||
|Requirement|Description|
|
||||
|--- |--- |
|
||||
|Hardware configuration|The computer must meet the minimum requirements for the supported Windows versions.|
|
||||
|Operating system|BitLocker is an optional feature which can be installed by Server Manager on Windows Server 2012 and later.|
|
||||
|Operating system|BitLocker is an optional feature that can be installed by Server Manager on Windows Server 2012 and later.|
|
||||
|Hardware TPM|TPM version 1.2 or 2.0. <p> A TPM is not required for BitLocker; however, only a computer with a TPM can provide the additional security of pre-startup system integrity verification and multifactor authentication.|
|
||||
|BIOS configuration|<li> A Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware.</li> <li> The boot order must be set to start first from the hard disk, and not the USB or CD drives.</li> <li> The firmware must be able to read from a USB flash drive during startup.</li>|
|
||||
|File system|For computers that boot natively with UEFI firmware, at least one FAT32 partition for the system drive and one NTFS partition for the operating system drive. <br/> For computers with legacy BIOS firmware, at least two NTFS disk partitions, one for the system drive and one for the operating system drive. <br/> For either firmware, the system drive partition must be at least 350 megabytes (MB) and set as the active partition.|
|
||||
@ -75,11 +75,11 @@ It is recommended that drives with little to no data utilize the **used disk spa
|
||||
> [!NOTE]
|
||||
> Deleted files appear as free space to the file system, which is not encrypted by **used disk space only**. Until they are wiped or overwritten, deleted files hold information that could be recovered with common data forensic tools.
|
||||
|
||||
Selecting an encryption type and choosing **Next** will give the user the option of running a BitLocker system check (selected by default) which will ensure that BitLocker can properly access the recovery and encryption keys before the volume encryption begins. It is recommended to run this system check before starting the encryption process. If the system check is not run and a problem is encountered when the operating system attempts to start, the user will need to provide the recovery key to start Windows.
|
||||
Selecting an encryption type and choosing **Next** will give the user the option of running a BitLocker system check (selected by default) which will ensure that BitLocker can properly access the recovery and encryption keys before the volume encryption begins. We recommend running this system check before starting the encryption process. If the system check is not run and a problem is encountered when the operating system attempts to start, the user will need to provide the recovery key to start Windows.
|
||||
|
||||
After completing the system check (if selected), the BitLocker Drive Encryption Wizard will restart the computer to begin encryption. Upon reboot, users are required to enter the password chosen to boot into the operating system volume. Users can check encryption status by checking the system notification area or the BitLocker control panel.
|
||||
|
||||
Until encryption is completed, the only available options for managing BitLocker involve manipulation of the password protecting the operating system volume, backing up the recovery key, and turning BitLocker off.
|
||||
Until encryption is completed, the only available options for managing BitLocker involve manipulation of the password protecting the operating system volume, backing up the recovery key, and turning off BitLocker.
|
||||
|
||||
### Data volume
|
||||
|
||||
@ -97,12 +97,12 @@ Encryption status displays in the notification area or within the BitLocker cont
|
||||
|
||||
There is a new option for storing the BitLocker recovery key using the OneDrive. This option requires that computers are not members of a domain and that the user is using a Microsoft Account. Local accounts do not give the option to utilize OneDrive. Using the OneDrive option is the default, recommended recovery key storage method for computers that are not joined to a domain.
|
||||
|
||||
Users can verify the recovery key was saved properly by checking their OneDrive for the BitLocker folder which is created automatically during the save process. The folder will contain two files, a readme.txt and the recovery key. For users storing more than one recovery password on their OneDrive,
|
||||
Users can verify the recovery key was saved properly by checking their OneDrive for the BitLocker folder that is created automatically during the save process. The folder will contain two files, a readme.txt and the recovery key. For users storing more than one recovery password on their OneDrive,
|
||||
they can identify the required recovery key by looking at the file name. The recovery key ID is appended to the end of the file name.
|
||||
|
||||
### Using BitLocker within Windows Explorer
|
||||
|
||||
Windows Explorer allows users to launch the BitLocker Drive Encryption wizard by right clicking on a volume and selecting **Turn On BitLocker**. This option is available on client computers by default. On servers, you must first install the BitLocker and Desktop-Experience features for this option to be available. After selecting **Turn on BitLocker**, the wizard works exactly as it does when launched using the BitLocker control panel.
|
||||
Windows Explorer allows users to launch the BitLocker Drive Encryption wizard by right-clicking a volume and selecting **Turn On BitLocker**. This option is available on client computers by default. On servers, you must first install the BitLocker and Desktop-Experience features for this option to be available. After selecting **Turn on BitLocker**, the wizard works exactly as it does when launched using the BitLocker control panel.
|
||||
|
||||
## <a href="" id="bkmk-dep2"></a>Down-level compatibility
|
||||
|
||||
@ -118,13 +118,13 @@ Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Window
|
||||
|Fully encrypted volume from Windows 7|Presents as fully encrypted|Presented as fully encrypted|N/A|
|
||||
|Partially encrypted volume from Windows 7|Windows 10 and Windows 8.1 will complete encryption regardless of policy|Windows 8 will complete encryption regardless of policy|N/A|
|
||||
|
||||
## <a href="" id="bkmk-dep3"></a>Encrypting volumes using the manage-bde command line interface
|
||||
## <a href="" id="bkmk-dep3"></a>Encrypting volumes using the manage-bde command-line interface
|
||||
|
||||
Manage-bde is a command-line utility that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the options, see [Manage-bde](/windows-server/administration/windows-commands/manage-bde).
|
||||
|
||||
Manage-bde offers a multitude of wider options for configuring BitLocker. This means that using the command syntax may require care and possibly later customization by the user. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected.
|
||||
Manage-bde offers a multitude of wider options for configuring BitLocker. So using the command syntax may require care and possibly later customization by the user. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected.
|
||||
|
||||
Command line users need to determine the appropriate syntax for a given situation. The following section covers general encryption for operating system volumes and data volumes.
|
||||
Command-line users need to determine the appropriate syntax for a given situation. The following section covers general encryption for operating system volumes and data volumes.
|
||||
|
||||
### Operating system volume
|
||||
|
||||
@ -136,7 +136,7 @@ A good practice when using manage-bde is to determine the volume status on the t
|
||||
|
||||
`manage-bde -status`
|
||||
|
||||
This command returns the volumes on the target, current encryption status and volume type (operating system or data) for each volume. Using this information, users can determine the best encryption method for their environment.
|
||||
This command returns the volumes on the target, current encryption status, and volume type (operating system or data) for each volume. Using this information, users can determine the best encryption method for their environment.
|
||||
|
||||
**Enabling BitLocker without a TPM**
|
||||
|
||||
@ -149,29 +149,29 @@ manage-bde -on C:
|
||||
|
||||
**Enabling BitLocker with a TPM only**
|
||||
|
||||
It is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is:
|
||||
It is possible to encrypt the operating system volume without any defined protectors by using manage-bde. Use this command:
|
||||
|
||||
`manage-bde -on C:`
|
||||
|
||||
This will encrypt the drive using the TPM as the protector. If a user is unsure of the protector for a volume, they can use the -protectors option in manage-bde to list this information with the command:
|
||||
This command will encrypt the drive using the TPM as the protector. If a user is unsure of the protector for a volume, they can use the -protectors option in manage-bde to list this information with the command:
|
||||
|
||||
`manage-bde -protectors -get <volume>`
|
||||
|
||||
**Provisioning BitLocker with two protectors**
|
||||
|
||||
Another example is a user on non-TPM hardware who wishes to add a password and SID-based protector to the operating system volume. In this instance, the user adds the protectors first. This is done with the command:
|
||||
Another example is a user on non-TPM hardware who wishes to add a password and SID-based protector to the operating system volume. In this instance, the user adds the protectors first. Use this command:
|
||||
|
||||
`manage-bde -protectors -add C: -pw -sid <user or group>`
|
||||
|
||||
This command will require the user to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, the user just needs to turn BitLocker on.
|
||||
This command will require the user to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, the user just needs to turn on BitLocker.
|
||||
|
||||
### Data volume
|
||||
|
||||
Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on <drive letter>` or users can choose to add protectors to the volume. It is recommended that at least one primary protector and a recovery protector be added to a data volume.
|
||||
Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on <drive letter>` or users can choose to add protectors to the volume. We recommend that you add at least one primary protector and a recovery protector to a data volume.
|
||||
|
||||
**Enabling BitLocker with a password**
|
||||
|
||||
A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on.
|
||||
A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn on BitLocker.
|
||||
|
||||
```powershell
|
||||
manage-bde -protectors -add -pw C:
|
||||
@ -322,7 +322,7 @@ Occasionally, all protectors may not be shown when using **Get-BitLockerVolume**
|
||||
Get-BitLockerVolume C: | fl
|
||||
```
|
||||
|
||||
If you wanted to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this requires the GUID associated with the protector to be removed.
|
||||
If you want to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the `Remove-BitLockerKeyProtector` cmdlet. Accomplishing this task requires the GUID associated with the protector to be removed.
|
||||
A simple script can pipe the values of each **Get-BitLockerVolume** return out to another variable as seen below:
|
||||
|
||||
```powershell
|
||||
@ -330,7 +330,7 @@ $vol = Get-BitLockerVolume
|
||||
$keyprotectors = $vol.KeyProtector
|
||||
```
|
||||
|
||||
Using this, we can display the information in the **$keyprotectors** variable to determine the GUID for each protector.
|
||||
Using this script, we can display the information in the **$keyprotectors** variable to determine the GUID for each protector.
|
||||
Using this information, we can then remove the key protector for a specific volume using the command:
|
||||
|
||||
```powershell
|
||||
@ -343,7 +343,8 @@ Remove-BitLockerKeyProtector <volume>: -KeyProtectorID "{GUID}"
|
||||
### Operating system volume
|
||||
|
||||
Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes. Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them using the BitLocker cmdlets for Windows PowerShell.
|
||||
To enable BitLocker with just the TPM protector. This can be done using the command:
|
||||
|
||||
To enable BitLocker with just the TPM protector, use this command:
|
||||
|
||||
```powershell
|
||||
Enable-BitLocker C:
|
||||
@ -357,7 +358,7 @@ Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath <path> -SkipHardwareTes
|
||||
|
||||
### Data volume
|
||||
|
||||
Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user defined password. Last, encryption begins.
|
||||
Data volume encryption using Windows PowerShell is the same as for operating system volumes. Add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a SecureString value to store the user-defined password. Last, encryption begins.
|
||||
|
||||
```powershell
|
||||
$pw = Read-Host -AsSecureString
|
||||
@ -365,14 +366,14 @@ $pw = Read-Host -AsSecureString
|
||||
Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw
|
||||
```
|
||||
|
||||
### Using a SID based protector in Windows PowerShell
|
||||
### Using a SID-based protector in Windows PowerShell
|
||||
|
||||
The ADAccountOrGroup protector is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover and be unlocked to any member computer of the cluster.
|
||||
The ADAccountOrGroup protector is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly fail over and be unlocked to any member computer of the cluster.
|
||||
|
||||
> [!WARNING]
|
||||
> The SID-based protector requires the use of an additional protector (such as TPM, PIN, recovery key, etc.) when used on operating system volumes.
|
||||
|
||||
To add an ADAccountOrGroup protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G.
|
||||
To add an ADAccountOrGroup protector to a volume, you need either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G.
|
||||
|
||||
```powershell
|
||||
Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator
|
||||
@ -389,7 +390,7 @@ Get-ADUser -filter {samaccountname -eq "administrator"}
|
||||
>
|
||||
> **Tip:** In addition to the Windows PowerShell command above, information about the locally logged on user and group membership can be found using: WHOAMI /ALL. This does not require the use of additional features.
|
||||
|
||||
In the example below, the user wishes to add a domain SID based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command:
|
||||
In the example below, the user wishes to add a domain SID-based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command:
|
||||
|
||||
```powershell
|
||||
Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup "<SID>"
|
||||
@ -400,7 +401,7 @@ Add-BitLockerKeyProtector C: -ADAccountOrGroupProtector -ADAccountOrGroup "<SID>
|
||||
|
||||
## <a href="" id="bkmk-dep5"></a> Checking BitLocker status
|
||||
|
||||
To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We will look at each of the available methods in the following section.
|
||||
To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command-line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We will look at each of the available methods in the following section.
|
||||
|
||||
### Checking BitLocker status with the control panel
|
||||
|
||||
@ -421,7 +422,7 @@ Once BitLocker protector activation is completed, the completion notice is displ
|
||||
|
||||
### Checking BitLocker status with manage-bde
|
||||
|
||||
Administrators who prefer a command line interface can utilize manage-bde to check volume status. Manage-bde is capable of returning more information about the volume than the graphical user interface tools in the control panel. For example, manage-bde can display the BitLocker version in use, the encryption type, and the protectors associated with a volume.
|
||||
Administrators who prefer a command-line interface can utilize manage-bde to check volume status. Manage-bde is capable of returning more information about the volume than the graphical user interface tools in the control panel. For example, manage-bde can display the BitLocker version in use, the encryption type, and the protectors associated with a volume.
|
||||
|
||||
To check the status of a volume using manage-bde, use the following command:
|
||||
|
||||
@ -446,7 +447,7 @@ This command will display information about the encryption method, volume type,
|
||||
|
||||
### Provisioning BitLocker during operating system deployment
|
||||
|
||||
Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment. This is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option described later in this document, this step takes only a few seconds and incorporates well into regular deployment processes.
|
||||
Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation Environment. This task is done with a randomly generated clear key protector applied to the formatted volume and encrypting the volume prior to running the Windows setup process. If the encryption uses the Used Disk Space Only option described later in this document, this step takes only a few seconds and incorporates well into regular deployment processes.
|
||||
|
||||
### Decrypting BitLocker volumes
|
||||
|
||||
@ -461,9 +462,9 @@ The control panel does not report decryption progress but displays it in the not
|
||||
|
||||
Once decryption is complete, the drive will update its status in the control panel and is available for encryption.
|
||||
|
||||
### Decrypting volumes using the manage-bde command line interface
|
||||
### Decrypting volumes using the manage-bde command-line interface
|
||||
|
||||
Decrypting volumes using manage-bde is very straightforward. Decryption with manage-bde offers the advantage of not requiring user confirmation to start the process. Manage-bde uses the -off command to start the decryption process. A sample command for decryption is:
|
||||
Decrypting volumes using manage-bde is straightforward. Decryption with manage-bde offers the advantage of not requiring user confirmation to start the process. Manage-bde uses the -off command to start the decryption process. A sample command for decryption is:
|
||||
|
||||
```powershell
|
||||
manage-bde -off C:
|
||||
|
||||
@ -37,7 +37,7 @@ Generally it imposes a single-digit percentage performance overhead.
|
||||
|
||||
## How long will initial encryption take when BitLocker is turned on?
|
||||
|
||||
Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting very large drives, you may want to set encryption to occur during times when you will not be using the drive.
|
||||
Although BitLocker encryption occurs in the background while you continue to work, and the system remains usable, encryption times vary depending on the type of drive that is being encrypted, the size of the drive, and the speed of the drive. If you are encrypting large drives, you may want to set encryption to occur during times when you will not be using the drive.
|
||||
|
||||
You can also choose whether or not BitLocker should encrypt the entire drive or just the used space on the drive when you turn on BitLocker. On a new hard drive, encrypting just the used spaced can be considerably faster than encrypting the entire drive. When this encryption option is selected, BitLocker automatically encrypts data as it is saved, ensuring that no data is stored unencrypted.
|
||||
|
||||
@ -82,11 +82,11 @@ The TPM is not involved in any recovery scenarios, so recovery is still possible
|
||||
|
||||
## What can prevent BitLocker from binding to PCR 7?
|
||||
|
||||
This happens if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it.
|
||||
BitLocker can be prevented from binding to PCR 7 if a non-Windows OS booted prior to Windows, or if Secure Boot is not available to the device, either because it has been disabled or the hardware does not support it.
|
||||
|
||||
## Can I swap hard disks on the same computer if BitLocker is enabled on the operating system drive?
|
||||
|
||||
Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive, so if you want to prepare a backup operating system or data drive for use in case of disk failure, you need to make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts.
|
||||
Yes, you can swap multiple hard disks on the same computer if BitLocker is enabled, but only if the hard disks were BitLocker-protected on the same computer. The BitLocker keys are unique to the TPM and operating system drive. So if you want to prepare a backup operating system or data drive in case a disk fails, make sure that they were matched with the correct TPM. You can also configure different hard drives for different operating systems and then enable BitLocker on each one with different authentication methods (such as one with TPM-only and one with TPM+PIN) without any conflicts.
|
||||
|
||||
## Can I access my BitLocker-protected drive if I insert the hard disk into a different computer?
|
||||
|
||||
|
||||
@ -62,7 +62,7 @@ A computer with a TPM must also have a Trusted Computing Group (TCG)-compliant B
|
||||
The system BIOS or UEFI firmware (for TPM and non-TPM computers) must support the USB mass storage device class, including reading small files on a USB flash drive in the pre-operating system environment.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://blogs.technet.microsoft.com/tip_of_the_day/2014/01/22/tip-of-the-day-bitlocker-without-tpm-or-usb/).
|
||||
> From Windows 7, you can encrypt an OS drive without a TPM and USB flash drive. For this procedure, see [Tip of the Day: Bitlocker without TPM or USB](https://social.technet.microsoft.com/Forums/en-US/eac2cc67-8442-42db-abad-2ed173879751/bitlocker-without-tpm?forum=win10itprosetup).
|
||||
|
||||
> [!NOTE]
|
||||
> TPM 2.0 is not supported in Legacy and CSM Modes of the BIOS. Devices with TPM 2.0 must have their BIOS mode configured as Native UEFI only. The Legacy and Compatibility Support Module (CSM) options must be disabled. For added security Enable the Secure Boot feature.
|
||||
@ -74,6 +74,8 @@ The hard disk must be partitioned with at least two drives:
|
||||
- The operating system drive (or boot drive) contains the operating system and its support files. It must be formatted with the NTFS file system.
|
||||
- The system drive contains the files that are needed to load Windows after the firmware has prepared the system hardware. BitLocker is not enabled on this drive. For BitLocker to work, the system drive must not be encrypted, must differ from the operating system drive, and must be formatted with the FAT32 file system on computers that use UEFI-based firmware or with the NTFS file system on computers that use BIOS firmware. We recommend that system drive be approximately 350 MB in size. After BitLocker is turned on it should have approximately 250 MB of free space.
|
||||
|
||||
A fixed data volume or removable data volume cannot be marked as an active partition.
|
||||
|
||||
When installed on a new computer, Windows will automatically create the partitions that are required for BitLocker.
|
||||
|
||||
When installing the BitLocker optional component on a server you will also need to install the Enhanced Storage feature, which is used to support hardware encrypted drives.
|
||||
@ -98,4 +100,3 @@ When installing the BitLocker optional component on a server you will also need
|
||||
| [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)| This topic for IT pros describes how to protect CSVs and SANs with BitLocker.|
|
||||
| [Enabling Secure Boot and BitLocker Device Encryption on Windows 10 IoT Core](https://developer.microsoft.com/windows/iot/docs/securebootandbitlocker) | This topic covers how to use BitLocker with Windows 10 IoT Core |
|
||||
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker recovery guide (Windows 10)
|
||||
description: This topic for IT professionals describes how to recover BitLocker keys from AD DS.
|
||||
description: This article for IT professionals describes how to recover BitLocker keys from AD DS.
|
||||
ms.assetid: d0f722e9-1773-40bf-8456-63ee7a95ea14
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
@ -20,11 +20,11 @@ ms.custom: bitlocker
|
||||
|
||||
# BitLocker recovery guide
|
||||
|
||||
**Applies to**
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows 10
|
||||
|
||||
This topic for IT professionals describes how to recover BitLocker keys from AD DS.
|
||||
This article for IT professionals describes how to recover BitLocker keys from AD DS.
|
||||
|
||||
Organizations can use BitLocker recovery information saved in Active Directory Domain Services (AD DS) to access BitLocker-protected data. Creating a recovery model for BitLocker while you are planning your BitLocker deployment is recommended.
|
||||
|
||||
@ -32,56 +32,58 @@ This article assumes that you understand how to set up AD DS to back up BitLock
|
||||
|
||||
This article does not detail how to configure AD DS to store the BitLocker recovery information.
|
||||
|
||||
|
||||
## <a href="" id="bkmk-whatisrecovery"></a>What is BitLocker recovery?
|
||||
|
||||
BitLocker recovery is the process by which you can restore access to a BitLocker-protected drive in the event that you cannot unlock the drive normally. In a recovery scenario, you have the following options to restore access to the drive:
|
||||
|
||||
- The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online. (Saving a recovery password with your Microsoft Account online is only allowed when BitLocker is used on a PC that is not a member of a domain).
|
||||
- A data recovery agent can use their credentials to unlock the drive. If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it.
|
||||
- A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive. Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in their organization if needed. This method requires that you have enabled this recovery method in the BitLocker Group Policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
- The user can supply the recovery password. If your organization allows users to print or store recovery passwords, the user can type in the 48-digit recovery password that they printed or stored on a USB drive or with your Microsoft Account online. (Saving a recovery password with your Microsoft Account online is only allowed when BitLocker is used on a PC that is not a member of a domain).
|
||||
- A data recovery agent can use their credentials to unlock the drive. If the drive is an operating system drive, the drive must be mounted as a data drive on another computer for the data recovery agent to unlock it.
|
||||
- A domain administrator can obtain the recovery password from AD DS and use it to unlock the drive. Storing recovery passwords in AD DS is recommended to provide a way for IT professionals to be able to obtain recovery passwords for drives in their organization if needed. This method requires that you have enabled this recovery method in the BitLocker Group Policy setting **Choose how BitLocker-protected operating system drives can be recovered** located at **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** in the Local Group Policy Editor. For more information, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
|
||||
### What causes BitLocker recovery?
|
||||
|
||||
The following list provides examples of specific events that will cause BitLocker to enter recovery mode when attempting to start the operating system drive:
|
||||
|
||||
- On PCs that use BitLocker Drive Encryption, or on devices such as tablets or phones that use [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md) only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality Administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor, or use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](/Exchange/clients/exchange-activesync/exchange-activesync) (also configurable through [Microsoft Intune](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/microsoft-intune)), to limit the number of failed password attempts before the device goes into Device Lockout.
|
||||
- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised.
|
||||
- Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD.
|
||||
- Failing to boot from a network drive before booting from the hard drive.
|
||||
- Docking or undocking a portable computer. In some instances (depending on the computer manufacturer and the BIOS), the docking condition of the portable computer is part of the system measurement and must be consistent to validate the system status and unlock BitLocker. This means that if a portable computer is connected to its docking station when BitLocker is turned on, then it might also need to be connected to the docking station when it is unlocked. Conversely, if a portable computer is not connected to its docking station when BitLocker is turned on, then it might need to be disconnected from the docking station when it is unlocked.
|
||||
- Changes to the NTFS partition table on the disk including creating, deleting, or resizing a primary partition.
|
||||
- Entering the personal identification number (PIN) incorrectly too many times so that the anti-hammering logic of the TPM is activated. Anti-hammering logic is software or hardware methods that increase the difficulty and cost of a brute force attack on a PIN by not accepting PIN entries until after a certain amount of time has passed.
|
||||
- Turning off the support for reading the USB device in the pre-boot environment from the BIOS or UEFI firmware if you are using USB-based keys instead of a TPM.
|
||||
- Turning off, disabling, deactivating, or clearing the TPM.
|
||||
- Upgrading critical early startup components, such as a BIOS or UEFI firmware upgrade, causing the related boot measurements to change.
|
||||
- Forgetting the PIN when PIN authentication has been enabled.
|
||||
- Updating option ROM firmware.
|
||||
- Upgrading TPM firmware.
|
||||
- Adding or removing hardware; for example, inserting a new card in the computer, including some PCMIA wireless cards.
|
||||
- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer.
|
||||
- Changes to the master boot record on the disk.
|
||||
- Changes to the boot manager on the disk.
|
||||
- Hiding the TPM from the operating system. Some BIOS or UEFI settings can be used to prevent the enumeration of the TPM to the operating system. When implemented, this option can make the TPM hidden from the operating system. When the TPM is hidden, BIOS and UEFI secure startup are disabled, and the TPM does not respond to commands from any software.
|
||||
- Using a different keyboard that does not correctly enter the PIN or whose keyboard map does not match the keyboard map assumed by the pre-boot environment. This can prevent the entry of enhanced PINs.
|
||||
- Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change.
|
||||
- On PCs that use BitLocker Drive Encryption, or on devices such as tablets or phones that use [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md) only, when an attack is detected, the device will immediately reboot and enter into BitLocker recovery mode. To take advantage of this functionality, administrators can set the **Interactive logon: Machine account lockout threshold** Group Policy setting located in **\\Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options** in the Local Group Policy Editor. Or they can use the **MaxFailedPasswordAttempts** policy of [Exchange ActiveSync](/Exchange/clients/exchange-activesync/exchange-activesync) (also configurable through [Microsoft Intune](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/microsoft-intune)), to limit the number of failed password attempts before the device goes into Device Lockout.
|
||||
- On devices with TPM 1.2, changing the BIOS or firmware boot device order causes BitLocker recovery. However, devices with TPM 2.0 do not start BitLocker recovery in this case. TPM 2.0 does not consider a firmware change of boot device order as a security threat because the OS Boot Loader is not compromised.
|
||||
- Having the CD or DVD drive before the hard drive in the BIOS boot order and then inserting or removing a CD or DVD.
|
||||
- Failing to boot from a network drive before booting from the hard drive.
|
||||
- Docking or undocking a portable computer. In some instances (depending on the computer manufacturer and the BIOS), the docking condition of the portable computer is part of the system measurement and must be consistent to validate the system status and unlock BitLocker. So if a portable computer is connected to its docking station when BitLocker is turned on, then it might also need to be connected to the docking station when it is unlocked. Conversely, if a portable computer is not connected to its docking station when BitLocker is turned on, then it might need to be disconnected from the docking station when it is unlocked.
|
||||
- Changes to the NTFS partition table on the disk including creating, deleting, or resizing a primary partition.
|
||||
- Entering the personal identification number (PIN) incorrectly too many times so that the anti-hammering logic of the TPM is activated. Anti-hammering logic is software or hardware methods that increase the difficulty and cost of a brute force attack on a PIN by not accepting PIN entries until after a certain amount of time has passed.
|
||||
- Turning off the support for reading the USB device in the pre-boot environment from the BIOS or UEFI firmware if you are using USB-based keys instead of a TPM.
|
||||
- Turning off, disabling, deactivating, or clearing the TPM.
|
||||
- Upgrading critical early startup components, such as a BIOS or UEFI firmware upgrade, causing the related boot measurements to change.
|
||||
- Forgetting the PIN when PIN authentication has been enabled.
|
||||
- Updating option ROM firmware.
|
||||
- Upgrading TPM firmware.
|
||||
- Adding or removing hardware; for example, inserting a new card in the computer, including some PCMIA wireless cards.
|
||||
- Removing, inserting, or completely depleting the charge on a smart battery on a portable computer.
|
||||
- Changes to the master boot record on the disk.
|
||||
- Changes to the boot manager on the disk.
|
||||
- Hiding the TPM from the operating system. Some BIOS or UEFI settings can be used to prevent the enumeration of the TPM to the operating system. When implemented, this option can make the TPM hidden from the operating system. When the TPM is hidden, BIOS and UEFI secure startup are disabled, and the TPM does not respond to commands from any software.
|
||||
- Using a different keyboard that does not correctly enter the PIN or whose keyboard map does not match the keyboard map assumed by the pre-boot environment. This problem can prevent the entry of enhanced PINs.
|
||||
- Modifying the Platform Configuration Registers (PCRs) used by the TPM validation profile. For example, including **PCR\[1\]** would result in BitLocker measuring most changes to BIOS settings, causing BitLocker to enter recovery mode even when non-boot critical BIOS settings change.
|
||||
|
||||
> [!NOTE]
|
||||
> Some computers have BIOS settings that skip measurements to certain PCRs, such as **PCR\[2\]**. Changing this setting in the BIOS would cause BitLocker to enter recovery mode because the PCR measurement will be different.
|
||||
|
||||
- Moving the BitLocker-protected drive into a new computer.
|
||||
- Upgrading the motherboard to a new one with a new TPM.
|
||||
- Losing the USB flash drive containing the startup key when startup key authentication has been enabled.
|
||||
- Failing the TPM self-test.
|
||||
- Having a BIOS, UEFI firmware, or an option ROM component that is not compliant with the relevant Trusted Computing Group standards for a client computer. For example, a non-compliant implementation may record volatile data (such as time) in the TPM measurements, causing different measurements on each startup and causing BitLocker to start in recovery mode.
|
||||
- Changing the usage authorization for the storage root key of the TPM to a non-zero value.
|
||||
|
||||
- Moving the BitLocker-protected drive into a new computer.
|
||||
- Upgrading the motherboard to a new one with a new TPM.
|
||||
- Losing the USB flash drive containing the startup key when startup key authentication has been enabled.
|
||||
- Failing the TPM self-test.
|
||||
- Having a BIOS, UEFI firmware, or an option ROM component that is not compliant with the relevant Trusted Computing Group standards for a client computer. For example, a non-compliant implementation may record volatile data (such as time) in the TPM measurements, causing different measurements on each startup and causing BitLocker to start in recovery mode.
|
||||
- Changing the usage authorization for the storage root key of the TPM to a non-zero value.
|
||||
|
||||
> [!NOTE]
|
||||
> The BitLocker TPM initialization process sets the usage authorization value to zero, so another user or process must explicitly have changed this value.
|
||||
|
||||
- Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr).
|
||||
- Pressing the F8 or F10 key during the boot process.
|
||||
- Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards.
|
||||
- Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive.
|
||||
|
||||
- Disabling the code integrity check or enabling test signing on Windows Boot Manager (Bootmgr).
|
||||
- Pressing the F8 or F10 key during the boot process.
|
||||
- Adding or removing add-in cards (such as video or network cards), or upgrading firmware on add-in cards.
|
||||
- Using a BIOS hot key during the boot process to change the boot order to something other than the hard drive.
|
||||
|
||||
> [!NOTE]
|
||||
> Before you begin recovery, we recommend that you determine what caused recovery. This might help prevent the problem from occurring again in the future. For instance, if you determine that an attacker has modified your computer by obtaining physical access, you can create new security policies for tracking who has physical presence. After the recovery password has been used to recover access to the PC, BitLocker will reseal the encryption key to the current values of the measured components.
|
||||
@ -91,60 +93,65 @@ For planned scenarios, such as a known hardware or firmware upgrades, you can av
|
||||
> [!NOTE]
|
||||
> If suspended BitLocker will automatically resume protection when the PC is rebooted, unless a reboot count is specified using the manage-bde command line tool.
|
||||
|
||||
If software maintenance requires the computer be restarted and you are using two-factor authentication, you can enable BitLocker Network Unlock to provide the secondary authentication factor when the computers do not have an on-premises user to provide the additional authentication method.
|
||||
If software maintenance requires the computer to be restarted and you are using two-factor authentication, you can enable BitLocker Network Unlock to provide the secondary authentication factor when the computers do not have an on-premises user to provide the additional authentication method.
|
||||
|
||||
Recovery has been described within the context of unplanned or undesired behavior, but you can also cause recovery as an intended production scenario, in order to manage access control. For example, when you redeploy desktop or laptop computers to other departments or employees in your enterprise, you can force BitLocker into recovery before the computer is given to a new user.
|
||||
|
||||
|
||||
## <a href="" id="bkmk-testingrecovery"></a>Testing recovery
|
||||
|
||||
Before you create a thorough BitLocker recovery process, we recommend that you test how the recovery process works for both end users (people who call your helpdesk for the recovery password) and administrators (people who help the end user get the recovery password). The –forcerecovery command of manage-bde is an easy way for you to step through the recovery process before your users encounter a recovery situation.
|
||||
Before you create a thorough BitLocker recovery process, we recommend that you test how the recovery process works for both end users (people who call your helpdesk for the recovery password) and administrators (people who help the end user get the recovery password). The -forcerecovery command of manage-bde is an easy way for you to step through the recovery process before your users encounter a recovery situation.
|
||||
|
||||
**To force a recovery for the local computer**
|
||||
**To force a recovery for the local computer:**
|
||||
|
||||
1. Click the **Start** button, type **cmd** in the **Start Search** box, right-click **cmd.exe**, and then click **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press ENTER:
|
||||
1. Select the **Start** button, type *cmd* in the **Start Search** box, right-click **cmd.exe**, and then select **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press **Enter**:
|
||||
`manage-bde -forcerecovery <BitLockerVolume>`
|
||||
|
||||
|
||||
**To force recovery for a remote computer**
|
||||
**To force recovery for a remote computer:**
|
||||
|
||||
1. On the Start screen, type **cmd.exe**, and then click **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press ENTER:
|
||||
1. On the Start screen, type **cmd.exe**, and then select **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press ENTER:
|
||||
`manage-bde -ComputerName <RemoteComputerName> -forcerecovery <BitLockerVolume>`
|
||||
|
||||
> [!NOTE]
|
||||
> Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because BitLocker will have to be unlocked and disabled manually from the WinRE environment before the OS can boot up again. For more information, see [BitLocker Troubleshooting: Continuous reboot loop with BitLocker recovery on a slate device](https://social.technet.microsoft.com/wiki/contents/articles/18671.bitlocker-troubleshooting-continuous-reboot-loop-with-bitlocker-recovery-on-a-slate-device.aspx).
|
||||
|
||||
|
||||
## <a href="" id="bkmk-planningrecovery"></a>Planning your recovery process
|
||||
|
||||
When planning the BitLocker recovery process, first consult your organization's current best practices for recovering sensitive information. For example: How does your enterprise handle lost Windows passwords? How does your organization perform smart card PIN resets? You can use these best practices and related resources (people and tools) to help formulate a BitLocker recovery model.
|
||||
|
||||
Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/mbam-v25/).
|
||||
|
||||
After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. You must consider both self-recovery and recovery password retrieval methods for your organization.
|
||||
After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. Consider both self-recovery and recovery password retrieval methods for your organization.
|
||||
|
||||
When you determine your recovery process, you should:
|
||||
|
||||
- Become familiar with how you can retrieve the recovery password. See:
|
||||
- Become familiar with how you can retrieve the recovery password. See:
|
||||
|
||||
- [Self-recovery](#bkmk-selfrecovery)
|
||||
- [Recovery password retrieval](#bkmk-recoveryretrieval)
|
||||
- [Self-recovery](#bkmk-selfrecovery)
|
||||
- [Recovery password retrieval](#bkmk-recoveryretrieval)
|
||||
|
||||
- Determine a series of steps for post-recovery, including analyzing why the recovery occurred and resetting the recovery password. See:
|
||||
- Determine a series of steps for post-recovery, including analyzing why the recovery occurred and resetting the recovery password. See:
|
||||
|
||||
- [Post-recovery analysis](#bkmk-planningpostrecovery)
|
||||
|
||||
- [Post-recovery analysis](#bkmk-planningpostrecovery)
|
||||
|
||||
### <a href="" id="bkmk-selfrecovery"></a>Self-recovery
|
||||
|
||||
In some cases, users might have the recovery password in a printout or a USB flash drive and can perform self-recovery. We recommend that your organization create a policy for self-recovery. If self-recovery includes using a password or recovery key stored on a USB flash drive, the users should be warned not to store the USB flash drive in the same place as the PC, especially during travel, for example if both the PC and the recovery items are in the same bag it would be very easy for access to be gained to the PC by an unauthorized user. Another policy to consider is having users contact the Helpdesk before or after performing self-recovery so that the root cause can be identified.
|
||||
In some cases, users might have the recovery password in a printout or a USB flash drive and can perform self-recovery. We recommend that your organization create a policy for self-recovery. If self-recovery includes using a password or recovery key stored on a USB flash drive, the users should be warned not to store the USB flash drive in the same place as the PC, especially during travel, for example if both the PC and the recovery items are in the same bag, then it's easy for an unauthorized user to access the PC. Another policy to consider is having users contact the Helpdesk before or after performing self-recovery so that the root cause can be identified.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-recoveryretrieval"></a>Recovery password retrieval
|
||||
|
||||
If the user does not have a recovery password in a printout or on a USB flash drive, the user will need to be able to retrieve the recovery password from an online source. If the PC is a member of a domain the recovery password can be backed up to AD DS. However, this does not happen by default, you must have configured the appropriate Group Policy settings before BitLocker was enabled on the PC. BitLocker Group Policy settings can be found in the Local Group Policy Editor or the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used.
|
||||
If the user does not have a recovery password in a printout or on a USB flash drive, the user will need to be able to retrieve the recovery password from an online source. If the PC is a member of a domain, the recovery password can be backed up to AD DS. However, this does not happen by default. You must have configured the appropriate Group Policy settings before BitLocker was enabled on the PC. BitLocker Group Policy settings can be found in the Local Group Policy Editor or the Group Policy Management Console (GPMC) under **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption**. The following policy settings define the recovery methods that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unable to be used.
|
||||
|
||||
- **Choose how BitLocker-protected operating system drives can be recovered**
|
||||
- **Choose how BitLocker-protected fixed drives can be recovered**
|
||||
- **Choose how BitLocker-protected removable drives can be recovered**
|
||||
|
||||
- **Choose how BitLocker-protected operating system drives can be recovered**
|
||||
- **Choose how BitLocker-protected fixed drives can be recovered**
|
||||
- **Choose how BitLocker-protected removable drives can be recovered**
|
||||
In each of these policies, select **Save BitLocker recovery information to Active Directory Domain Services** and then choose which BitLocker recovery information to store in Active Directory Domain Services (AD DS). Select the **Do not enable BitLocker until recovery information is stored in AD
|
||||
DS** check box if you want to prevent users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information for the drive to AD DS succeeds.
|
||||
|
||||
@ -155,24 +162,28 @@ The BitLocker Recovery Password Viewer for Active Directory Users and Computers
|
||||
|
||||
You can use the following list as a template for creating your own recovery process for recovery password retrieval. This sample process uses the BitLocker Recovery Password Viewer for Active Directory Users and Computers tool.
|
||||
|
||||
- [Record the name of the user's computer](#bkmk-recordcomputername)
|
||||
- [Verify the user's identity](#bkmk-verifyidentity)
|
||||
- [Locate the recovery password in AD DS](#bkmk-locatepassword)
|
||||
- [Gather information to determine why recovery occurred](#bkmk-gatherinfo)
|
||||
- [Give the user the recovery password](#bkmk-givepassword)
|
||||
- [Record the name of the user's computer](#bkmk-recordcomputername)
|
||||
- [Verify the user's identity](#bkmk-verifyidentity)
|
||||
- [Locate the recovery password in AD DS](#bkmk-locatepassword)
|
||||
- [Gather information to determine why recovery occurred](#bkmk-gatherinfo)
|
||||
- [Give the user the recovery password](#bkmk-givepassword)
|
||||
|
||||
|
||||
### <a href="" id="bkmk-recordcomputername"></a>Record the name of the user's computer
|
||||
|
||||
You can use the name of the user's computer to locate the recovery password in AD DS. If the user does not know the name of the computer, ask the user to read the first word of the **Drive Label** in the **BitLocker Drive Encryption Password Entry** user interface. This is the computer name when BitLocker was enabled and is probably the current name of the computer.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-verifyidentity"></a>Verify the user's identity
|
||||
|
||||
You should verify that the person that is asking for the recovery password is truly the authorized user of that computer. You may also wish to verify that the computer with the name the user provided belongs to the user.
|
||||
Verify that the person that is asking for the recovery password is truly the authorized user of that computer. You might also want to verify that the computer with the name the user provided belongs to the user.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-locatepassword"></a>Locate the recovery password in AD DS
|
||||
|
||||
Locate the Computer object with the matching name in AD DS. Because Computer object names are listed in the AD DS global catalog, you should be able to locate the object even if you have a multi-domain forest.
|
||||
|
||||
|
||||
### Multiple recovery passwords
|
||||
|
||||
If multiple recovery passwords are stored under a computer object in AD DS, the name of the BitLocker recovery information object includes the date that the password was created.
|
||||
@ -181,26 +192,30 @@ If at any time you are unsure what password to provide, or if you think you migh
|
||||
|
||||
Since the password ID is a unique value that is associated with each recovery password stored in AD DS, running a query using this ID will find the correct password to unlock the encrypted volume.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-gatherinfo"></a>Gather information to determine why recovery occurred
|
||||
|
||||
Before you give the user the recovery password, you should gather any information that will help determine why the recovery was needed, in order to analyze the root cause during the post-recovery analysis. For more info about post-recovery analysis, see [Post-recovery analysis](#bkmk-planningpostrecovery).
|
||||
|
||||
|
||||
### <a href="" id="bkmk-givepassword"></a>Give the user the recovery password
|
||||
|
||||
Because the recovery password is 48 digits long the user may need to record the password by writing it down or typing it on a different computer. If you are using MBAM, the recovery password will be regenerated after it is recovered from the MBAM database to avoid the security risks associated with an uncontrolled password.
|
||||
Because the recovery password is 48 digits long, the user might need to record the password by writing it down or typing it on a different computer. If you are using MBAM, the recovery password will be regenerated after it is recovered from the MBAM database to avoid the security risks associated with an uncontrolled password.
|
||||
|
||||
> [!NOTE]
|
||||
> Because the 48-digit recovery password is long and contains a combination of digits, the user might mishear or mistype the password. The boot-time recovery console uses built-in checksum numbers to detect input errors in each 6-digit block of the 48-digit recovery password, and offers the user the opportunity to correct such errors.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-planningpostrecovery"></a>Post-recovery analysis
|
||||
|
||||
When a volume is unlocked using a recovery password, an event is written to the event log and the platform validation measurements are reset in the TPM to match the current configuration. Unlocking the volume means that the encryption key has been released and is ready for on-the-fly encryption
|
||||
when data is written to the volume, and on-the-fly decryption when data is read from the volume. After the volume is unlocked, BitLocker behaves the same way, regardless of how the access was granted.
|
||||
|
||||
If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator can perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See:
|
||||
If you notice that a computer is having repeated recovery password unlocks, you might want to have an administrator perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user no longer needs to enter a recovery password each time that the computer starts up. See:
|
||||
|
||||
- [Determine the root cause of the recovery](#bkmk-determinecause)
|
||||
- [Refresh BitLocker protection](#bkmk-refreshprotection)
|
||||
|
||||
- [Determine the root cause of the recovery](#bkmk-determinecause)
|
||||
- [Refresh BitLocker protection](#bkmk-refreshprotection)
|
||||
|
||||
### <a href="" id="bkmk-determinecause"></a>Determine the root cause of the recovery
|
||||
|
||||
@ -210,14 +225,15 @@ While an administrator can remotely investigate the cause of recovery in some ca
|
||||
|
||||
Review and answer the following questions for your organization:
|
||||
|
||||
1. What BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC?
|
||||
2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be?
|
||||
3. If TPM mode was in effect, was recovery caused by a boot file change?
|
||||
4. If recovery was caused by a boot file change, is this due to an intended user action (for example, BIOS upgrade), or to malicious software?
|
||||
5. When was the user last able to start the computer successfully, and what might have happened to the computer since then?
|
||||
6. Might the user have encountered malicious software or left the computer unattended since the last successful startup?
|
||||
1. What BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC?
|
||||
2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be?
|
||||
3. If TPM mode was in effect, was recovery caused by a boot file change?
|
||||
4. If recovery was caused by a boot file change, was the change an intended user action (for example, BIOS upgrade), or was it caused by malicious software?
|
||||
5. When was the user last able to start the computer successfully, and what might have happened to the computer since then?
|
||||
6. Might the user have encountered malicious software or left the computer unattended since the last successful startup?
|
||||
|
||||
To help you answer these questions, use the BitLocker command-line tool to view the current configuration and protection mode (for example, **manage-bde -status**). Scan the event log to find events that help indicate why recovery was initiated (for example, if the boot file changed). Both of these capabilities can be performed remotely.
|
||||
|
||||
To help you answer these questions, use the BitLocker command-line tool to view the current configuration and protection mode (for example, **manage-bde -status**). Scan the event log to find events that help indicate why recovery was initiated (for example, if boot file change occurred). Both of these capabilities can be performed remotely.
|
||||
|
||||
### <a href="" id="bkmk-refreshprotection"></a>Resolve the root cause
|
||||
|
||||
@ -231,18 +247,21 @@ The details of this reset can vary according to the root cause of the recovery.
|
||||
- [Unknown PIN](#bkmk-unknownpin)
|
||||
- [Lost startup key](#bkmk-loststartup)
|
||||
- [Changes to boot files](#bkmk-changebootknown)
|
||||
### <a href="" id="bkmk-unknownpin"></a>Unknown PIN
|
||||
|
||||
|
||||
### <a href="" id="bkmk-unknownpin"></a>Unknown PIN
|
||||
|
||||
If a user has forgotten the PIN, you must reset the PIN while you are logged on to the computer in order to prevent BitLocker from initiating recovery each time the computer is restarted.
|
||||
|
||||
**To prevent continued recovery due to an unknown PIN**
|
||||
|
||||
1. Unlock the computer using the recovery password.
|
||||
2. Reset the PIN:
|
||||
1. Right-click the drive and then click **Change PIN**
|
||||
2. In the BitLocker Drive Encryption dialog, click **Reset a forgotten PIN**. If you are not logged in with an administrator account you must provide administrative credentials at this time.
|
||||
3. In the PIN reset dialog, provide and confirm the new PIN to use and then click **Finish**.
|
||||
3. You will use the new PIN the next time you unlock the drive.
|
||||
1. Unlock the computer using the recovery password.
|
||||
2. Reset the PIN:
|
||||
1. Right-click the drive and then select **Change PIN**.
|
||||
2. In the BitLocker Drive Encryption dialog, select **Reset a forgotten PIN**. If you are not logged in with an administrator account, provide administrative credentials at this time.
|
||||
3. In the PIN reset dialog, provide and confirm the new PIN to use and then select **Finish**.
|
||||
3. You will use the new PIN the next time you unlock the drive.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-loststartup"></a>Lost startup key
|
||||
|
||||
@ -250,22 +269,26 @@ If you have lost the USB flash drive that contains the startup key, then you mus
|
||||
|
||||
**To prevent continued recovery due to a lost startup key**
|
||||
|
||||
1. Log on as an administrator to the computer that has the lost startup key.
|
||||
2. Open Manage BitLocker.
|
||||
3. Click **Duplicate start up key**, insert the clean USB drive on which you are going to write the key and then click **Save**.
|
||||
1. Log on as an administrator to the computer that has the lost startup key.
|
||||
2. Open Manage BitLocker.
|
||||
3. Select **Duplicate start up key**, insert the clean USB drive on which you are going to write the key and then select **Save**.
|
||||
|
||||
|
||||
### <a href="" id="bkmk-changebootknown"></a>Changes to boot files
|
||||
|
||||
This error might occur if you updated the firmware. As a best practice you should suspend BitLocker before making changes the firmware and then resume protection after the update has completed. This prevents the computer from going into recovery mode. However if changes were made when BitLocker protection was on you can simply log on to the computer using the recovery password and the platform validation profile will be updated so that recovery will not occur the next time.
|
||||
This error might occur if you updated the firmware. As a best practice, you should suspend BitLocker before making changes to the firmware and then resume protection after the update has completed. This action prevents the computer from going into recovery mode. However if changes were made when BitLocker protection was on, then log on to the computer using the recovery password, and the platform validation profile will be updated so that recovery will not occur the next time.
|
||||
|
||||
|
||||
## Windows RE and BitLocker Device Encryption
|
||||
|
||||
Windows Recovery Environment (RE) can be used to recover access to a drive protected by [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md). If a PC is unable to boot after two failures, Startup Repair will automatically start. When Startup Repair is launched automatically due to boot failures, it will only execute operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. In Windows 8.1 and later, devices that include firmware to support specific TPM measurements for PCR\[7\] the TPM can validate that Windows RE is a trusted operating environment and will unlock any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM has been disabled, the drives will stay locked until the BitLocker recovery key is provided. If Startup Repair is not able to be run automatically from the PC and instead Windows RE is manually started from a repair disk, the BitLocker recovery key must be provided to unlock the BitLocker–protected drives.
|
||||
Windows Recovery Environment (RE) can be used to recover access to a drive protected by [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md). If a PC is unable to boot after two failures, Startup Repair will automatically start. When Startup Repair is launched automatically due to boot failures, it will only execute operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. In Windows 8.1 and later, devices that include firmware to support specific TPM measurements for PCR\[7\] the TPM can validate that Windows RE is a trusted operating environment and will unlock any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM has been disabled, the drives will stay locked until the BitLocker recovery key is provided. If Startup Repair can't run automatically from the PC and instead Windows RE is manually started from a repair disk, then the BitLocker recovery key must be provided to unlock the BitLocker–protected drives.
|
||||
|
||||
|
||||
## BitLocker recovery screen
|
||||
|
||||
During BitLocker recovery, Windows can display a custom recovery message and hints that identify where a key can be retrieved from. These improvements can help a user during BitLocker recovery.
|
||||
|
||||
|
||||
### Custom recovery message
|
||||
|
||||
BitLocker Group Policy settings in Windows 10, version 1511, let you configure a custom recovery message and URL on the BitLocker recovery screen, which can include the address of the BitLocker self-service recovery portal, the IT internal website, or a phone number for support.
|
||||
@ -281,9 +304,10 @@ Example of customized recovery screen:
|
||||
|
||||
|
||||
|
||||
|
||||
### BitLocker recovery key hints
|
||||
|
||||
BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where key has been saved. Hints are displayed in both the modern (blue) and legacy (black) recovery screen. This applies to both the bootmanager recovery screen and the WinRE unlock screen.
|
||||
BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where the key has been saved. Hints are displayed on both the modern (blue) and legacy (black) recovery screen. This applies to both the boot manager recovery screen and the WinRE unlock screen.
|
||||
|
||||
|
||||
|
||||
@ -302,6 +326,7 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
8. There is no specific hint for keys saved to an on-premises Active Directory. In this case, a custom message (if configured) or a generic message, "Contact your organization's help desk," will be displayed.
|
||||
9. If two recovery keys are present on the disk, but only one has been successfully backed up, the system will ask for a key that has been backed up, even if another key is newer.
|
||||
|
||||
|
||||
#### Example 1 (single recovery key with single backup)
|
||||
|
||||
| Custom URL | Yes |
|
||||
@ -312,10 +337,11 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
| Printed | No |
|
||||
| Saved to file | No |
|
||||
|
||||
**Result:** The hint for the Microsoft Account and custom URL are displayed.
|
||||
**Result:** The hint for the Microsoft Account and the custom URL are displayed.
|
||||
|
||||
|
||||
|
||||
|
||||
#### Example 2 (single recovery key with single backup)
|
||||
|
||||
| Custom URL | Yes |
|
||||
@ -330,6 +356,7 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
#### Example 3 (single recovery key with multiple backups)
|
||||
|
||||
| Custom URL | No |
|
||||
@ -344,13 +371,14 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
#### Example 4 (multiple recovery passwords)
|
||||
|
||||
| Custom URL | No |
|
||||
|----------------------|-----------------|
|
||||
| Saved to Microsoft Account | No |
|
||||
| Saved to Azure AD | No |
|
||||
| Saved to Acive Directory | No |
|
||||
| Saved to Active Directory | No |
|
||||
| Printed | No |
|
||||
| Saved to file | Yes |
|
||||
| Creation time | **1PM** |
|
||||
@ -373,6 +401,7 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
#### Example 5 (multiple recovery passwords)
|
||||
|
||||
| Custom URL | No |
|
||||
@ -402,10 +431,12 @@ There are rules governing which hint is shown during the recovery (in order of p
|
||||
|
||||
|
||||
|
||||
|
||||
## <a href="" id="bkmk-usingaddrecovery"></a>Using additional recovery information
|
||||
|
||||
Besides the 48-digit BitLocker recovery password, other types of recovery information are stored in Active Directory. This section describes how this additional information can be used.
|
||||
|
||||
|
||||
### BitLocker key package
|
||||
|
||||
If the recovery methods discussed earlier in this document do not unlock the volume, you can use the BitLocker Repair tool to decrypt the volume at the block level. The tool uses the BitLocker key package to help recover encrypted data from severely damaged drives. You can then use this recovered data to salvage encrypted data, even after the correct recovery password has failed to unlock the damaged volume. We recommend that you still save the recovery password. A key package cannot be used without the corresponding recovery password.
|
||||
@ -413,38 +444,39 @@ If the recovery methods discussed earlier in this document do not unlock the vol
|
||||
> [!NOTE]
|
||||
> You must use the BitLocker Repair tool **repair-bde** to use the BitLocker key package.
|
||||
|
||||
The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details on how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc).
|
||||
The BitLocker key package is not saved by default. To save the package along with the recovery password in AD DS, you must select the **Backup recovery password and key package** option in the Group Policy settings that control the recovery method. You can also export the key package from a working volume. For more details about how to export key packages, see [Retrieving the BitLocker Key Package](#bkmk-appendixc).
|
||||
|
||||
|
||||
## <a href="" id="bkmk-appendixb"></a>Resetting recovery passwords
|
||||
|
||||
You should invalidate a recovery password after it has been provided and used. It should also be done when you intentionally want to invalidate an existing recovery password for any reason.
|
||||
Invalidate a recovery password after it has been provided and used. It should also be done when you intentionally want to invalidate an existing recovery password for any reason.
|
||||
|
||||
You can reset the recovery password in two ways:
|
||||
|
||||
- **Use manage-bde** You can use manage-bde to remove the old recovery password and add a new recovery password. The procedure identifies the command and the syntax for this method.
|
||||
- **Run a script** You can run a script to reset the password without decrypting the volume. The sample script in the procedure illustrates this functionality. The sample script creates a new recovery password and invalidates all other passwords.
|
||||
- **Use manage-bde**: You can use manage-bde to remove the old recovery password and add a new recovery password. The procedure identifies the command and the syntax for this method.
|
||||
- **Run a script**: You can run a script to reset the password without decrypting the volume. The sample script in the procedure illustrates this functionality. The sample script creates a new recovery password and invalidates all other passwords.
|
||||
|
||||
**To reset a recovery password using manage-bde**
|
||||
**To reset a recovery password using manage-bde:**
|
||||
|
||||
1. Remove the previous recovery password
|
||||
1. Remove the previous recovery password
|
||||
|
||||
```powershell
|
||||
Manage-bde –protectors –delete C: –type RecoveryPassword
|
||||
```
|
||||
|
||||
2. Add the new recovery password
|
||||
2. Add the new recovery password
|
||||
|
||||
```powershell
|
||||
Manage-bde –protectors –add C: -RecoveryPassword
|
||||
```
|
||||
|
||||
3. Get the ID of the new recovery password. From the screen copy the ID of the recovery password.
|
||||
3. Get the ID of the new recovery password. From the screen, copy the ID of the recovery password.
|
||||
|
||||
```powershell
|
||||
Manage-bde –protectors –get C: -Type RecoveryPassword
|
||||
```
|
||||
|
||||
4. Backup the new recovery password to AD DS
|
||||
4. Back up the new recovery password to AD DS.
|
||||
|
||||
```powershell
|
||||
Manage-bde –protectors –adbackup C: -id {EXAMPLE6-5507-4924-AA9E-AFB2EB003692}
|
||||
@ -453,10 +485,10 @@ You can reset the recovery password in two ways:
|
||||
> [!WARNING]
|
||||
> You must include the braces in the ID string.
|
||||
|
||||
**To run the sample recovery password script**
|
||||
**To run the sample recovery password script:**
|
||||
|
||||
1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs.
|
||||
2. At the command prompt, type a command similar to the following:
|
||||
1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs.
|
||||
2. At the command prompt, type a command similar to the following sample script:
|
||||
|
||||
**cscript ResetPassword.vbs**
|
||||
|
||||
@ -466,7 +498,7 @@ You can reset the recovery password in two ways:
|
||||
> [!NOTE]
|
||||
> To manage a remote computer, you can specify the remote computer name rather than the local computer name.
|
||||
|
||||
You can use the following sample script to create a VBScript file to reset the recovery passwords.
|
||||
You can use the following sample script to create a VBScript file to reset the recovery passwords:
|
||||
|
||||
```vb
|
||||
' Target drive letter
|
||||
@ -539,23 +571,24 @@ WScript.Echo "A new recovery password has been added. Old passwords have been re
|
||||
'WScript.Echo "Type ""manage-bde -protectors -get " & strDriveLetter & " -type recoverypassword"" to view existing passwords."
|
||||
```
|
||||
|
||||
|
||||
## <a href="" id="bkmk-appendixc"></a>Retrieving the BitLocker key package
|
||||
|
||||
You can use two methods to retrieve the key package, as described in [Using Additional Recovery Information](#bkmk-usingaddrecovery):
|
||||
|
||||
- **Export a previously-saved key package from AD DS.** You must have Read access to BitLocker recovery passwords that are stored in AD DS.
|
||||
- **Export a new key package from an unlocked, BitLocker-protected volume.** You must have local administrator access to the working volume, before any damage has occurred.
|
||||
- **Export a previously saved key package from AD DS.** You must have Read access to BitLocker recovery passwords that are stored in AD DS.
|
||||
- **Export a new key package from an unlocked, BitLocker-protected volume.** You must have local administrator access to the working volume, before any damage has occurred.
|
||||
|
||||
The following sample script exports all previously-saved key packages from AD DS.
|
||||
The following sample script exports all previously saved key packages from AD DS.
|
||||
|
||||
**To run the sample key package retrieval script**
|
||||
**To run the sample key package retrieval script:**
|
||||
|
||||
1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackageADDS.vbs.
|
||||
2. At the command prompt, type a command similar to the following:
|
||||
2. At the command prompt, type a command similar to the following sample script:
|
||||
|
||||
**cscript GetBitLockerKeyPackageADDS.vbs -?**
|
||||
|
||||
You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS.
|
||||
You can use the following sample script to create a VBScript file to retrieve the BitLocker key package from AD DS:
|
||||
|
||||
```vb
|
||||
' --------------------------------------------------------------------------------
|
||||
@ -697,10 +730,10 @@ WScript.Quit
|
||||
|
||||
The following sample script exports a new key package from an unlocked, encrypted volume.
|
||||
|
||||
**To run the sample key package retrieval script**
|
||||
**To run the sample key package retrieval script:**
|
||||
|
||||
1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackage.vbs
|
||||
2. Open an administrator command prompt, type a command similar to the following:
|
||||
2. Open an administrator command prompt, and then type a command similar to the following sample script:
|
||||
|
||||
**cscript GetBitLockerKeyPackage.vbs -?**
|
||||
|
||||
@ -882,6 +915,7 @@ Function BinaryToString(Binary)
|
||||
End Function
|
||||
```
|
||||
|
||||
|
||||
## See also
|
||||
|
||||
- [BitLocker overview](bitlocker-overview.md)
|
||||
- [BitLocker overview](bitlocker-overview.md)
|
||||
|
||||
@ -6,7 +6,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: #medium
|
||||
ms.localizationpriority: medium
|
||||
ms.author: v-maave
|
||||
author: martyav
|
||||
manager: dansimp
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker To Go FAQ (Windows 10)
|
||||
description: Learn more about BitLocker To Go — BitLocker drive encryption for removable drives.
|
||||
description: "Learn more about BitLocker To Go: BitLocker drive encryption for removable drives."
|
||||
ms.assetid: c40f87ac-17d3-47b2-afc6-6c641f72ecee
|
||||
ms.reviewer:
|
||||
ms.author: dansimp
|
||||
@ -25,7 +25,14 @@ ms.custom: bitlocker
|
||||
|
||||
## What is BitLocker To Go?
|
||||
|
||||
BitLocker To Go is BitLocker Drive Encryption on removable data drives. This includes the encryption of USB flash drives, SD cards, external hard disk drives, and other drives formatted by using the NTFS, FAT16, FAT32, or exFAT file systems. Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](https://docs.microsoft.com/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements).
|
||||
BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of:
|
||||
|
||||
As with BitLocker, drives that are encrypted using BitLocker To Go can be opened with a password or smart card on another computer by using **BitLocker Drive Encryption** in Control Panel.
|
||||
- USB flash drives
|
||||
- SD cards
|
||||
- External hard disk drives
|
||||
- Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system.
|
||||
|
||||
Drive partitioning must meet the [BitLocker Drive Encryption Partitioning Requirements](https://docs.microsoft.com/windows-hardware/manufacture/desktop/bitlocker-drive-encryption#bitlocker-drive-encryption-partitioning-requirements).
|
||||
|
||||
As with BitLocker, you can open drives that are encrypted by BitLocker To Go by using a password or smart card on another computer. In Control Panel, use **BitLocker Drive Encryption**.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: BitLocker Use BitLocker Drive Encryption Tools to manage BitLocker (Windows 10)
|
||||
description: This topic for the IT professional describes how to use tools to manage BitLocker.
|
||||
description: This article for the IT professional describes how to use tools to manage BitLocker.
|
||||
ms.assetid: e869db9c-e906-437b-8c70-741dd61b5ea6
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
@ -23,9 +23,9 @@ ms.custom: bitlocker
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
|
||||
This topic for the IT professional describes how to use tools to manage BitLocker.
|
||||
This article for the IT professional describes how to use tools to manage BitLocker.
|
||||
|
||||
BitLocker Drive Encryption Tools include the command line tools manage-bde and repair-bde and the BitLocker cmdlets for Windows PowerShell.
|
||||
BitLocker Drive Encryption Tools include the command-line tools manage-bde and repair-bde and the BitLocker cmdlets for Windows PowerShell.
|
||||
|
||||
Both manage-bde and the BitLocker cmdlets can be used to perform any task that can be accomplished through the BitLocker control panel and are appropriate to use for automated deployments and other scripting scenarios.
|
||||
|
||||
@ -39,11 +39,11 @@ Repair-bde is a special circumstance tool that is provided for disaster recovery
|
||||
|
||||
Manage-bde is a command-line tool that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the manage-bde options, see the [Manage-bde](https://technet.microsoft.com/library/ff829849.aspx) command-line reference.
|
||||
|
||||
Manage-bde includes less default settings and requires greater customization for configuring BitLocker. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. The following sections provide examples of common usage scenarios for manage-bde.
|
||||
Manage-bde includes fewer default settings and requires greater customization for configuring BitLocker. For example, using just the `manage-bde -on` command on a data volume will fully encrypt the volume without any authenticating protectors. A volume encrypted in this manner still requires user interaction to turn on BitLocker protection, even though the command successfully completed because an authentication method needs to be added to the volume for it to be fully protected. The following sections provide examples of common usage scenarios for manage-bde.
|
||||
|
||||
### Using manage-bde with operating system volumes
|
||||
|
||||
Listed below are examples of basic valid commands for operating system volumes. In general, using only the `manage-bde -on <drive letter>` command will encrypt the operating system volume with a TPM-only protector and no recovery key. However, many environments require more secure protectors such as passwords or PIN and expect to be able to recover information with a recovery key. It is recommended that at least one primary protector and a recovery protector be added to an operating system volume.
|
||||
Listed below are examples of basic valid commands for operating system volumes. In general, using only the `manage-bde -on <drive letter>` command will encrypt the operating system volume with a TPM-only protector and no recovery key. However, many environments require more secure protectors such as passwords or PIN and expect to be able to recover information with a recovery key. We recommend that you add at least one primary protector and a recovery protector to an operating system volume.
|
||||
|
||||
A good practice when using manage-bde is to determine the volume status on the target system. Use the following command to determine volume status:
|
||||
|
||||
@ -54,7 +54,7 @@ This command returns the volumes on the target, current encryption status, encry
|
||||
|
||||
|
||||
|
||||
The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process.
|
||||
The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process, you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process.
|
||||
|
||||
```powershell
|
||||
manage-bde –protectors -add C: -startupkey E:
|
||||
@ -63,30 +63,30 @@ manage-bde -on C:
|
||||
|
||||
>**Note:** After the encryption is completed, the USB startup key must be inserted before the operating system can be started.
|
||||
|
||||
An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. This is done with the command:
|
||||
An alternative to the startup key protector on non-TPM hardware is to use a password and an **ADaccountorgroup** protector to protect the operating system volume. In this scenario, you would add the protectors first. To add them, use this command:
|
||||
|
||||
```powershell
|
||||
manage-bde -protectors -add C: -pw -sid <user or group>
|
||||
```
|
||||
|
||||
This command will require you to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, you can then turn BitLocker on.
|
||||
This command will require you to enter and then confirm the password protector before adding them to the volume. With the protectors enabled on the volume, you can then turn on BitLocker.
|
||||
|
||||
On computers with a TPM it is possible to encrypt the operating system volume without any defined protectors using manage-bde. The command to do this is:
|
||||
On computers with a TPM, it is possible to encrypt the operating system volume without any defined protectors using manage-bde. Use this command:
|
||||
|
||||
```powershell
|
||||
manage-bde -on C:
|
||||
```
|
||||
|
||||
This will encrypt the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command:
|
||||
This command encrypts the drive using the TPM as the default protector. If you are not sure if a TPM protector is available, to list the protectors available for a volume, run the following command:
|
||||
|
||||
```powershell
|
||||
manage-bde -protectors -get <volume>
|
||||
```
|
||||
### Using manage-bde with data volumes
|
||||
|
||||
Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on <drive letter>` or you can choose to add additional protectors to the volume first. It is recommended that at least one primary protector and a recovery protector be added to a data volume.
|
||||
Data volumes use the same syntax for encryption as operating system volumes but they do not require protectors for the operation to complete. Encrypting data volumes can be done using the base command: `manage-bde -on <drive letter>` or you can choose to add additional protectors to the volume first. We recommend that you add at least one primary protector and a recovery protector to a data volume.
|
||||
|
||||
A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn BitLocker on.
|
||||
A common protector for a data volume is the password protector. In the example below, we add a password protector to the volume and turn on BitLocker.
|
||||
|
||||
```powershell
|
||||
manage-bde -protectors -add -pw C:
|
||||
@ -101,11 +101,11 @@ The BitLocker Repair Tool (Repair-bde) can be used to access encrypted data on a
|
||||
|
||||
>**Tip:** If you are not backing up recovery information to AD DS or if you want to save key packages alternatively, you can use the command `manage-bde -KeyPackage` to generate a key package for a volume.
|
||||
|
||||
The Repair-bde command-line tool is intended for use when the operating system does not start or when you cannot start the BitLocker Recovery Console. You should use Repair-bde if the following conditions are true:
|
||||
The Repair-bde command-line tool is intended for use when the operating system does not start or when you cannot start the BitLocker Recovery Console. Use Repair-bde if the following conditions are true:
|
||||
|
||||
1. You have encrypted the drive by using BitLocker Drive Encryption.
|
||||
2. Windows does not start, or you cannot start the BitLocker recovery console.
|
||||
3. You do not have a copy of the data that is contained on the encrypted drive.
|
||||
- You have encrypted the drive by using BitLocker Drive Encryption.
|
||||
- Windows does not start, or you cannot start the BitLocker recovery console.
|
||||
- You do not have a copy of the data that is contained on the encrypted drive.
|
||||
|
||||
>**Note:** Damage to the drive may not be related to BitLocker. Therefore, we recommend that you try other tools to help diagnose and resolve the problem with the drive before you use the BitLocker Repair Tool. The Windows Recovery Environment (Windows RE) provides additional options to repair computers.
|
||||
|
||||
@ -249,7 +249,7 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work
|
||||
|
||||
Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they are encrypting prior to running Windows PowerShell cmdlets.
|
||||
A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the <code>Get-BitLockerVolume</code> cmdlet.
|
||||
The <code>Get-BitLockerVolume</code> cmdlet output gives information on the volume type, protectors, protection status and other details.
|
||||
The <code>Get-BitLockerVolume</code> cmdlet output gives information on the volume type, protectors, protection status, and other details.
|
||||
|
||||
>**Tip:** Occasionally, all protectors may not be shown when using `Get-BitLockerVolume` due to lack of space in the output display. If you do not see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a full listing of the protectors.
|
||||
`Get-BitLockerVolume C: | fl`
|
||||
@ -263,9 +263,9 @@ $vol = Get-BitLockerVolume
|
||||
$keyprotectors = $vol.KeyProtector
|
||||
```
|
||||
|
||||
Using this, you can display the information in the $keyprotectors variable to determine the GUID for each protector.
|
||||
By using this script, you can display the information in the $keyprotectors variable to determine the GUID for each protector.
|
||||
|
||||
Using this information, you can then remove the key protector for a specific volume using the command:
|
||||
By using this information, you can then remove the key protector for a specific volume using the command:
|
||||
|
||||
```powershell
|
||||
Remove-BitLockerKeyProtector <volume>: -KeyProtectorID "{GUID}"
|
||||
@ -291,8 +291,8 @@ Enable-BitLocker C: -StartupKeyProtector -StartupKeyPath <path> -SkipHardwareTes
|
||||
|
||||
### Using the BitLocker Windows PowerShell cmdlets with data volumes
|
||||
|
||||
Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a
|
||||
SecureString value to store the user defined password.
|
||||
Data volume encryption using Windows PowerShell is the same as for operating system volumes. Add the desired protectors prior to encrypting the volume. The following example adds a password protector to the E: volume using the variable $pw as the password. The $pw variable is held as a
|
||||
SecureString value to store the user-defined password.
|
||||
|
||||
```powershell
|
||||
$pw = Read-Host -AsSecureString
|
||||
@ -301,11 +301,11 @@ Enable-BitLockerKeyProtector E: -PasswordProtector -Password $pw
|
||||
```
|
||||
### Using an AD Account or Group protector in Windows PowerShell
|
||||
|
||||
The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2012, is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly failover to and be unlocked by any member computer of the cluster.
|
||||
The **ADAccountOrGroup** protector, introduced in Windows 8 and Windows Server 2012, is an Active Directory SID-based protector. This protector can be added to both operating system and data volumes, although it does not unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding a SID-based protector for the Cluster Name Object (CNO) that lets the disk properly fail over to and be unlocked by any member computer of the cluster.
|
||||
|
||||
>**Warning:** The **ADAccountOrGroup** protector requires the use of an additional protector for use (such as TPM, PIN, or recovery key) when used on operating system volumes
|
||||
|
||||
To add an **ADAccountOrGroup** protector to a volume requires either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G.
|
||||
To add an **ADAccountOrGroup** protector to a volume, use either the actual domain SID or the group name preceded by the domain and a backslash. In the example below, the CONTOSO\\Administrator account is added as a protector to the data volume G.
|
||||
|
||||
```powershell
|
||||
Enable-BitLocker G: -AdAccountOrGroupProtector -AdAccountOrGroup CONTOSO\Administrator
|
||||
|
||||
@ -37,7 +37,7 @@ BitLocker has a storage driver stack that ensures memory dumps are encrypted whe
|
||||
|
||||
## Can BitLocker support smart cards for pre-boot authentication?
|
||||
|
||||
BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them very difficult.
|
||||
BitLocker does not support smart cards for pre-boot authentication. There is no single industry standard for smart card support in the firmware, and most computers either do not implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them difficult.
|
||||
|
||||
## Can I use a non-Microsoft TPM driver?
|
||||
|
||||
@ -69,7 +69,7 @@ The **Save to USB** option is not shown by default for removable drives. If the
|
||||
|
||||
## Why am I unable to automatically unlock my drive?
|
||||
|
||||
Automatic unlocking for fixed data drives requires that the operating system drive also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers.
|
||||
Automatic unlocking for fixed data drives requires the operating system drive to also be protected by BitLocker. If you are using a computer that does not have a BitLocker-protected operating system drive, the drive cannot be automatically unlocked. For removable data drives, you can add automatic unlocking by right-clicking the drive in Windows Explorer and clicking **Manage BitLocker**. You will still be able to use the password or smart card credentials you supplied when you turned on BitLocker to unlock the removable drive on other computers.
|
||||
|
||||
## Can I use BitLocker in Safe Mode?
|
||||
|
||||
@ -95,8 +95,8 @@ Yes. However, shadow copies made prior to enabling BitLocker will be automatical
|
||||
## Does BitLocker support virtual hard disks (VHDs)?
|
||||
|
||||
BitLocker should work like any specific physical machine within its hardware limitations as long as the environment (physical or virtual) meets Windows Operating System requirements to run.
|
||||
- With TPM - Yes it is supported
|
||||
- Without TPM - Yes it is supported (with password protector)
|
||||
- With TPM: Yes, it is supported.
|
||||
- Without TPM: Yes, it is supported (with password protector).
|
||||
|
||||
BitLocker is also supported on data volume VHDs, such as those used by clusters, if you are running Windows 10, Windows 8.1, Windows 8, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Protecting cluster shared volumes and storage area networks with BitLocker (Windows 10)
|
||||
description: This topic for IT pros describes how to protect CSVs and SANs with BitLocker.
|
||||
description: This article for IT pros describes how to protect CSVs and SANs with BitLocker.
|
||||
ms.assetid: ecd25a10-42c7-4d31-8a7e-ea52c8ebc092
|
||||
ms.reviewer:
|
||||
ms.prod: w10
|
||||
@ -23,7 +23,7 @@ ms.custom: bitlocker
|
||||
**Applies to**
|
||||
- Windows Server 2016
|
||||
|
||||
This topic for IT pros describes how to protect CSVs and SANs with BitLocker.
|
||||
This article for IT pros describes how to protect CSVs and SANs with BitLocker.
|
||||
|
||||
BitLocker can protect both physical disk resources and cluster shared volumes version 2.0 (CSV2.0). BitLocker on clustered volumes allows for an additional layer of protection for administrators wishing to protect sensitive, highly available data. By adding additional protectors to the clustered volume, administrators can also add an additional barrier of security to resources within an organization by allowing only certain user accounts access to unlock the BitLocker volume.
|
||||
|
||||
@ -38,15 +38,15 @@ BitLocker on volumes within a cluster are managed based on how the cluster servi
|
||||
Alternatively, the volume can be a cluster-shared volume, a shared namespace, within the cluster. Windows Server 2012 expanded the CSV architecture, now known as CSV2.0, to enable support for BitLocker. When using BitLocker with volumes designated for a cluster, the volume will need to turn on
|
||||
BitLocker before its addition to the storage pool within cluster or put the resource into maintenance mode before BitLocker operations will complete.
|
||||
|
||||
Windows PowerShell or the manage-bde command line interface is the preferred method to manage BitLocker on CSV2.0 volumes. This is recommended over the BitLocker Control Panel item because CSV2.0 volumes are mount points. Mount points are an NTFS object that is used to provide an entry point to other volumes. Mount points do not require the use of a drive letter. Volumes that lack drive letters do not appear in the BitLocker Control Panel item. Additionally, the new Active Directory-based protector option required for cluster disk resource or CSV2.0 resources is not available in the Control Panel item.
|
||||
Windows PowerShell or the manage-bde command-line interface is the preferred method to manage BitLocker on CSV2.0 volumes. This method is recommended over the BitLocker Control Panel item because CSV2.0 volumes are mount points. Mount points are an NTFS object that is used to provide an entry point to other volumes. Mount points do not require the use of a drive letter. Volumes that lack drive letters do not appear in the BitLocker Control Panel item. Additionally, the new Active Directory-based protector option required for cluster disk resource or CSV2.0 resources is not available in the Control Panel item.
|
||||
|
||||
>**Note:** Mount points can be used to support remote mount points on SMB based network shares. This type of share is not supported for BitLocker encryption.
|
||||
|
||||
For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde -WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This is blocked in order to avoid expanding thinly provisioned volumes to occupy the entire backing store while wiping the unoccupied (free) space.
|
||||
For thinly provisioned storage, such as a Dynamic Virtual Hard Disk (VHD), BitLocker runs in Used Disk Space Only encryption mode. You cannot use the **manage-bde -WipeFreeSpace** command to transition the volume to full-volume encryption on these types of volumes. This action is blocked in order to avoid expanding thinly provisioned volumes to occupy the entire backing store while wiping the unoccupied (free) space.
|
||||
|
||||
### Active Directory-based protector
|
||||
|
||||
You can also use an Active Directory Domain Services (AD DS) protector for protecting clustered volumes held within your AD DS infrastructure. The **ADAccountOrGroup** protector is a domain security identifier (SID)-based protector that can be bound to a user account, machine account or group. When an unlock request is made for a protected volume, the BitLocker service interrupts the request and uses the BitLocker protect/unprotect APIs to unlock or deny the request. BitLocker will unlock protected volumes without user intervention by attempting protectors in the following order:
|
||||
You can also use an Active Directory Domain Services (AD DS) protector for protecting clustered volumes held within your AD DS infrastructure. The **ADAccountOrGroup** protector is a domain security identifier (SID)-based protector that can be bound to a user account, machine account, or group. When an unlock request is made for a protected volume, the BitLocker service interrupts the request and uses the BitLocker protect/unprotect APIs to unlock or deny the request. BitLocker will unlock protected volumes without user intervention by attempting protectors in the following order:
|
||||
|
||||
1. Clear key
|
||||
2. Driver-based auto-unlock key
|
||||
@ -61,7 +61,7 @@ You can also use an Active Directory Domain Services (AD DS) protector for prote
|
||||
|
||||
### Turning on BitLocker before adding disks to a cluster using Windows PowerShell
|
||||
|
||||
BitLocker encryption is available for disks before or after addition to a cluster storage pool. The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource does not require suspending the resource to complete the operation. To turn on BitLocker for a disk before adding it to a cluster, do the following:
|
||||
BitLocker encryption is available for disks before or after addition to a cluster storage pool. The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource does not require suspending the resource to complete the operation. To turn on BitLocker for a disk before adding it to a cluster:
|
||||
|
||||
1. Install the BitLocker Drive Encryption feature if it is not already installed.
|
||||
2. Ensure the disk is formatted NTFS and has a drive letter assigned to it.
|
||||
@ -84,7 +84,7 @@ BitLocker encryption is available for disks before or after addition to a cluste
|
||||
|
||||
### Turning on BitLocker for a clustered disk using Windows PowerShell
|
||||
|
||||
When the cluster service owns a disk resource already, it needs to be set into maintenance mode before BitLocker can be enabled. Use the following steps for turning BitLocker on for a clustered disk:
|
||||
When the cluster service owns a disk resource already, it needs to be set into maintenance mode before BitLocker can be enabled. Use the following steps for turning on BitLocker for a clustered disk:
|
||||
|
||||
1. Install the BitLocker Drive Encryption feature if it is not already installed.
|
||||
2. Check the status of the cluster disk using Windows PowerShell.
|
||||
@ -122,11 +122,11 @@ When the cluster service owns a disk resource already, it needs to be set into m
|
||||
|
||||
### Adding BitLocker encrypted volumes to a cluster using manage-bde
|
||||
|
||||
You can also use manage-bde to enable BitLocker on clustered volumes. The steps needed to add a physical disk resource or CSV2.0 volume to an existing cluster includes the following:
|
||||
You can also use manage-bde to enable BitLocker on clustered volumes. Follow these steps to add a physical disk resource or CSV2.0 volume to an existing cluster:
|
||||
|
||||
1. Verify the BitLocker Drive Encryption feature is installed on the computer.
|
||||
2. Ensure new storage is formatted as NTFS.
|
||||
3. Encrypt the volume, add a recovery key and add the cluster administrator as a protector key using the manage-bde command line interface (see example):
|
||||
3. Encrypt the volume, add a recovery key, and add the cluster administrator as a protector key by using the manage-bde command-line interface (see example):
|
||||
|
||||
- `Manage-bde -on -used <drive letter> -RP -sid domain\CNO$ -sync`
|
||||
|
||||
@ -135,16 +135,17 @@ You can also use manage-bde to enable BitLocker on clustered volumes. The steps
|
||||
|
||||
4. Open the Failover Cluster Manager snap-in or cluster PowerShell cmdlets to enable the disk to be clustered
|
||||
|
||||
- Once the disk is clustered it can also be enabled for CSV.
|
||||
- Once the disk is clustered, it can also be enabled for CSV.
|
||||
|
||||
5. During the resource online operation, cluster will check to see if the disk is BitLocker encrypted.
|
||||
|
||||
1. If the volume is not BitLocker enabled, traditional cluster online operations occur.
|
||||
2. If the volume is BitLocker enabled, the following check occurs:
|
||||
|
||||
- If volume is **locked**, BitLocker will impersonate the CNO and unlock the volume using the CNO protector. If this operation fails an event will be logged that the volume could not be unlocked and the online operation will fail.
|
||||
- If volume is **locked**, BitLocker will impersonate the CNO and unlock the volume using the CNO protector. If this operation fails, an event will be logged that the volume could not be unlocked and the online operation will fail.
|
||||
|
||||
6. Once the disk is online in the storage pool, it can be added to a CSV by right-clicking the disk resource and choosing **Add to cluster shared volumes**.
|
||||
|
||||
6. Once the disk is online in the storage pool, it can be added to a CSV by right clicking on the disk resource and choosing "**Add to cluster shared volumes**".
|
||||
CSVs can include both encrypted and unencrypted volumes. To check the status of a particular volume for BitLocker encryption, administrators can utilize the manage-bde -status command with a path to the volume inside the CSV namespace as seen in the example command line below.
|
||||
|
||||
```powershell
|
||||
@ -153,11 +154,11 @@ manage-bde -status "C:\ClusterStorage\volume1"
|
||||
|
||||
### Physical Disk Resources
|
||||
|
||||
Unlike CSV2.0 volumes, physical disk resources can only be accessed by one cluster node at a time. This means that operations such as encrypting, decrypting, locking or unlocking volumes require context to perform. For example, you cannot unlock or decrypt a physical disk resource if you are not administering the cluster node that owns the disk resource because the disk resource is not available.
|
||||
Unlike CSV2.0 volumes, physical disk resources can only be accessed by one cluster node at a time. So operations such as encrypting, decrypting, locking, or unlocking volumes require context to perform. For example, you cannot unlock or decrypt a physical disk resource if you are not administering the cluster node that owns the disk resource because the disk resource is not available.
|
||||
|
||||
### Restrictions on BitLocker actions with cluster volumes
|
||||
|
||||
The following table contains information about both Physical Disk Resources (i.e. traditional failover cluster volumes) and Cluster Shared Volumes (CSV) and the actions that are allowed by BitLocker in each situation.
|
||||
The following table contains information about both Physical Disk Resources (that is, traditional failover cluster volumes) and Cluster Shared Volumes (CSV) and the actions that are allowed by BitLocker in each situation.
|
||||
|
||||
<table>
|
||||
<colgroup>
|
||||
@ -268,7 +269,7 @@ In the case where a physical disk resource experiences a failover event during c
|
||||
|
||||
### Other considerations when using BitLocker on CSV2.0
|
||||
|
||||
Some other considerations to take into account for BitLocker on clustered storage include the following:
|
||||
Also take these considerations into account for BitLocker on clustered storage:
|
||||
- BitLocker volumes have to be initialized and beginning encryption before they are available to add to a CSV2.0 volume.
|
||||
- If an administrator needs to decrypt a CSV volume, remove the volume from the cluster or put into disk maintenance mode. You can add the CSV back to the cluster while waiting for decryption to complete.
|
||||
- If an administrator needs to start encrypting a CSV volume, remove the volume from the cluster or put it in maintenance mode.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Information protection (Windows 10)
|
||||
description: Learn more about how to protect sesnsitive data across your ogranization.
|
||||
description: Learn more about how to protect sensitive data across your organization.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -82,20 +82,24 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if
|
||||
### Using System information
|
||||
|
||||
1. Launch MSINFO32.exe in a command prompt, or in the Windows search bar.
|
||||
|
||||
2. Check the value of **Kernel DMA Protection**.
|
||||
|
||||
|
||||
|
||||
3. If the current state of **Kernel DMA Protection** is OFF and **Hyper-V - Virtualization Enabled in Firmware** is NO:
|
||||
|
||||
- Reboot into BIOS settings
|
||||
- Turn on Intel Virtualization Technology.
|
||||
- Turn on Intel Virtualization Technology for I/O (VT-d). In Windows 10 version 1803, only Intel VT-d is supported. Other platforms can use DMA attack mitigations described in [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md).
|
||||
- Reboot system into Windows 10.
|
||||
|
||||
>[!NOTE]
|
||||
> **Hyper-V - Virtualization Enabled in Firmware** is NOT shown when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is shown because this means that **Hyper-V - Virtualization Enabled in Firmware** is YES.
|
||||
>[!NOTE]
|
||||
> **Hyper-V - Virtualization Enabled in Firmware** is not available when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is displayed. This means that **Hyper-V - Virtualization Enabled in Firmware** is set to Yes and the **Hyper-V** Windows feature is enabled. Enabling Hyper-V virtualization in Firmware (IOMMU) is required to enable **Kernel DMA Protection**, even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](https://docs.microsoft.com/windows-hardware/design/device-experiences/oem-kernel-dma-protection).
|
||||
|
||||
4. If the state of **Kernel DMA Protection** remains Off, then the system does not support this feature.
|
||||
|
||||
For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection.
|
||||
For systems that do not support Kernel DMA Protection, please refer to the [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md) or [Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating system](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) for other means of DMA protection.
|
||||
|
||||
## Frequently asked questions
|
||||
|
||||
|
||||
@ -84,7 +84,7 @@ These requirements help protect you from rootkits while allowing you to run any
|
||||
- **Configure UEFI to trust your custom bootloader.** All Certified For Windows 10 PCs allow you to trust a non-certified bootloader by adding a signature to the UEFI database, allowing you to run any operating system, including homemade operating systems.
|
||||
- **Turn off Secure Boot.** All Certified For Windows 10 PCs allow you to turn off Secure Boot so that you can run any software. This does not help protect you from bootkits, however.
|
||||
|
||||
To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. For more information about Secure Boot, read the blog, [Protecting the pre-OS environment with UEFI](https://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx).
|
||||
To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings.
|
||||
|
||||
Like most mobile devices, ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system. Fortunately, there is a large market of ARM devices designed to run other operating systems.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user