From 5629f3c98411af347c2ea06347f8fd771f816a39 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 3 Oct 2023 09:35:45 -0400 Subject: [PATCH] tabbed xp --- .../data-protection/bitlocker/configure.md | 38 ------ .../data-protection/bitlocker/images/cmd.png | Bin 0 -> 626 bytes .../bitlocker/images/manage-bde-status.png | Bin 18409 -> 0 bytes .../bitlocker/images/powershell.png | Bin 0 -> 1166 bytes .../data-protection/bitlocker/manage.md | 117 +++++++++++------- 5 files changed, 74 insertions(+), 81 deletions(-) create mode 100644 windows/security/operating-system-security/data-protection/bitlocker/images/cmd.png delete mode 100644 windows/security/operating-system-security/data-protection/bitlocker/images/manage-bde-status.png create mode 100644 windows/security/operating-system-security/data-protection/bitlocker/images/powershell.png diff --git a/windows/security/operating-system-security/data-protection/bitlocker/configure.md b/windows/security/operating-system-security/data-protection/bitlocker/configure.md index 36223aee22..5c03db8446 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/configure.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/configure.md @@ -37,15 +37,6 @@ For the operating system volume the **BitLocker Drive Encryption Wizard** presen 1. When the **BitLocker Drive Encryption Wizard** first launches, it verifies the computer meets the BitLocker system requirements for encrypting an operating system volume. By default, the system requirements are: - |Requirement|Description| - |--- |--- | - |Hardware configuration|The computer must meet the minimum requirements for the supported Windows versions.| - |Operating system|BitLocker is an optional feature that can be installed by Server Manager on Windows Server 2012 and later.| - |Hardware TPM|TPM version 1.2 or 2.0.

A TPM isn't required for BitLocker; however, only a computer with a TPM can provide the additional security of pre-startup system integrity verification and multifactor authentication.| - |UEFI firmware/BIOS configuration|| - |File system| One FAT32 partition for the system drive and one NTFS partition for the operating system drive. This requirement is applicable for computers that boot natively with UEFI firmware.
For computers with legacy BIOS firmware, at least two NTFS disk partitions, one for the system drive and one for the operating system drive.
For either firmware, the system drive partition must be at least 350 megabytes (MB) and set as the active partition.| - |Hardware encrypted drive prerequisites (optional)|To use a hardware encrypted drive as the boot drive, the drive must be in the uninitialized state and in the security inactive state. In addition, the system must always boot with native UEFI version 2.3.1 or higher and the CSM (if any) disabled.| - If the volume doesn't pass the initial configuration for BitLocker, the user is presented with an error dialog describing the appropriate actions to be taken. 2. Upon passing the initial configuration, users may be prompted to enter a password for the volume, for example, if a TPM isn't available. If a TPM is available, the password screen will be skipped. @@ -231,10 +222,6 @@ manage-bde.exe -protectors -add -pw C: manage-bde.exe -on C: ``` -## Encrypting volumes using the BitLocker Windows PowerShell cmdlets - - - ## Checking BitLocker status To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, `manage-bde.exe` command-line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use. We'll look at each of the available methods in the following section. @@ -257,31 +244,6 @@ The drive security window displays prior to changing the volume status. Selectin Once BitLocker protector activation is completed, the completion notice is displayed. -### Checking BitLocker status with `manage-bde.exe` - -Administrators who prefer a command-line interface can utilize `manage-bde.exe` to check volume status. Manage-bde is capable of returning more information about the volume than the graphical user interface tools in the control panel. For example, `manage-bde.exe` can display the BitLocker version in use, the encryption type, and the protectors associated with a volume. - -To check the status of a volume using `manage-bde.exe`, use the following command: - -```powershell -manage-bde.exe -status -``` - -> [!NOTE] -> If no volume letter is associated with the -status command, all volumes on the computer display their status. - -### Checking BitLocker status with Windows PowerShell - -Windows PowerShell commands offer another way to query BitLocker status for volumes. Like `manage-bde.exe`, Windows PowerShell includes the advantage of being able to check the status of a volume on a remote computer. - -Using the Get-BitLockerVolume cmdlet, each volume on the system displays its current BitLocker status. To get information that is more detailed on a specific volume, use the following command: - -```powershell -Get-BitLockerVolume -Verbose | fl -``` - -This command displays information about the encryption method, volume type, key protectors, and more. - ### Provisioning BitLocker during operating system deployment Administrators can enable BitLocker prior to operating system deployment from the Windows Pre-installation environment. Enabling BitLocker prior to the operating system deployment is done with a randomly generated clear key protector applied to the formatted volume and by encrypting the volume prior to running the Windows setup process. If the encryption uses the **Used Disk Space Only** option described later in this document, this step takes only a few seconds and incorporates well into regular deployment processes. diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/cmd.png b/windows/security/operating-system-security/data-protection/bitlocker/images/cmd.png new file mode 100644 index 0000000000000000000000000000000000000000..55fd5b43ff09f8c5755346bdb48d00f8c4efe638 GIT binary patch literal 626 zcmV-&0*(ENP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGqB>(^xB>_oNB=7(L0tZP%K~z{r?Uzey z8c`UAhbR#VK|ygL2;LAuMG!?45kyo()W6Yv$Rbbz=AxZwu~MrkO@2?CcwZ$ev&&zw ztGqp*H)eDaBsdzVFFZINzcb%6!$HpBcG-IPO6_yu;tMv(MX_99t@jywT!}BgJPw~R zcz9wA*UG1pn&c-*u;zxbM78!~)a?&2r#C=Hl0G`!KH777XmuvgIL+(!Sq-bB-)a25 z-Njw2gFp9e{Jv|=nF`n#2VC>|c9hTOLF95dWV2ahG8v@PX{1sqBoYb4<8j1dF+`(L zL?RJ{!(jx2LHPZC_B%UN>NPnT{paDhf5=AWUks`$P5=M^ M07*qoM6N<$g71X|O8@`> literal 0 HcmV?d00001 diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/manage-bde-status.png b/windows/security/operating-system-security/data-protection/bitlocker/images/manage-bde-status.png deleted file mode 100644 index 321b1fa0526133725f877fe4398d319ffa3ad04e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 18409 zcmce;bx@qm`ZhQ*2p%A~ySoh@+z0nCxCVEJpuyeUg1ftWfZ*=#?zY2w&VKtlU!AJ0 z-L2X`sOe{>yQiOL`j+dyt|mwhB!&Qs4GRDO5G2Hf6##(utN_5fgwO9G@6ZHk1wmfk z*(rz#0?I~l_aPS_jRj-`0D#H}xF_9DkZTxgadkTY0I~b+?_IxDfdK#@<|!d8pyUib zPLl~{TejJ){e^#ppN==6Sx{I<=qeYsr+(W&LCv#Qk0Z>`G1Y-8`;i?Jz6;ab&#%%@ zJ>C#U_l&EFWYkzV^;b+%{mF>iN$V?tU>rr;*x;XE^=;`7D_&3iUhYVcZ&wTUdcF0^ ze|`0WTy$WcSwB3VdPS^%1ORmKoPp1a?aw#?r~rVs!`k{)`RhYDCJ54R=4aq!`_pi{ z4)7gh255ZH>(kh4=>HmYQ{Uce4Y~aaM4r@_{frk==G2$j*ZcOs7u6-mXm6?Y^{bTC zCnLU8&+ElivDZh2*G;eC*Z#LLXAY2W-Q<7SbO$~^VYDyZw+~uBOcHpWy750vR#ik^ zJgz>M(HcFSG@r`S?k-%ealz8W=3qu7pGq4x+P(vn!*Jwkzdp=fy^1h?y9@}sK}Mu7 zn_YcfM`|ayZd>l&7rg0zwIwrUyrz0;K5YvjzwodQRE%2kY*>8|{QyY+m`+InPmwOO z`b_`og-m6+Tn*{3N4B)mJ%*H^vy>TIVn+f1Fd)drrgc*>Tsrj82I&B&3k`mwI@#_# zu6n4tshEMiG`6O;izR-TmNw_XU0l|VMEFEjblLe@?8P+HQSK>g3^9siF5Op=(pPw} zv3|^|l`a6Ok0kCqIBJQMmQ${To!CY?!FqF3z=B#Hyg zJpJq9r6Su1NsrQN;a!Efi8wiqr11%{>6c{Hwv!M^mWp^X_=Gw5BLA9^foG~Nxy`(a zWmc0&@i_-8H?r`iad#2Z!Mp{BTeuKaaPJoYfL!hs$ev0%pGk{yVx2uRg^f~QI79B1 zV#X`Q&T#8$sm=hDQHAb<(Ll5Rm_0ibNlaJMEYNIUC)7Bb0<~ZDrTI>5d5>rTUcpF} za^?Cx!264(IEL2_DFgG0b+)I0xW&+EVwFqdteq5I1YH~%WBzeKl>uAANM7fZ42|BBMf8wPemP#JN0@dLS@=bFe9`Qd-Upphi zBrU{i>DvsVZPDnfH`^93I3!dkUK0<=9$NTcK&DHkEoq05l4L)E!rGr;w4tYIlk{K! z06wq3tF{9k>*9j+ITX^Ub-f6)6Psr@{V8%I{3nz`yj3TduFV9W5}PZIT*v?VH;0n$ zgS)KohuT+IF%OZx?=j<8K7A7wf@7fLdlvtsXekt3#0CI3Tjwx@z{#y~Hoo^HU^66rKQvTG~+L31U z%H>(d(kc7<3T6kOyyo#~-(NSCAEMun`!&^BZz2N5qn+kRz)h={fiZmk=ii@V9;oX* z@fDu3ELWtAv=4G_ELUjF2E=WiPNrCwfs}#pH}NnXG;#r`tuoS{oKt!tcgs#(Coi*Z z@L&9R1{x9i3X?Q5zs_HO=pgfIYhUcDZs5yUZ00f}*d{Z+jSo1ludX~a`8I)?fd_~e zgQsw1np`|Te%^d8ZH?a7l4>|r%xhJ>H?#zAcpOIA(^4e_5Agkn74{zporVnn&<^I^ z$O#2R)Ys`&(mB8@kc3cI_O)b_Nx126vxruQ$!cD4U2A1250|p3_tj8pnJG%S8RDm< zK+jWXw<0-!K8mFUzAeSje;2E77M5VvD1rpQ;D-xZU2*0*HM7)I6o?UfkS#_Yx!mxW;2G^>mknOdyb-bdJY?) zToMbkJ(9V9buLhC>in}0gW5G=u8O88?)r441Z#DAE*+~_LYR#6t0H#K_F)2PByu3U z#$T5GR136eS=-0Tx$`(sV~|XAmJ+eS^dXmj07LWdl##>A!ecJrXRY4Qwh&=QX|}v@ zt4sBN)?kYmr{a#8@$3e`quWnJ7mXH*{{+ZH%73uT=`lnYyj3&1EPUBZ)kD zL2MAIWo15g<18U{F6blkMx+3o2D$$1R$Z)7!sTB%^H=1*$8!Uz-Ctu`1gWCcirn@@ z2XQ{?l3%NpTemO#P41nN`RXjex+^gqlyid+quM=$%N!~T+bC2`+aTet2mqtAq+*LQ zwk*+FuadPRs1-hvSIJiEkcW}?@zV&$73;@2n^@;wp?s={iNqxnNS5y z%1IBKPv{zp@#w@TQJP3@sF(-&d`@*ONzkgd=Pt$^aH9;#`UnPnz^k=NYzg>{u!-}k z)13}v{IsS#*d3%z|16oTYRJl1ZmeG;eKnh~#xduH?0-7tDI3l?c*Wv{#B)6TWdC-< z5BtATzZ(`SP7@zc-0${_Nv5_16iuQB9PwqT58W2V(O!n$Zed$M!NB=E!wM-lKRRFz zp)q-EV;sZz7JA=K#LBxJQ-Rdm#2VV!j9C&^aAz~riokvWMR)Gq6{UF z?OKz%*LLFR;LJR~ko+s!bcMK<&iO|>_mOXlS$oqBWm_cl?oN7Vc=fxrI7;oA4@jRm zcorQyb9~l6dcW`9x9PNYC5N~kIUOJ`{j-$Fo*5FnB?$okKRnOB-IX!WgQYzZyK>f2 zcOv02VL|v6s)xo4S}*Hy!s^${e2lm!^5gAr{2dV{oM++|6;=T1Yg_+H{_8J`y3s^v zDy3LNLWQe%xp`+wPDd6j*N&Ip)`%}Zqp#G$p1-LsEPZP!=Uz^DvUhP&-{jqodLn$h z<(6{3<8;9WJMGGbVS&U>FJ2O2h%tn2_9eu@s{3db<5hZhk6bA1Nyhn+&jem_A!sn5 z%fB)bfpa61?XgN_s+)h?K;9V<>jYIpADzf!S3}jirbjP%{+SRPG#)c1l*!2R0fPr4 z_4k9xZCO^a5={O}*RZ%Qc>h#MW^8y&O2JCIG1l>mUUUBj;|4IK6<)p|s%glwdt|ta z#EZd95V4n_k5Yu=%b=L8THUNa`{0-SAIuUNs0)lUv3ujOw$*A?j)$ZV9-Ld_BP$DFxXK9c~`9q+*BlDQ(<#gg=P@$ zSjB*tc|)X_bVhf$=is+<6o)3VlEH+bL3}B=jk$TIjuuoyuUpmU+_=jrny!cf?-1-d z54d*q}*jZwR4g%AjXvsJLPuSDP%prXnuDOmzcl8eHx!rl-D=fV@$tN z^0n_EP9&qIx+!cPqW+M;QA{q}3NCcmL()stu9fLBDV0Z4X(0O1FNFX%PUCl)VIQ8u))} zki9X?@pq|RC*6Re9>wgNQ4HE5u^X0`VpD>l`N6v&hk<>Z?!nA0d3|_9gv}d=%3pW8 z$)e<`ARa;)9)xm?%fqUf!PzM2?*byvrI3M^%0A&WLOm_$NZ^`+ZqxlJbguu&zmr)v z??kgpwAak?boa~`DzX%Vcob)AYNM`+62t&LHK=01q5D&e7W2yv7%JLdc~2ANZeYo2 zW=fM*HWAP~#?slAG7aT$!l{nMUxT#4velh@L4?{fF7I5c4oSV)+jmJbfC;=2bV82l zSzj+}CANPd@`P-LOV{QI)U1v(XPLp&QF`RxxY?R_GWk0^o3=8Zk{Y8{KdU?o;I5lV zO;)lB)linRllsFZGP@e8hi=Nv%gGW&NBp6KrbFA(_#vdleyB7Z&pR#3?j9@VPV%UZ zU^=;v(%}IqX^^mUl)H67lR?{M zBMyhsaGaauXBMY+{es|vnhd}2a?n7ntRJUv4Ia1CVZ;R#r^EBmnjEg_$!q7j;Q6#m z5Izf!v0?UxF-ASD|Fx8E3~70n@RSoNnp@Rw9mzldJKB|Q{!GOuMb)3JQAy8l><2L{Uxc&66EbISOYWDwOP*eTu{c!Y1qk#CC!yU}MGfl{sB_2RJK3nQuTDf`q9_UI?CfO(Hd)zu5uBH@=1QE&*p_}!MAM9+d^z4;5-3)1Y z-K>hxGt5}JVV4peo*UWFuO1I=I;bGNm1;#^gnZ_9u;%x0h|S~jm!pn^=$|w&Fo!JL zPdd1jyUL6%3W~VI?TA0Y6uo?JSwjF?Zz{|un6E@qodzhemINP(tZI{boU$o&t50X$dlU9aI9=qs zrI`(WS{Pmc`Lx)yXVCM%exomv*I@|Jxs2Bwn0EL!s#)sidy(fK<0Sj^rBTdxU?ynv z=h=~ivo6yhT!)lmz+_%|tw*g%+6veC_<;jH-5x`!XXoP3gR1|4DnB}R+XNLE`$|un zYHlj|`87VX#td>0l^ycte*MFK|?57WiUs*f^G)|_Vp zR?pAPP;Fd+VoF+Ks^qlfF7KR8+kmM7j^BQo+#f&tX3j=T9q`ufi2em@K+>s=QV?si zI+%T^UD zER_7u9kTJ;v5jh$s&|LOcN>w?>KlJlQf`<$@mf2Vf0l4Y6gFsgpk`+PFv#G6p4tW+ ze|u>#w6c#L#>!b?t9yF7=Q8w9#%9tS=dH>UyPB$l=@kvbd44px$8)e4$QC@H&G3=s z^9cR&sg&JeXP(8Kl_O~=qdjWVyM&ra#MO0I2VKw*73=

c6osWl_oPMpOc?FT&EB z9zxcjwKp=ngpkCJMheg4w%%d(I+N4_XkoPgBHxz|?m1DIw#-sxtrTAU-id2aszeoB zSrxl5QU52m3LN@4N5eI*+I2&d$VPH=Ai@HyIcKpzJ0Dpn!2@JN#v}kh``;+=KU__v6)?|=GWF5JkIV~jhPYcn8sUYwp=qE;P<(v& zZnTkLOK>&P<7pT5ivutyA+F+fx_$oTsbNB?@z{D|arqg%e3r$5wrqXc9AwprFs2KI zrgX1ii@3FX`FM1QxNDxyz9VG{T!BN#cXxN}em-AHcqnL1nO%~=q6%M4Oa6^>%CI{# zu&%_BCb@cEaL*9O!22hz>*K)j&hyG+Ktb@#T3!7b;STw}SLYUCNZK{t*u6#}hP$iP zCp@gQdG6=-1#9&D9O;OI8B^Tah>PfIH|XxW#rZjh>Qt7qfEbP3R#M?stvM5oh2+;3 zDT-DnzA!;MG~FtFq=gX?V&-h+VIo$1bK@IDo@}5@wi!lvD7eW%w4#_VP8hvjoGa4F za_igd5&3o#W98K*$1SL|wAj3MqHzD|E^bTDfDgBm6Mx5frGz#_FoJmzBj$?h<8~pI zxIn^)7`f$i4K6#YyszVQN&0VnUH4IKiIS}d8uqWSwp9)>Qjb(u^ zW42F?>WJ@@RGaPv`DtA_ z2s7jB{bYIQrt8*M%g|Te{4DnRwHo=;@1lj*r=p&b#9o_4N?;56t_#CiVR@Rm^b_6) z{pZ+Lr2xp|56aZ|A&bnmkW~<9jb|XOm=uhiM;N+TVOgfZ6a);!Rel;WbSYIe{!95& z&F@@&-0l<3%tptr%Ii4?JA}g|eT1Al-4&nd{t82zI1pFn-_LH@DV01RDj^ofxhm-61?YW&vaOtH8U49q!$YT>EUeH!8*nc7RRBzP(vO)a`*kFV)|IaB`!YrC z-#OZun*F!*5!cq<$w3{g>0vze>rY9EZr7czxyol@UPsjTILB4beQMp5o{9B3vn-S| za?IK|l5G-OC#;xiIz{p3ng*Z~hC}T@}VvRjE z#M@$RoHO;nL81Z_NdA-&Gxf*`Q{VMPpROpe-=X)NxsrZ!RvOQ*|g zd3VdF;tau2b4@-2^Nzmo0dqa`5>>T!6+dP8$UJxx$+d0Pzw(a(gFj3b7~9T~*l~Z2 z?a*X!h8cynGZ_w3C}EUf3WYEZW{MeT_b-(*3ai@<)FtJHH{?Ac9!7;9kEMgAhO-b4Cd|}jOzpkh^3NKj+G>CFm`8P~!6KD^UWoka zs!b%+Nc_9}DceJr5$z0|%pAN$R31$e{pR%&H_S%xT&#%??$bc|1l-xjTA;GgI;^Wvot%67r#*62u;BDUO zm*-@Wi;%f??Yf>@VLB@}FXgpL`EH3P+UG{M_R((Fak@)SAdm}sjQzJ5ld^yC#5*Ne z`Qh~CN*5NKaEDjU3}3HIQeKrDV2(dK$CuMX&@CCiB^W&8EbB_jKk)KAih}P6N)N!8 zcfkSexZF>y4mT31da8*f+;je!_(5sQWRQU$x#bY2P-~*j^wf&}PScz;KT!S}Sw04SznMJdidMQkD#MW184O7vHKKjvM2u_^li(>h&gYiL?BN z*-{-7_BclL>h{>6yJ2O^kvPOH2c#tUi@m)3^}`M350wwLB#e&OsxU8yvxp`F%^F1W zQPk*`P>ttMZ5ve@9M4ExJyPb`xX-RcjQy}6jTZple^;NjQwTuK2zMixt_=F5jWXXq z5a$u5fm;PqXPRK{cFGpdb%2??gk`Xm7pTXKaU~uer!}M5sInBD zy5jV^w$ZZ|H5STiDp~h$Wrm|*-dw!&&*LTlt`q)b=nq_+erUI`GU-H<-yrtpcKR-+3rK=- zit0dqR{kjo0^SWKAgH-zN5sxkZ^&9f6Jt(u9MntMV|p!Rm~+x+-NZh&r-{BG7g#C4 z@fXdI(yvUv$1bIlD8++5N@xpO#VYU&R!3cr+ag?+fRCT=?obng@ylJ|_bgOs4p&>% zS(NxHjr+_{Q5qH|4eiH%)4QjC$tjjO8lQ#Fj+wIpxh?BuNQ$hw-O> zV{Sm=i-{0k-!d=v5iL{a4JeJPj%px?zt(9(s<8rb)1(p1ONY}vm@ddo=aT7HQ#@-x z>>lQ;I~5$PrcPoiq?JzR_@SIQifv0AdsJ6aNztf4SEIwx!5|9W?5zed#_i` zzbd7rlOLI{iKQV}H>}}-AUp=`{W{-#LKynabU@56oC2Uerlu^}8}=5Xo0cOhDY-Tg z(lV)WyBR#9oGz~pG`Ug&JOkteYb@7Ro8+&F21Q6ODY(>`@M&0(*G)wKq@tef#Z8XcCUZ0&mwP9dBOVDg?!Gb zdLeU^mx5+9@J7Hrz+Fv|&%g)B1zXNu?Dqb^dP8yi)gjXBKqBqKVyr(GUHmXkWa`x_ z!UW<6UzKI1pX^ih%z4MdGE31uc6)oNOt=F~v3hOnpMcp=vpCeK|Egqso#IWUwS4DG zC%IbqoQ|t$Ev?&ny)z7b#UdPXVJ4(d;7ygI8s7^78CNv1@exl*Svaqi5KkNJV1c3wmpED5x2u$Y2vYUArtuZB$-Te#s;6phFr+Hc zhD{-r=Z)d=u+Iu(3|Icu!W&wu350nJU&##t5sqioZ8qP;+zH!OiagjfB_1)fo+1U{ zg2WQj?*km6alhg7XS~pjdOAyS++Fl_B(L?Y#8t02ory2$0p}@>-`}l&B`W*Ev@!6* zTXn~@)4GXfxAk<*rs2d|Z$FN&vm}eT-d%xevh2+5xZ}eH|JWMqsM~61jx~g$g48=K zq5gwM`fv5#|7Y~ne+xkWjnjGzP<;6C`uI}zy4VluhLgx64h+VUkX$_Ms`ZazuaI14nm{i-Z6igFp;&^C(4$7_RWlcXTm7ECmx_Tbs?+ z4@EfNhIHJ*{e1Oz&XP~-u`?I`6|S<;g;x5mWI0_TijVqnNH!G>c&RaR`#3HsQy z1UDNfF;1e~h)^)Gzm!ygKh|JP8Xhm}V>G~o^((@R-!bhh+pK$}1;9gqfkffskCl~u zOIi79NF1@nU^iDkUMxGE^J%0Ntix9U|4DEb2_|K%Elr45LOT<|`P{gIs5>o6-HQ>hl- zFs#DeBdW&Fn8Qhh9v`-iBKL|4@CzmQw_~-;*h&nfUetW|qwp1IMZd}m>sWZ`LgT&!06!%!Vn59%OV%P4!o)1`r*W%Dva z4!U~#{Z=Pw8k(x}W_gN}_vbW&y#o;W$}c`U=Cpp~!h52#JlxEnX&;wL06?Ul_ROSA4||5+ zs@eBKv^r-?od6z`|960x7yuAoT4%jVm+!bM?TgcRHR^$_*G7YT$h`6db(J#qsD)7P z*nFp(?x}*188iQ&LVRVVlBB7O*1>N;vrEcF?-9M(5eKKYg}HCD2f39y#;h5#S^<57jAs0$D&_Okp0Z%H5k(12hVip`f^LQ>g6 z@d;DsH5I7rh=jIg>NRmzU}kqH(a(qY}^A3cnf?|5Q-Jj=RbuV4bH%6 zD}CqH0p~9d=$6-$f2g|K)^74kxa%1p3M&;7B#IX_G+uqtpka@;jFT795gVV4N5;Qm zgxhT8(P0$vQ`&eSf0+*uu?hZ=F~|}9I8{d8tDWfgs+ZeqLxa9sZ~mF`034Hl>U^dk z>8cd;=eHvbTdBf1tzYCXM^d$Z>KFPl};9 zuq3I1AK~v=OIB99`gL-IPjvJ zglR|Na;##bqW=*=q`9q2&#B>ixl!Bz@EG#BGg&9a%uu9iiO5A?V?WoQDnouY*2Z3%b1a(a_~p(+ZaKg7W`YR zN~B=Qm6?!DQoFSz?}3^du#0GMzie_5Io*$RzHf1xgwp|p)XgPRtSBY^SCYfNHc$sqUV6ts?qsRS?NkL$0Ou19 z>Fe|hSjhqMK?S^KchK4m*hGs5DWGrVBwZ*87wn$$4d^i9@B;q&W>&QQ;pg5NLkl4Crot1HtMJ&XB~ID5Cor7=o03fYY47|m7K^C@=koJ033u*L$PYOtz#2^|TWS|y zu+e84ICGHp}ZM*O~VU?@XtC7G22)sUjD3dPOYjdCgrU3pi>V7Bn_n|Er+4TJ6X%;$3+f_fXpS03Ay9OIN_cmP| z;O(3G@Bw*=45hmmw|#Ys1g$70i;jo>S+qzq89&NV%0(I7y%43IjyQ)XK|)rOa7j!tW~b@sn^#`L5MB_Tiug90IcN|x(chCO%&nwT?7xrl@eZJ|eh9NSZ1X?2Yg>*NfWS|zMd zOBL;ER`<8Es@U`M`M^7Chm%V~-nWhS{{If*g|h`r;(2~tdI4Mt*#_Eu0C=+ie*j0k z7<#O#{>2mRTW_p}j<-v)NS1X9AyM!}{~5)@b%gjcdSeLT+zz!rhNSJ9NaGK)#z*aB zGV2Y>#r@2WxLEHaTcLLB;RygB{oxIm1Qw!XFWc+pn06Nur`aEF^r@JX5lcHB2{bo~ z3yap6ar*W7>t7Mim6jv+Suy_>*;i;)wJ86?zoKEJ=xIB@Ffjs=G7k106W=%k0Qkvn z9yX+OT0@5hsw9OU`DSKA8Y$YY@UUvS>^@J9c3vM? z8k0m2b#NBaVE{UW>@rR{5j+e{65t(3^L3jP4p+mT2t{7{lnYxHzWZ$tmjz|R4&>eq zZ6Nj=H`2=!|BHF(4Zo1}9W$*?{BF$^VqkF#18`Fe&|5Dgv)sC_SC9;Y(&m?X1Vn@N-L#Df5;}jZAM5-o`Vh_N{EN{5M`ZN`_2m*mc!myrnT(e)LUsIbyW~n7#tyc8;B2 ztzKKdFQZT6_OE15p|yXy4^y7MP%3~^3C)sOL`R;VWxAzVBAh+aLl#G|F{OyCf+?&}w8HwSbtZDRQ9*#0mB(kqf z`-8YLLNmu)I8*RVq*T01U+g6Mj^*4fS`L?%?EbEA?<9Sdk+2M-tRm!Scd#54cn3%i zX}?ctr&5J%#17*Bh5-IIuXq7`6)Wz9dWIgn9*YvYNa%Yhg6y7w!tTLmgjBS~eQT8V z@|+l43o4{#pDC&%KJ%N406EgtF~jSn*x^%#095DqARN&C_NmpM`rC*Ecegvt?6z~; z?)^JpPz!ws`Ms-OvG4jvaB?+7yh=abJZ6zKA#Gc(Q!eZ=twsyxZZ)6jgV1?_5IV0% zR4MXC(;?t)H&b%(b52`1b=a{T?|wAl7&yvyf{k?A=vY+*V?7DWb#_O^%ADa> zYH#N=8pm&{e*p)XcOGxR0Z(32mPQaI8@KrV+Bwh^xb0LyOL|a>7V_j8EOH)xG?}8# zGH{4nkO%{fJgNJ4NQpgE)mZ$5unetGBN(dJyzhtx!r*K9R3y&CJ2LIGkqPkXJ|~%A z_@;guVY`U_$WD86THc5i2LTi<6{?2v8(%M56hvR1WlVn{jMtvRbm-emSSyr=e{1<2 zbfaSG?>yfFM{99)NXgojzGp=1BqcfUH&n}NmecnSGuLZfecjnnx9iR$Z-$a=zDk`< zy2i52)-s2!0&ZzPw|f9yQQ!I)De$2_JMrXJ(b+X&Q$`2Zh?k z{uLTed^`>6!=ZyjT1sT?Lxk08vue^@MaJ|b3Bn^UftHE>CeH^3RdAXF2kzuRr)##L zp1*bklPV6rW5x&qn-M0IcmLMts$EsNty^)8V7qyZp7MRZ8cvZRy}Wy&_M_8G z_2765FOYhpc4n}%)5UP?p2GFS(CKq4!;cZtWU?L z{Hv>fjNheuB;>VsX&yP~ah$eX{OG1id#oz=%)S%7ke+B#hmy{8#iTuXcl8`cFH?dC zug}X>>hN`;4EB3+qU5|g;ybkr7D(c^+l9cL`qfFN#JCprof;H8#aW56oCvo1DqiPwm;qz-MK>!o~ZUm^->vOYbj$5l6-&EuzI+wTS)@|SYNhe zUveStZ8^qex*7X6N;;turc^qX^z^&x8J_P(S~t^uKTG_w4W;g#?0aXB#B4+Bf?I?B()uEfk35(EUU3>z z22e60>*YFno7zBg1tv@mIRafY)kK+-9mPcLamNvY5EYLckj>elh*OM+6_XN2m)kGuY+)h~geP6fwDPjW?znJ>h2{viNZ zTfH2Oy_7)i>f}o)j`blWT`0W>3#y9yJlnD~H)}SKy1Wur5T?mLm;_yZHOa9kOTL(?a49Xh5 ztlpprHlG_7WE@*ui}IA{)okekGl4#~FPguo5kTTW^aaS%SpOI4ZL!P=&CW5EsGAs) z`I%g2xOd7uibu~(yNI5B5(w~iJIC-k$AH8K;pJS`;HZwDz3D<<#RA7w(j&qdX!oj6 zMV2}Zw82v*?ee(fZZSWtr*`D)Ko#Xop_)sclo3l%Vpk}_7r%l$=GB*VD&zqjX;~o6 zGE2C6=y5-;-`s4((36hX0=RghPQ>$7)XebOsvnweieN4SK0d-8hTh=xNaThsZ=OO` zI>NK*i+B5A3s94|_wpsjW@*sC#*3$zb;Tzhk2I zXjWYB>WCi94Z9Y*YBxfl!hLc3L$U2Aa%+khtlp2KBL8kC zv_BdCyJ_`$V>OJnmwUQg@`#GmGuswO>XnNP>A!XQa&kH}9X8G{S0QW_s(E!B5c5#k zo@Uy@Mc@XU535&Xl7*T46Kkn@KQEM$3@_-y<7vZm`;#MPT%gI_${7GoQVg8b3$*eWq&>MXwe(eDzNrrDsJfPH6ce%ADD<#asy-hKO2p2EkM8=v2*jQ33M=)Dms3_XEt&uOax*ZJlcUDq=J;8teza|wI^^(=OA2@=4rGS3 z0hGxb6p;XV4`-!5b>g!f+H;mor@9M2b*6`-?wPp5#{4n%OfC97<0ya(@E$Gqye_tN z(D%8G>MdoU#_>#Z@Rc+O%!Y87)FCMOiMw&kl31x9VUUSfdKf}*wP{m%VF!H7SKp3r zpm+@lI5JG0w{Y35=#gDq7_!8}p-qZPj|bp#1pYY4r@*RDwdgH0ht$aWQH=9|xcuFg zQ85!iBu4l5fe0PG=SZ(-NZSW}xe3*Z+8WC=!UV_(u>UfOzn2x&Z(xWkJYPwFp~&*di^W6R7k_%+d^c0Vm!-Ptps?C}27GBHR0v2e9ujlv`ZHQ0o$;`CyYIE%Ga`XcEfpUyjI+-n>m>i1_{p#agl3XL7rL|Hkq!M3_!Rs+y3Iv*u*5D_;+JPMD64z zP{M9-#efjE)+N@W!>ICbr-@rH0Nx;xKGDUsiO@a%q0SkvcMGs zlCYGbmOuFmyY!x0Gf(4oD}&54*Y`X~sghKc|JP!fQZODQHMfCegZUi@-)?whA*QC| zl5Pq-C#-sv2!4xoNCS58`440J_= zx1!nt{RwVAed0j^q>jpZUc^A$>_G(W*S0Gb*lw%J@8Y<-zemLJ{H1N}wP(2k-Mn|R zh$7zeH-GrHU6L`g$x+ejGWDtL0)M3qYZ;L*kaBqsynZ_ z=m=qPG}nhL+W?&TR4_r$$A`AMy6C^RRknVVfnC6%JE1rf-B^Z`pAXlE(Y?-W*KGSl z6RZ!j6312kXGTiYgbR+lDvVWi!58(_=&l3;c!-=HtH2)B>hk5+%~aZA(;O}2*@j)q zEcDV!>|SaS5T;&ofR;q)joFJK8MFSe;Xoh@KFb_~-p(tfOA_l7{_+UIB z_w##|DV4S_5GGT9dR_ReSfj#4Z>2qPeOx@hJ)0%hIdIaSlwUCI#@f8c zyN@XkH0^C32_7xu4wbV(%Pp5fe}It7I3QKm%7{Su_99}BhycMKP1p~!&Nl?5 z*W9BCmc;1*0BCbQ5Y?%A;KfA5L`L;Z&&p{0bG-*4KN|WG;`(mObkq28F=a%BJO2C}4|6@8h9b=$ZbC~4NXFC;d&10r_RtN5^NMiHnu;XO zw*3I44z>oOa{MA!fwP1O7ea{P3OQCpY^-hwuoU@PkClSL<3^tYje)MAE8ZK?s15DL zb-Xq)IF*AnW*u3PiI=O9n4(&kq(F=uJaWj~WH}1(PO;lvH%O7;2!8k$-JUdB_3qxF zMk+Qthwe>Rt*e_t5b1Zz%QF^w4Y%3A5h8JMem}m$TM{n@0l=!equqnBnyM9A`2zSs zaLK~9%jRsU>J_@>hg0ah(akZceJd-D*43A!g6)Enn%z(?qWgkW5kPhX%~j${p5(2n>?kftl@Sv$)7yr9*7i0`;mO# zLr$10tlCB6`Jxq_e$_}cur5(f+}XIsrq43kKBRM7kA$_Q(FSY1C}U(No1NyX}BbK*DFr~G-5u@mOHHvYr-Hr5Xv$-?8Aucan4`X(#9|I9i~(W zSUweLA_bbU;8B+6=iE;=r`#FR?OD%8hnJ+W@*)IR__^}3dFhs-%{v!U;?ssj!I{pYS_-w3E-(zdL@jt#xmRW|h>v{E6G>d4fm zq)E|`dktu=qtMmAq&6Dmbit*HWhv_N;D!MT~H zRkWS2;XNWn1gzmNc>rzrO`Zh{^1go`?lW*3!EDi`wfh<-hjasvvF=APY-A#RGaK`1 zM2+^2d7*rG$!IFLT6s39@wuW~$)d(MC~Wb4-sct1ViD%OvM65dI>Co7^gljZ$i43X zOF?c(6m)wubf?RLw_yWr9abDRsMu^VYiS{ekYHbg#vQB!{d0b$f&tG)&T8(opufLw zdBv&;_Z3l5hoG0D@j3C>=Pk3hfo$^RUuN_HWxtXKa`O^-K4}lZCpQ+ZRk?QAjYGss zaSd{PW-b!tPDD!*ItIx+9@qug(`Ap#`8wR|nuAk5dYP0*vM` zg>NKdFriSR*_*)ZD;oRz@5R4Y74r)XM}ozKgLw3CYg&bu4^l+)947OSqx$g3$ftG2 zk1y-Hf9y+YItZl;26RBwAPLtER9|8Cd%UnNCF>HpN`ii=p)Zy&x5Z+y(b|L>CYgS~ zn8`8clv6hmYSm64s?wVpLJ0kHAiX$!UEx^Wo_x;XLCMqLQLXuyADt2l6`c5!&)Rl+>T2yt4dboW;xA z4D$0{n0+BRa_Tl;M-%A_vuUF=8KJm_-F9W&?Kw}wqVIytaL2xP>dCx4+q7@LKV;WI zr~*I*!oO;Dr>mUr4YTF(s-CmM+s zKHN6)u|Q(QQ=OY6)2jStJRlmkK`ru0zC_XZH%+h+cK@JMq`g>L6)th1G!ukj`k2a{ zdhv=OAAsYA7WAXeTx-^*+5~ldBtaPL&{)A3q7mPnDn&zQX2Azr-{f7wWm7qpz6HwEnM0^5Dxez> zfi8Z*Zq9oC>XPO8JdLhv1)ox3kBhSbib*uK3}t$-uM_I+W>m~A>?n@T5Aku1`Xoo3p?SF6cT${jLOp62Z~6?IqA}^x1!~av!?)vA?g2H67N^r$69W zSap^&Ln`s>5&?>q#|KV9qenifm>?{~njgSx^?2vVp8*h`H8+TgkT09<*d})D6BwY# zBHcdo`1ukB5>qQ;D6m0Kr$aL{vrU;NH!{)~1gE)@GQ8K0<7}77$Z4_f$Ah~~WnzGn zS;P`#(VZ$ z*~QG@aNsiU@;hPCKtncmLY4<{++Lo!xy|u5lhl@)6K3a?I(W<BrZZ_!b^v|0TF_objXOJH4n;J{~I^?l3!-&r3!;a2*^4ZeSU7MWdrb^UhQ_Uk8j zloy+&O3S8H>@z!CHP2N*GVjQFmvc^j(@VNu-VQgJ`(o9R#K~flgs->?1m9R*bf*ev z-lvwsnz|*|&wN6cJvA+SBy-$BgnQzIv|LMv)^DY0)G&_IKuMYy+!SMb0(zf6zRonB6 zzkmPpeEyI439tW80h-qE`}3*8n*V1ndl_$jH4Uin-RaY{k@~Be{nw_r#eB<;DF8JT*vA!H^j|J2MSJs=USa?Zi4;9 z^XH-bzeMPW3ID$b{Lu39$0j+T-B^#%z!nM_7Jr}r|2caT&^m@N2Jj}(sG9fH|K$@( V>$!jWi+X@0JYD@<);T3K0RV2|+AIJ7 diff --git a/windows/security/operating-system-security/data-protection/bitlocker/images/powershell.png b/windows/security/operating-system-security/data-protection/bitlocker/images/powershell.png new file mode 100644 index 0000000000000000000000000000000000000000..9c014536ca6010831843495edef8e4f97848b6fb GIT binary patch literal 1166 zcmV;91abR`P)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGqB>(^xB>_oNB=7(L1S3gAK~z{r?Uq?j zQ&AAd`3QUz9!xYou!FKmm0oQYdO4FXO%npb;*oq;q zYmSrpYcF1VAv%8m;tIwr0%=reMw=($;vbN)g`2iONq4vji^u z_QLx{{{X46YrzOF(8C8II`1p)zTX^vjKlfy_Tf670D;wn36v3(!xs@g4;IG^gG)6! z=U0Z)dFOsc_(xNC*wNSQs07j|{L-a|Z+Fb%x&MNDZ3_a=)!>}P(k}x)Dd9a3dHg-X z-$Hn{6T&m!AiNzyGhR^zn*>r*U~02JW$X)&FP(z;;z=z3yufpnR#U^7z;jLDSrXpH zs(@>%4H%T#VxiI~@RCW)*n?%CU_00AT+PHk!9$O?Xe9TLxto22rkF1 zq0`tCj=N)`=@5Rx1fHqELk_=SRl{-i7g$XpM_x9`Szit=XWiL9C-7Wn@3^&&N4Oj} z20yC7gVUc;1G@y$D9U)PMw3`H0KFr|o=7@RJJ)7ic6?}t2B#~Ib(uhF3Q2z+KDk``%hlN03xUZuvBXbTgyWR4eiBHduyig3 zt}~j%;z4-UZR~#9bx~OhY)rbN7>yT>Nl7@mESIh;2g!4F+?gWIzx zuw31)QAo_Hf*|W-(^>bz@p}oU#PAuT8W5JuLgiJ)Eq@3qn};jctfqt<4wiw>6LSM1 z2h+pJXs*?L7s~)|wB#D$a+=Xh%`Ayum@CFw<%Lrt;_g)g!ZTzBWM(uem)apNqZR_K zk2qZSMnmJa+ui}mg%2_6c@#WgkyKCzyK-t_Q!?Hw5}@B>0(%5j6PD8&oi|{Zb@_B# z>5XQkS(i|Kh}S&TfN)_OmE0GuzR}>*?LXlZ_+ax0q)`a45R5WhJ}{v*2L0Ceelj=H g@~>-Metv#`0Xj%0MHZA9bpQYW07*qoM6N<$f;USN7XSbN literal 0 HcmV?d00001 diff --git a/windows/security/operating-system-security/data-protection/bitlocker/manage.md b/windows/security/operating-system-security/data-protection/bitlocker/manage.md index 6f865c35b9..589ee40f59 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/manage.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/manage.md @@ -13,6 +13,79 @@ BitLocker drive encryption tools include the two command-line tools *manage-bde. The tools can be used to perform any tasks that can be accomplished through the BitLocker control panel and are appropriate to use for automated deployments and other scripting scenarios. + +Follow the instructions below to configure your devices, selecting the option that best suits your needs. + +#### [:::image type="icon" source="images/powershell.png"::: **Intune**](#tab/powershell) + +Similar to manage-bde, the PowerShell cmdlets allow configuration beyond the options offered in the control panel. A good initial step is to determine the current state of the volume(s) on the computer. For example, to determine the current state of a volume you can use the `Get-BitLockerVolume` cmdlet, which provides information on the volume type, protectors, protection status, and other details. + +```powershell +PS C:\> Get-BitLockerVolume C: | fl + +ComputerName : DESKTOP +MountPoint : C: +EncryptionMethod : XtsAes128 +AutoUnlockEnabled : +AutoUnlockKeyStored : False +MetadataVersion : 2 +VolumeStatus : FullyEncrypted +ProtectionStatus : On +LockStatus : Unlocked +EncryptionPercentage : 100 +WipePercentage : 0 +VolumeType : OperatingSystem +CapacityGB : 1000 +KeyProtector : {Tpm, RecoveryPassword} +``` + +To remove the existing protectors prior to provisioning BitLocker on the volume, use the `Remove-BitLockerKeyProtector` cmdlet. Running this cmdlet requires the GUID associated with the protector to be removed. + +The following commands return the list of key protectors and GUIDS: + +```PowerShell +$vol = Get-BitLockerVolume +$keyprotectors = $vol.KeyProtector +$keyprotectors +``` + +By using this information, the key protector for a specific volume can be removed using the command: + +```powershell +Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" +``` + +> [!NOTE] +> The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. + +#### [:::image type="icon" source="images/cmd.png"::: **Intune**](#tab/cmd) + +```cmd +C:\>manage-bde -status + +Volume C: [Local Disk] +[OS Volume] + + Size: 1000 GB + BitLocker Version: 2.0 + Conversion Status: Used Space Only Encrypted + Percentage Encrypted: 100.0% + Encryption Method: XTS-AES 128 + Protection Status: Protection On + Lock Status: Unlocked + Identification Field: Unknown + Key Protectors: + TPM + Numerical Password +``` + + +#### [:::image type="icon" source="images/locked-drive.svg"::: **Intune**](#tab/controlpanel) + +--- + + + ## Manage-bde Manage-bde is a command-line tool that can be used for scripting BitLocker operations. Manage-bde offers additional options not displayed in the BitLocker control panel. For a complete list of the `manage-bde.exe` options, see the [Manage-bde](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ff829849(v=ws.11)) command-line reference. @@ -25,13 +98,9 @@ Listed below are examples of basic valid commands for operating system volumes. A good practice when using `manage-bde.exe` is to determine the volume status on the target system. Use the following command to determine volume status: -```cmd -manage-bde.exe -status -``` -This command returns the volumes on the target, current encryption status, encryption method, and volume type (operating system or data) for each volume: -![Using manage-bde to check encryption status.](images/manage-bde-status.png) +This command returns the volumes on the target, current encryption status, encryption method, and volume type (operating system or data) for each volume. The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process, the startup key needed for BitLocker must be created and saved to a USB drive. When BitLocker is enabled for the operating system volume, BitLocker will need to access the USB flash drive to obtain the encryption key. In this example, the drive letter E represents the USB drive. Once the commands are run, it will prompt to reboot the computer to complete the encryption process. @@ -127,45 +196,7 @@ The BitLocker PowerShell module enables administrators to integrate BitLocker op - `Suspend-BitLocker` - `Unlock-BitLocker` -Similar to manage-bde, the PowerShell cmdlets allow configuration beyond the options offered in the control panel. A good initial step is to determine the current state of the volume(s) on the computer. For example, to determine the current state of a volume you can use the `Get-BitLockerVolume` cmdlet, which provides information on the volume type, protectors, protection status, and other details. -```powershell -PS C:\> Get-BitLockerVolume C: | fl - -ComputerName : DESKTOP -MountPoint : C: -EncryptionMethod : XtsAes128 -AutoUnlockEnabled : -AutoUnlockKeyStored : False -MetadataVersion : 2 -VolumeStatus : FullyEncrypted -ProtectionStatus : On -LockStatus : Unlocked -EncryptionPercentage : 100 -WipePercentage : 0 -VolumeType : OperatingSystem -CapacityGB : 1000 -KeyProtector : {Tpm, RecoveryPassword} -``` - -To remove the existing protectors prior to provisioning BitLocker on the volume, use the `Remove-BitLockerKeyProtector` cmdlet. Running this cmdlet requires the GUID associated with the protector to be removed. - -The following commands return the list of key protectors and GUIDS: - -```PowerShell -$vol = Get-BitLockerVolume -$keyprotectors = $vol.KeyProtector -$keyprotectors -``` - -By using this information, the key protector for a specific volume can be removed using the command: - -```powershell -Remove-BitLockerKeyProtector : -KeyProtectorID "{GUID}" -``` - -> [!NOTE] -> The BitLocker cmdlet requires the key protector GUID enclosed in quotation marks to execute. Ensure the entire GUID, with braces, is included in the command. ### Using the BitLocker Windows PowerShell cmdlets with operating system volumes