mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 20:03:40 +00:00
Metadata/style update BitLocker 7
This commit is contained in:
Frank Rojas
@ -24,45 +24,57 @@ ms.technology: itpro-security
|
||||
|
||||
This article explains how to deploy BitLocker on Windows Server 2012 and later versions. For all Windows Server editions, BitLocker can be installed using Server Manager or Windows PowerShell cmdlets. BitLocker requires administrator privileges on the server on which it's to be installed.
|
||||
|
||||
## <a href="" id="installing-bitlocker-"></a>Installing BitLocker
|
||||
## Installing BitLocker
|
||||
|
||||
### <a href="" id="bkmk-blinstallsrvmgr"></a>To install BitLocker using server manager
|
||||
### To install BitLocker using server manager
|
||||
|
||||
1. Open server manager by selecting the server manager icon or running servermanager.exe.
|
||||
2. Select **Manage** from the **Server Manager Navigation** bar and select **Add Roles and Features** to start the **Add Roles and Features Wizard.**
|
||||
3. With the **Add Roles and Features** wizard open, select **Next** at the **Before you begin** pane (if shown).
|
||||
4. Select **Role-based or feature-based installation** on the **Installation type** pane of the **Add Roles and Features** wizard and select **Next** to continue.
|
||||
5. Select the **Select a server from the server pool** option in the **Server Selection** pane and confirm the server on which the BitLocker feature is to be installed.
|
||||
6. Select **Next** on the **Server Roles** pane of the **Add Roles and Features** wizard to proceed to the **Features** pane.
|
||||
**Note**: Server roles and features are installed by using the same wizard in Server Manager.
|
||||
7. Select the check box next to **BitLocker Drive Encryption** within the **Features** pane of the **Add Roles and Features** wizard. The wizard shows the extra management features available for BitLocker. If you don't want to install these features, deselect the **Include management tools
|
||||
1. Open server manager by selecting the server manager icon or running servermanager.exe.
|
||||
|
||||
2. Select **Manage** from the **Server Manager Navigation** bar and select **Add Roles and Features** to start the **Add Roles and Features Wizard.**
|
||||
|
||||
3. With the **Add Roles and Features** wizard open, select **Next** at the **Before you begin** pane (if shown).
|
||||
|
||||
4. Select **Role-based or feature-based installation** on the **Installation type** pane of the **Add Roles and Features** wizard and select **Next** to continue.
|
||||
|
||||
5. Select the **Select a server from the server pool** option in the **Server Selection** pane and confirm the server on which the BitLocker feature is to be installed.
|
||||
|
||||
6. Select **Next** on the **Server Roles** pane of the **Add Roles and Features** wizard to proceed to the **Features** pane.
|
||||
|
||||
> [!NOTE]
|
||||
> Server roles and features are installed by using the same wizard in Server Manager.
|
||||
|
||||
7. Select the check box next to **BitLocker Drive Encryption** within the **Features** pane of the **Add Roles and Features** wizard. The wizard shows the extra management features available for BitLocker. If you don't want to install these features, deselect the **Include management tools
|
||||
** and select **Add Features**. Once optional features selection is complete, select **Next** to proceed in the wizard.
|
||||
|
||||
> **Note:** The **Enhanced Storage** feature is a required feature for enabling BitLocker. This feature enables support for encrypted hard drives on capable systems.
|
||||
|
||||
8. Select **Install** on the **Confirmation** pane of the **Add Roles and Features** wizard to begin BitLocker feature installation. The BitLocker feature requires a restart for its installation to be complete. Selecting the **Restart the destination server automatically if required** option in the **Confirmation** pane forces a restart of the computer after installation is complete.
|
||||
9. If the **Restart the destination server automatically if required** check box isn't selected, the **Results** pane of the **Add Roles and Features** wizard displays the success or failure of the BitLocker feature installation. If necessary, a notification of other action necessary to complete the feature installation, such as the restart of the computer, will be displayed in the results text.
|
||||
> [!NOTE]
|
||||
> The **Enhanced Storage** feature is a required feature for enabling BitLocker. This feature enables support for encrypted hard drives on capable systems.
|
||||
|
||||
### <a href="" id="bkmk-blinstallwps"></a>To install BitLocker using Windows PowerShell
|
||||
8. Select **Install** on the **Confirmation** pane of the **Add Roles and Features** wizard to begin BitLocker feature installation. The BitLocker feature requires a restart for its installation to be complete. Selecting the **Restart the destination server automatically if required** option in the **Confirmation** pane forces a restart of the computer after installation is complete.
|
||||
|
||||
Windows PowerShell offers administrators another option for BitLocker feature installation. Windows PowerShell installs features using the `servermanager` or `dism` module; however, the `servermanager` and `dism` modules don't always share feature name parity. Because of this, it's advisable to confirm the feature or role name prior to installation.
|
||||
9. If the **Restart the destination server automatically if required** check box isn't selected, the **Results** pane of the **Add Roles and Features** wizard displays the success or failure of the BitLocker feature installation. If necessary, a notification of other action necessary to complete the feature installation, such as the restart of the computer, will be displayed in the results text.
|
||||
|
||||
### To install BitLocker using Windows PowerShell
|
||||
|
||||
Windows PowerShell offers administrators another option for BitLocker feature installation. Windows PowerShell installs features using the `servermanager` or `dism` module. However, the `servermanager` and `dism` modules don't always share feature name parity. Because of this mismatch of feature name parity, it's advisable to confirm the feature or role name prior to installation.
|
||||
|
||||
> [!NOTE]
|
||||
> You must restart the server to complete the installation of BitLocker.
|
||||
|
||||
>**Note:**You must restart the server to complete the installation of BitLocker.
|
||||
|
||||
### Using the servermanager module to install BitLocker
|
||||
|
||||
The `servermanager` Windows PowerShell module can use either the `Install-WindowsFeature` or `Add-WindowsFeature` to install the BitLocker feature. The `Add-WindowsFeature` cmdlet is merely a stub to the `Install-WindowsFeature`. This example uses the `Install-WindowsFeature` cmdlet. The feature name for BitLocker in the `servermanager` module is `BitLocker`.
|
||||
The `servermanager` Windows PowerShell module can use either the `Install-WindowsFeature` or `Add-WindowsFeature` to install the BitLocker feature. The `Add-WindowsFeature` cmdlet is merely a stub to the `Install-WindowsFeature`. This example uses the `Install-WindowsFeature` cmdlet. The feature name for BitLocker in the `servermanager` module is `BitLocker`.
|
||||
|
||||
By default, installation of features in Windows PowerShell doesn't include optional sub-features or management tools as part of the installation process. This can be seen using the `-WhatIf` option in Windows PowerShell.
|
||||
By default, installation of features in Windows PowerShell doesn't include optional sub-features or management tools as part of the installation process. What is installed as part of the installation process can be seen using the `-WhatIf` option in Windows PowerShell.
|
||||
|
||||
```powershell
|
||||
``` powershell
|
||||
Install-WindowsFeature BitLocker -WhatIf
|
||||
```
|
||||
|
||||
The results of this command show that only the BitLocker Drive Encryption feature is installed using this command.
|
||||
|
||||
To see what would be installed with the BitLocker feature, including all available management tools and sub-features, use the following command:
|
||||
|
||||
```powershell
|
||||
``` powershell
|
||||
Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -WhatIf | fl
|
||||
```
|
||||
|
||||
@ -78,17 +90,18 @@ The result of this command displays the following list of all the administration
|
||||
|
||||
The command to complete a full installation of the BitLocker feature with all available sub-features and then to reboot the server at completion is:
|
||||
|
||||
```powershell
|
||||
``` powershell
|
||||
Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -Restart
|
||||
```
|
||||
|
||||
>**Important:**Installing the BitLocker feature using Windows PowerShell does not install the Enhanced Storage feature. Administrators wishing to support Encrypted Hard Drives in their environment will need to install the Enhanced Storage feature separately.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Installing the BitLocker feature using Windows PowerShell does not install the Enhanced Storage feature. Administrators wishing to support Encrypted Hard Drives in their environment will need to install the Enhanced Storage feature separately.
|
||||
|
||||
### Using the dism module to install BitLocker
|
||||
|
||||
The `dism` Windows PowerShell module uses the `Enable-WindowsOptionalFeature` cmdlet to install features. The BitLocker feature name for BitLocker is `BitLocker`. The `dism` module doesn't support wildcards when searching for feature names. To list feature names for the `dism` module, use the `Get-WindowsOptionalFeatures` cmdlet. The following command will list all of the optional features in an online (running) operating system.
|
||||
|
||||
```powershell
|
||||
``` powershell
|
||||
Get-WindowsOptionalFeature -Online | ft
|
||||
```
|
||||
|
||||
@ -96,16 +109,17 @@ From this output, we can see that there are three BitLocker-related optional fea
|
||||
|
||||
To install BitLocker using the `dism` module, use the following command:
|
||||
|
||||
```powershell
|
||||
``` powershell
|
||||
Enable-WindowsOptionalFeature -Online -FeatureName BitLocker -All
|
||||
```
|
||||
|
||||
This command prompts the user for a reboot. The Enable-WindowsOptionalFeature cmdlet doesn't offer support for forcing a reboot of the computer. This command doesn't include installation of the management tools for BitLocker. For a complete installation of BitLocker and all available management tools, use the following command:
|
||||
|
||||
```powershell
|
||||
``` powershell
|
||||
Enable-WindowsOptionalFeature -Online -FeatureName BitLocker, BitLocker-Utilities -All
|
||||
```
|
||||
## More information
|
||||
|
||||
## Related articles
|
||||
|
||||
- [BitLocker overview](bitlocker-overview.md)
|
||||
- [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml)
|
||||
|
||||
@ -72,17 +72,17 @@ Manage and deploy this certificate through the Group Policy editor directly on a
|
||||
|
||||
The Network Unlock process follows these phases:
|
||||
|
||||
1. The Windows boot manager detects a Network Unlock protector in the BitLocker configuration.
|
||||
2. The client computer uses its DHCP driver in the UEFI to get a valid IPv4 IP address.
|
||||
3. The client computer broadcasts a vendor-specific DHCP request that contains:
|
||||
1. A network key (a 256-bit intermediate key) that is encrypted by using the 2048-bit RSA Public Key of the network unlock certificate from the WDS server.
|
||||
2. An AES-256 session key for the reply.
|
||||
4. The Network Unlock provider on the WDS server recognizes the vendor-specific request.
|
||||
5. The provider decrypts the request by using the WDS server's BitLocker Network Unlock certificate RSA private key.
|
||||
6. The WDS provider returns the network key encrypted with the session key by using its own vendor-specific DHCP reply to the client computer. This key is an intermediate key.
|
||||
7. The returned intermediate key is combined with another local 256-bit intermediate key. This key can be decrypted only by the TPM.
|
||||
8. This combined key is used to create an AES-256 key that unlocks the volume.
|
||||
9. Windows continues the boot sequence.
|
||||
1. The Windows boot manager detects a Network Unlock protector in the BitLocker configuration.
|
||||
2. The client computer uses its DHCP driver in the UEFI to get a valid IPv4 IP address.
|
||||
3. The client computer broadcasts a vendor-specific DHCP request that contains:
|
||||
1. A network key (a 256-bit intermediate key) that is encrypted by using the 2048-bit RSA Public Key of the network unlock certificate from the WDS server.
|
||||
2. An AES-256 session key for the reply.
|
||||
4. The Network Unlock provider on the WDS server recognizes the vendor-specific request.
|
||||
5. The provider decrypts the request by using the WDS server's BitLocker Network Unlock certificate RSA private key.
|
||||
6. The WDS provider returns the network key encrypted with the session key by using its own vendor-specific DHCP reply to the client computer. This key is an intermediate key.
|
||||
7. The returned intermediate key is combined with another local 256-bit intermediate key. This key can be decrypted only by the TPM.
|
||||
8. This combined key is used to create an AES-256 key that unlocks the volume.
|
||||
9. Windows continues the boot sequence.
|
||||
|
||||
## <a href="" id="bkmk-configuringnetworkunlock"></a>Configure network unlock
|
||||
|
||||
@ -122,15 +122,15 @@ Install-WindowsFeature BitLocker-NetworkUnlock
|
||||
|
||||
A properly configured Active Directory Services Certification Authority can use this certificate template to create and issue Network Unlock certificates.
|
||||
|
||||
1. Open the Certificates Template snap-in (certtmpl.msc).
|
||||
2. Locate the User template, right-click the template name and select **Duplicate Template**.
|
||||
3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8, respectively. Ensure that the **Show resulting changes** dialog box is selected.
|
||||
4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the check box for the **Publish certificate in Active Directory** option.
|
||||
5. Select the **Request Handling** tab. Select **Encryption** from the **Purpose** drop-down menu. Ensure that the **Allow private key to be exported** option is selected.
|
||||
6. Select the **Cryptography** tab. Set the **Minimum key size** to 2048. (Any Microsoft cryptographic provider that supports RSA can be used for this template, but for simplicity and forward compatibility, we recommend using **Microsoft Software Key Storage Provider**.)
|
||||
7. Select the **Requests must use one of the following providers** option and clear all options except for the cryptography provider you selected, such as **Microsoft Software Key Storage Provider**.
|
||||
8. Select the **Subject Name** tab. Select **Supply in the request**. Click **OK** if the certificate templates pop-up dialog appears.
|
||||
9. Select the **Issuance Requirements** tab. Select both **CA certificate manager approval** and **Valid existing certificate** options.
|
||||
1. Open the Certificates Template snap-in (certtmpl.msc).
|
||||
2. Locate the User template, right-click the template name and select **Duplicate Template**.
|
||||
3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8, respectively. Ensure that the **Show resulting changes** dialog box is selected.
|
||||
4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the check box for the **Publish certificate in Active Directory** option.
|
||||
5. Select the **Request Handling** tab. Select **Encryption** from the **Purpose** drop-down menu. Ensure that the **Allow private key to be exported** option is selected.
|
||||
6. Select the **Cryptography** tab. Set the **Minimum key size** to 2048. (Any Microsoft cryptographic provider that supports RSA can be used for this template, but for simplicity and forward compatibility, we recommend using **Microsoft Software Key Storage Provider**.)
|
||||
7. Select the **Requests must use one of the following providers** option and clear all options except for the cryptography provider you selected, such as **Microsoft Software Key Storage Provider**.
|
||||
8. Select the **Subject Name** tab. Select **Supply in the request**. Click **OK** if the certificate templates pop-up dialog appears.
|
||||
9. Select the **Issuance Requirements** tab. Select both **CA certificate manager approval** and **Valid existing certificate** options.
|
||||
10. Select the **Extensions** tab. Select **Application Policies** and choose **Edit…**.
|
||||
11. In the **Edit Application Policies Extension** options dialog box, select **Client Authentication**, **Encrypting File System**, **and Secure Email** and choose **Remove**.
|
||||
12. On the **Edit Application Policies Extension** dialog box, select **Add**.
|
||||
@ -153,26 +153,26 @@ After you add the Network Unlock template to the certificate authority, you can
|
||||
Network Unlock can use imported certificates from an existing public key infrastructure (PKI). Or it can use a self-signed certificate.
|
||||
|
||||
To enroll a certificate from an existing certificate authority:
|
||||
1. On the WDS server, open Certificate Manager by using `certmgr.msc`.
|
||||
2. Under **Certificates - Current User**, right-click **Personal**.
|
||||
3. Select **All Tasks** > **Request New Certificate**.
|
||||
4. When the Certificate Enrollment wizard opens, select **Next**.
|
||||
5. Select **Active Directory Enrollment Policy**.
|
||||
6. Choose the certificate template that was created for Network Unlock on the domain controller. Then select **Enroll**.
|
||||
1. On the WDS server, open Certificate Manager by using `certmgr.msc`.
|
||||
2. Under **Certificates - Current User**, right-click **Personal**.
|
||||
3. Select **All Tasks** > **Request New Certificate**.
|
||||
4. When the Certificate Enrollment wizard opens, select **Next**.
|
||||
5. Select **Active Directory Enrollment Policy**.
|
||||
6. Choose the certificate template that was created for Network Unlock on the domain controller. Then select **Enroll**.
|
||||
1. When you're prompted for more information, select **Subject Name** and provide a friendly name value. Your friendly name should include information for the domain or organizational unit for the certificate. Here's an example: *BitLocker Network Unlock Certificate for Contoso domain*.
|
||||
7. Create the certificate. Ensure the certificate appears in the **Personal** folder.
|
||||
8. Export the public key certificate for Network Unlock:
|
||||
7. Create the certificate. Ensure the certificate appears in the **Personal** folder.
|
||||
8. Export the public key certificate for Network Unlock:
|
||||
|
||||
1. Create a .cer file by right-clicking the previously created certificate, selecting **All Tasks**, and then selecting **Export**.
|
||||
2. Select **No, do not export the private key**.
|
||||
3. Select **DER encoded binary X.509** and complete exporting the certificate to a file.
|
||||
4. Give the file a name such as BitLocker-NetworkUnlock.cer.
|
||||
1. Create a .cer file by right-clicking the previously created certificate, selecting **All Tasks**, and then selecting **Export**.
|
||||
2. Select **No, do not export the private key**.
|
||||
3. Select **DER encoded binary X.509** and complete exporting the certificate to a file.
|
||||
4. Give the file a name such as BitLocker-NetworkUnlock.cer.
|
||||
|
||||
9. Export the public key with a private key for Network Unlock.
|
||||
9. Export the public key with a private key for Network Unlock.
|
||||
|
||||
1. Create a .pfx file by right-clicking the previously created certificate, selecting **All Tasks**, and then selecting **Export**.
|
||||
2. Select **Yes, export the private key**.
|
||||
3. Complete the steps to create the *.pfx* file.
|
||||
1. Create a .pfx file by right-clicking the previously created certificate, selecting **All Tasks**, and then selecting **Export**.
|
||||
2. Select **Yes, export the private key**.
|
||||
3. Complete the steps to create the *.pfx* file.
|
||||
|
||||
To create a self-signed certificate, either use the `New-SelfSignedCertificate` cmdlet in Windows PowerShell or use `certreq`.
|
||||
|
||||
@ -184,8 +184,8 @@ New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -Subject "CN=
|
||||
|
||||
Here's a `certreq` example:
|
||||
|
||||
1. Create a text file with an .inf extension, for example, notepad.exe BitLocker-NetworkUnlock.inf.
|
||||
2. Add the following contents to the previously created file:
|
||||
1. Create a text file with an .inf extension, for example, notepad.exe BitLocker-NetworkUnlock.inf.
|
||||
2. Add the following contents to the previously created file:
|
||||
|
||||
```ini
|
||||
[NewRequest]
|
||||
@ -206,23 +206,23 @@ Here's a `certreq` example:
|
||||
_continue_ = "1.3.6.1.4.1.311.67.1.1"
|
||||
```
|
||||
|
||||
3. Open an elevated command prompt and use the `certreq` tool to create a new certificate. Use the following command, specifying the full path to the file that you created previously. Also specify the file name.
|
||||
3. Open an elevated command prompt and use the `certreq` tool to create a new certificate. Use the following command, specifying the full path to the file that you created previously. Also specify the file name.
|
||||
|
||||
```cmd
|
||||
certreq -new BitLocker-NetworkUnlock.inf BitLocker-NetworkUnlock.cer
|
||||
```
|
||||
4. Verify that certificate was properly created by the previous command by confirming that the .cer file exists.
|
||||
5. Launch Certificates - Local Machine by running **certlm.msc**.
|
||||
6. Create a .pfx file by opening the **Certificates - Local Computer\\Personal\\Certificates** path in the navigation pane, right-clicking the previously imported certificate, selecting **All Tasks**, and then selecting **Export**. Follow through the wizard to create the .pfx file.
|
||||
4. Verify that certificate was properly created by the previous command by confirming that the .cer file exists.
|
||||
5. Launch Certificates - Local Machine by running **certlm.msc**.
|
||||
6. Create a .pfx file by opening the **Certificates - Local Computer\\Personal\\Certificates** path in the navigation pane, right-clicking the previously imported certificate, selecting **All Tasks**, and then selecting **Export**. Follow through the wizard to create the .pfx file.
|
||||
|
||||
### <a href="" id="bkmk-deploycert"></a>Deploy the private key and certificate to the WDS server
|
||||
|
||||
Now that you've created the certificate and key, deploy them to the infrastructure to properly unlock systems. To deploy the certificates:
|
||||
|
||||
1. On the WDS server, open a new MMC and add the certificates snap-in. Select the computer account and local computer when given the options.
|
||||
2. Right-click the Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock item -, select **All Tasks**, and then select **Import**.
|
||||
3. In the **File to Import** dialog, choose the .pfx file created previously.
|
||||
4. Enter the password used to create the .pfx and complete the wizard.
|
||||
1. On the WDS server, open a new MMC and add the certificates snap-in. Select the computer account and local computer when given the options.
|
||||
2. Right-click the Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock item -, select **All Tasks**, and then select **Import**.
|
||||
3. In the **File to Import** dialog, choose the .pfx file created previously.
|
||||
4. Enter the password used to create the .pfx and complete the wizard.
|
||||
|
||||
### Configure group policy settings for network unlock
|
||||
|
||||
@ -230,22 +230,22 @@ With certificate and key deployed to the WDS server for Network Unlock, the fina
|
||||
|
||||
The following steps describe how to enable the group policy setting that is a requirement for configuring network unlock.
|
||||
|
||||
1. Open Group Policy Management Console (`gpmc.msc`).
|
||||
2. Enable the policy **Require additional authentication at startup**, and then select **Require startup PIN with TPM** or **Allow startup PIN with TPM**.
|
||||
3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers.
|
||||
1. Open Group Policy Management Console (`gpmc.msc`).
|
||||
2. Enable the policy **Require additional authentication at startup**, and then select **Require startup PIN with TPM** or **Allow startup PIN with TPM**.
|
||||
3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers.
|
||||
|
||||
The following steps describe how to deploy the required group policy setting:
|
||||
|
||||
> [!NOTE]
|
||||
> The group policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012.
|
||||
|
||||
1. Copy the *.cer* file that you created for Network Unlock to the domain controller.
|
||||
2. On the domain controller, open Group Policy Management Console (`gpmc.msc`).
|
||||
3. Create a new Group Policy Object or modify an existing object to enable the **Allow network unlock at startup** setting.
|
||||
4. Deploy the public certificate to clients:
|
||||
1. Within group policy management console, navigate to the following location: **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate**.
|
||||
2. Right-click the folder and select **Add Network Unlock Certificate**.
|
||||
3. Follow the wizard steps and import the .cer file that was copied earlier.
|
||||
1. Copy the *.cer* file that you created for Network Unlock to the domain controller.
|
||||
2. On the domain controller, open Group Policy Management Console (`gpmc.msc`).
|
||||
3. Create a new Group Policy Object or modify an existing object to enable the **Allow network unlock at startup** setting.
|
||||
4. Deploy the public certificate to clients:
|
||||
1. Within group policy management console, navigate to the following location: **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate**.
|
||||
2. Right-click the folder and select **Add Network Unlock Certificate**.
|
||||
3. Follow the wizard steps and import the .cer file that was copied earlier.
|
||||
|
||||
> [!NOTE]
|
||||
> Only one network unlock certificate can be available at a time. If you need a new certificate, delete the current certificate before you deploy a new one. The Network Unlock certificate is located in the *HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP* key on the client computer.
|
||||
@ -351,12 +351,12 @@ Your system must meet these requirements:
|
||||
|
||||
Follow these steps to configure Network Unlock on these older systems.
|
||||
|
||||
1. [Install the WDS Server role](#bkmk-installwdsrole)
|
||||
2. [Confirm the WDS Service is running](#bkmk-confirmwdsrunning)
|
||||
3. [Install the Network Unlock feature](#bkmk-installnufeature)
|
||||
4. [Create the Network Unlock certificate](#bkmk-createcert)
|
||||
5. [Deploy the private key and certificate to the WDS server](#bkmk-deploycert)
|
||||
6. Configure registry settings for network unlock:
|
||||
1. [Install the WDS Server role](#bkmk-installwdsrole)
|
||||
2. [Confirm the WDS Service is running](#bkmk-confirmwdsrunning)
|
||||
3. [Install the Network Unlock feature](#bkmk-installnufeature)
|
||||
4. [Create the Network Unlock certificate](#bkmk-createcert)
|
||||
5. [Deploy the private key and certificate to the WDS server](#bkmk-deploycert)
|
||||
6. Configure registry settings for network unlock:
|
||||
|
||||
Apply the registry settings by running the following `certutil` script (assuming your Network Unlock certificate file is called *BitLocker-NetworkUnlock.cer*) on each computer that runs a client operating system that's designated in the "Applies to" list at the beginning of this article.
|
||||
|
||||
@ -371,8 +371,8 @@ Follow these steps to configure Network Unlock on these older systems.
|
||||
reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f
|
||||
```
|
||||
|
||||
7. Set up a TPM protector on the clients.
|
||||
8. Reboot the clients to add the Network (certificate based) protector.
|
||||
7. Set up a TPM protector on the clients.
|
||||
8. Reboot the clients to add the Network (certificate based) protector.
|
||||
|
||||
## See also
|
||||
|
||||
|
||||
@ -30,9 +30,11 @@ sections:
|
||||
questions:
|
||||
- question: How can I authenticate or unlock my removable data drive?
|
||||
answer: |
|
||||
You can unlock removable data drives by using a password, a smart card, or you can configure a SID protector to unlock a drive by using your domain credentials. After you've started encryption, the drive can also be automatically unlocked on a specific computer for a specific user account. System administrators can configure which options are available for users, as well as password complexity and minimum length requirements. To unlock by using a SID protector, use Manage-bde:
|
||||
You can unlock removable data drives by using a password, a smart card, or you can configure a SID protector to unlock a drive by using your domain credentials. After you've started encryption, the drive can also be automatically unlocked on a specific computer for a specific user account. System administrators can configure which options are available for users including password complexity and minimum length requirements. To unlock by using a SID protector, use Manage-bde:
|
||||
|
||||
<code>Manage-bde -protectors -add e: -sid <i>domain\username</i></code>
|
||||
``` syntax
|
||||
Manage-bde.exe -protectors -add e: -sid <i>domain\username</i></code>
|
||||
```
|
||||
|
||||
- question: What is the difference between a recovery password, recovery key, PIN, enhanced PIN, and startup key?
|
||||
answer: |
|
||||
@ -42,22 +44,26 @@ sections:
|
||||
answer: |
|
||||
The recovery password and recovery key for an operating system drive or a fixed data drive can be saved to a folder, saved to one or more USB devices, saved to your Microsoft Account, or printed.
|
||||
|
||||
For removable data drives, the recovery password and recovery key can be saved to a folder, saved to your Microsoft Account, or printed. By default, you cannot store a recovery key for a removable drive on a removable drive.
|
||||
For removable data drives, the recovery password and recovery key can be saved to a folder, saved to your Microsoft Account, or printed. By default, you can't store a recovery key for a removable drive on a removable drive.
|
||||
|
||||
A domain administrator can additionally configure Group Policy to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) for any BitLocker-protected drive.
|
||||
A domain administrator can also configure Group Policy to automatically generate recovery passwords and store them in Active Directory Domain Services (AD DS) for any BitLocker-protected drive.
|
||||
|
||||
- question: Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled?
|
||||
answer: |
|
||||
You can use the Manage-bde.exe command-line tool to replace your TPM-only authentication mode with a multifactor authentication mode. For example, if BitLocker is enabled with TPM authentication only and you want to add PIN authentication, use the following commands from an elevated command prompt, replacing *4-20 digit numeric PIN* with the numeric PIN you want to use:
|
||||
|
||||
<code>manage-bde -protectors -delete %systemdrive% -type tpm</code>
|
||||
``` syntax
|
||||
manage-bde.exe -protectors -delete %systemdrive% -type tpm
|
||||
```
|
||||
|
||||
<code>manage-bde -protectors -add %systemdrive% -tpmandpin <i>4-20 digit numeric PIN</i></code>
|
||||
``` syntax
|
||||
manage-bde.exe -protectors -add %systemdrive% -tpmandpin <4-20 digit numeric PIN>
|
||||
```
|
||||
|
||||
|
||||
- question: When should an additional method of authentication be considered?
|
||||
answer: |
|
||||
New hardware that meets [Windows Hardware Compatibility Program](/windows-hardware/design/compatibility/) requirements make a PIN less critical as a mitigation, and having a TPM-only protector is likely sufficient when combined with policies like device lockout. For example, Surface Pro and Surface Book do not have external DMA ports to attack.
|
||||
New hardware that meets [Windows Hardware Compatibility Program](/windows-hardware/design/compatibility/) requirements make a PIN less critical as a mitigation, and having a TPM-only protector is likely sufficient when combined with policies like device lockout. For example, Surface Pro and Surface Book don't have external DMA ports to attack.
|
||||
For older hardware, where a PIN may be needed, it's recommended to enable [enhanced PINs](bitlocker-group-policy-settings.md#allow-enhanced-pins-for-startup) that allow non-numeric characters such as letters and punctuation marks, and to set the PIN length based on your risk tolerance and the hardware anti-hammering capabilities available to the TPMs in your computers.
|
||||
|
||||
- question: If I lose my recovery information, will the BitLocker-protected data be unrecoverable?
|
||||
@ -68,7 +74,7 @@ sections:
|
||||
> Store the recovery information in AD DS, along with your Microsoft Account, or another safe location.
|
||||
|
||||
- question: Can the USB flash drive that is used as the startup key also be used to store the recovery key?
|
||||
answer: While this is technically possible, it is not a best practice to use one USB flash drive to store both keys. If the USB flash drive that contains your startup key is lost or stolen, you also lose access to your recovery key. In addition, inserting this key would cause your computer to automatically boot from the recovery key even if TPM-measured files have changed, which circumvents the TPM's system integrity check.
|
||||
answer: While using a USB flash drive as both the startup key and for storage of the recovery key is technically possible, it isn't a best practice to use one USB flash drive to store both keys. If the USB flash drive that contains your startup key is lost or stolen, you also lose access to your recovery key. In addition, inserting this key would cause your computer to automatically boot from the recovery key even if TPM-measured files have changed, which circumvents the TPM's system integrity check.
|
||||
|
||||
- question: Can I save the startup key on multiple USB flash drives?
|
||||
answer: Yes, you can save a computer's startup key on multiple USB flash drives. Right-clicking a BitLocker-protected drive and selecting **Manage BitLocker** will provide you the options to duplicate the recovery keys as needed.
|
||||
@ -80,7 +86,7 @@ sections:
|
||||
answer: You can generate different startup keys for the same computer through scripting. However, for computers that have a TPM, creating different startup keys prevents BitLocker from using the TPM's system integrity check.
|
||||
|
||||
- question: Can I generate multiple PIN combinations?
|
||||
answer: You cannot generate multiple PIN combinations.
|
||||
answer: You can't generate multiple PIN combinations.
|
||||
|
||||
- question: What encryption keys are used in BitLocker? How do they work together?
|
||||
answer: Raw data is encrypted with the full volume encryption key, which is then encrypted with the volume master key. The volume master key is in turn encrypted by one of several possible methods depending on your authentication (that is, key protectors or TPM) and recovery scenarios.
|
||||
@ -93,16 +99,16 @@ sections:
|
||||
|
||||
- question: Why do I have to use the function keys to enter the PIN or the 48-character recovery password?
|
||||
answer: |
|
||||
The F1 through F10 keys are universally mapped scan codes available in the pre-boot environment on all computers and in all languages. The numeric keys 0 through 9 are not usable in the pre-boot environment on all keyboards.
|
||||
The F1 through F10 keys are universally mapped scan codes available in the pre-boot environment on all computers and in all languages. The numeric keys 0 through 9 aren't usable in the pre-boot environment on all keyboards.
|
||||
|
||||
When using an enhanced PIN, users should run the optional system check during the BitLocker setup process to ensure that the PIN can be entered correctly in the pre-boot environment.
|
||||
|
||||
- question: How does BitLocker help prevent an attacker from discovering the PIN that unlocks my operating system drive?
|
||||
answer: |
|
||||
It is possible that a personal identification number (PIN) can be discovered by an attacker performing a brute force attack. A brute force attack occurs when an attacker uses an automated tool to try different PIN combinations until the correct one is discovered. For BitLocker-protected computers, this type of attack, also known as a dictionary attack, requires that the attacker have physical access to the computer.
|
||||
It's possible that a personal identification number (PIN) can be discovered by an attacker performing a brute force attack. A brute force attack occurs when an attacker uses an automated tool to try different PIN combinations until the correct one is discovered. For BitLocker-protected computers, this type of attack, also known as a dictionary attack, requires that the attacker has physical access to the computer.
|
||||
|
||||
The TPM has the built-in ability to detect and react to these types of attacks. Because different manufacturers' TPMs may support different PIN and attack mitigations, contact your TPM's manufacturer to determine how your computer's TPM mitigates PIN brute force attacks.
|
||||
After you have determined your TPM's manufacturer, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset.
|
||||
After you've determined your TPM's manufacturer, contact the manufacturer to gather the TPM's vendor-specific information. Most manufacturers use the PIN authentication failure count to exponentially increase lockout time to the PIN interface. However, each manufacturer has different policies regarding when and how the failure counter is decreased or reset.
|
||||
|
||||
- question: How can I determine the manufacturer of my TPM?
|
||||
answer: You can determine your TPM manufacturer in **Windows Defender Security Center** > **Device Security** > **Security processor details**.
|
||||
@ -117,6 +123,6 @@ sections:
|
||||
|
||||
- question: Can PIN length and complexity be managed with Group Policy?
|
||||
answer: |
|
||||
Yes and No. You can configure the minimum personal identification number (PIN) length by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** Group Policy setting. However, you cannot require PIN complexity by Group Policy.
|
||||
Yes and No. You can configure the minimum personal identification number (PIN) length by using the **Configure minimum PIN length for startup** Group Policy setting and allow the use of alphanumeric PINs by enabling the **Allow enhanced PINs for startup** Group Policy setting. However, you can't require PIN complexity by Group Policy.
|
||||
|
||||
For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md).
|
||||
|
||||
@ -85,7 +85,7 @@ When installing the BitLocker optional component on a server, you will also need
|
||||
|
||||
| Topic | Description |
|
||||
| - | - |
|
||||
| [Overview of BitLocker Device Encryption in Windows 10](bitlocker-device-encryption-overview-windows-10.md) | This topic provides an overview of the ways in which BitLocker Device Encryption can help protect data on devices running Windows 10. |
|
||||
| [Overview of BitLocker Device Encryption in Windows 10](bitlocker-device-encryption-overview-windows-10.md) | This topic provides an overview of the ways in which BitLocker Device Encryption can help protect data on devices running Windows 10. |
|
||||
| [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml) | This topic answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.|
|
||||
| [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)| This topic explains the procedure you can use to plan your BitLocker deployment. |
|
||||
| [BitLocker basic deployment](bitlocker-basic-deployment.md) | This topic explains how BitLocker features can be used to protect your data through drive encryption. |
|
||||
|
||||
@ -103,16 +103,16 @@ Before you create a thorough BitLocker recovery process, we recommend that you t
|
||||
|
||||
**To force a recovery for the local computer:**
|
||||
|
||||
1. Select the **Start** button, type **cmd** in the **Start Search** box, and select and hold **cmd.exe**, and then select **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press **ENTER**:
|
||||
1. Select the **Start** button, type **cmd** in the **Start Search** box, and select and hold **cmd.exe**, and then select **Run as administrator**.
|
||||
2. At the command prompt, type the following command and then press **ENTER**:
|
||||
|
||||
`manage-bde.exe -forcerecovery <BitLockerVolume>`
|
||||
|
||||
**To force recovery for a remote computer:**
|
||||
|
||||
1. On the Start screen, type **cmd.exe**, and then select **Run as administrator**.
|
||||
1. On the Start screen, type **cmd.exe**, and then select **Run as administrator**.
|
||||
|
||||
2. At the command prompt, type the following command and then press **ENTER**:
|
||||
2. At the command prompt, type the following command and then press **ENTER**:
|
||||
|
||||
`manage-bde.exe -ComputerName <RemoteComputerName> -forcerecovery <BitLockerVolume>`
|
||||
|
||||
@ -220,12 +220,12 @@ While an administrator can remotely investigate the cause of recovery in some ca
|
||||
|
||||
Review and answer the following questions for your organization:
|
||||
|
||||
1. Which BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC?
|
||||
2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be?
|
||||
3. If TPM mode was in effect, was recovery caused by a boot file change?
|
||||
4. If recovery was caused by a boot file change, is the boot file change due to an intended user action (for example, BIOS upgrade), or a malicious software?
|
||||
5. When was the user last able to start the computer successfully, and what might have happened to the computer since then?
|
||||
6. Might the user have encountered malicious software or left the computer unattended since the last successful startup?
|
||||
1. Which BitLocker protection mode is in effect (TPM, TPM + PIN, TPM + startup key, startup key only)? Which PCR profile is in use on the PC?
|
||||
2. Did the user merely forget the PIN or lose the startup key? If a token was lost, where might the token be?
|
||||
3. If TPM mode was in effect, was recovery caused by a boot file change?
|
||||
4. If recovery was caused by a boot file change, is the boot file change due to an intended user action (for example, BIOS upgrade), or a malicious software?
|
||||
5. When was the user last able to start the computer successfully, and what might have happened to the computer since then?
|
||||
6. Might the user have encountered malicious software or left the computer unattended since the last successful startup?
|
||||
|
||||
To help you answer these questions, use the BitLocker command-line tool to view the current configuration and protection mode (for example, **manage-bde -status**). Scan the event log to find events that help indicate why recovery was initiated (for example, if a boot file change occurred). Both of these capabilities can be performed remotely.
|
||||
|
||||
@ -249,11 +249,11 @@ If a user has forgotten the PIN, you must reset the PIN while you are logged on
|
||||
|
||||
**To prevent continued recovery due to an unknown PIN**
|
||||
|
||||
1. Unlock the computer using the recovery password.
|
||||
2. Reset the PIN:
|
||||
1. Select and hold the drive and then select **Change PIN**
|
||||
2. In the BitLocker Drive Encryption dialog, select **Reset a forgotten PIN**. If you are not logged in with an administrator account, you must provide administrative credentials at this time.
|
||||
3. In the PIN reset dialog, provide and confirm the new PIN to be used and then select **Finish**.
|
||||
1. Unlock the computer using the recovery password.
|
||||
2. Reset the PIN:
|
||||
1. Select and hold the drive and then select **Change PIN**
|
||||
2. In the BitLocker Drive Encryption dialog, select **Reset a forgotten PIN**. If you are not logged in with an administrator account, you must provide administrative credentials at this time.
|
||||
3. In the PIN reset dialog, provide and confirm the new PIN to be used and then select **Finish**.
|
||||
3. You will use the new PIN the next time you unlock the drive.
|
||||
|
||||
### <a href="" id="bkmk-loststartup"></a>Lost startup key
|
||||
@ -262,9 +262,9 @@ If you have lost the USB flash drive that contains the startup key, then you mus
|
||||
|
||||
**To prevent continued recovery due to a lost startup key**
|
||||
|
||||
1. Log on as an administrator to the computer that has its startup key lost.
|
||||
2. Open Manage BitLocker.
|
||||
3. Select **Duplicate start up key**, insert the clean USB drive on which you are going to write the key, and then select **Save**.
|
||||
1. Log on as an administrator to the computer that has its startup key lost.
|
||||
2. Open Manage BitLocker.
|
||||
3. Select **Duplicate start up key**, insert the clean USB drive on which you are going to write the key, and then select **Save**.
|
||||
|
||||
### <a href="" id="bkmk-changebootknown"></a>Changes to boot files
|
||||
|
||||
@ -457,22 +457,22 @@ You can reset the recovery password in two ways:
|
||||
|
||||
**To reset a recovery password using manage-bde:**
|
||||
|
||||
1. Remove the previous recovery password.
|
||||
1. Remove the previous recovery password.
|
||||
|
||||
```powershell
|
||||
Manage-bde -protectors -delete C: -type RecoveryPassword
|
||||
```
|
||||
2. Add the new recovery password.
|
||||
2. Add the new recovery password.
|
||||
|
||||
```powershell
|
||||
Manage-bde -protectors -add C: -RecoveryPassword
|
||||
```
|
||||
3. Get the ID of the new recovery password. From the screen, copy the ID of the recovery password.
|
||||
3. Get the ID of the new recovery password. From the screen, copy the ID of the recovery password.
|
||||
|
||||
```powershell
|
||||
Manage-bde -protectors -get C: -Type RecoveryPassword
|
||||
```
|
||||
4. Back up the new recovery password to AD DS.
|
||||
4. Back up the new recovery password to AD DS.
|
||||
|
||||
```powershell
|
||||
Manage-bde -protectors -adbackup C: -id {EXAMPLE6-5507-4924-AA9E-AFB2EB003692}
|
||||
@ -483,8 +483,8 @@ You can reset the recovery password in two ways:
|
||||
|
||||
**To run the sample recovery password script:**
|
||||
|
||||
1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs.
|
||||
2. At the command prompt, type a command similar to the following:
|
||||
1. Save the following sample script in a VBScript file. For example: ResetPassword.vbs.
|
||||
2. At the command prompt, type a command similar to the following:
|
||||
|
||||
**cscript ResetPassword.vbs**
|
||||
|
||||
@ -579,8 +579,8 @@ The following sample script exports all previously saved key packages from AD DS
|
||||
|
||||
**To run the sample key package retrieval script:**
|
||||
|
||||
1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackageADDS.vbs.
|
||||
2. At the command prompt, type a command similar to the following sample script:
|
||||
1. Save the following sample script in a VBScript file. For example: GetBitLockerKeyPackageADDS.vbs.
|
||||
2. At the command prompt, type a command similar to the following sample script:
|
||||
|
||||
**cscript GetBitLockerKeyPackageADDS.vbs -?**
|
||||
|
||||
|
||||
@ -32,9 +32,9 @@ Both manage-bde and the BitLocker cmdlets can be used to perform any task that c
|
||||
|
||||
Repair-bde is a special circumstance tool that is provided for disaster recovery scenarios in which a BitLocker protected drive can't be unlocked normally or using the recovery console.
|
||||
|
||||
1. [Manage-bde](#bkmk-managebde)
|
||||
2. [Repair-bde](#bkmk-repairbde)
|
||||
3. [BitLocker cmdlets for Windows PowerShell](#bkmk-blcmdlets)
|
||||
1. [Manage-bde](#bkmk-managebde)
|
||||
2. [Repair-bde](#bkmk-repairbde)
|
||||
3. [BitLocker cmdlets for Windows PowerShell](#bkmk-blcmdlets)
|
||||
|
||||
## <a href="" id="bkmk-managebde"></a>Manage-bde
|
||||
|
||||
@ -142,9 +142,9 @@ Windows PowerShell cmdlets provide a new way for administrators to use when work
|
||||
|
||||
Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel. As with manage-bde, users need to consider the specific needs of the volume they're encrypting prior to running Windows PowerShell cmdlets.
|
||||
|
||||
A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the <code>Get-BitLockerVolume</code> cmdlet.
|
||||
A good initial step is to determine the current state of the volume(s) on the computer. You can do this using the `Get-BitLockerVolume` cmdlet.
|
||||
|
||||
The <code>Get-BitLockerVolume</code> cmdlet output gives information on the volume type, protectors, protection status, and other details.
|
||||
The `Get-BitLockerVolume` cmdlet output gives information on the volume type, protectors, protection status, and other details.
|
||||
|
||||
> [!TIP]
|
||||
> Occasionally, all protectors may not be shown when using `Get-BitLockerVolume` due to lack of space in the output display. If you don't see all of the protectors for a volume, you can use the Windows PowerShell pipe command (|) to format a full listing of the protectors.
|
||||
|
||||
@ -40,20 +40,20 @@ The following procedures describe the most common tasks performed by using the B
|
||||
|
||||
**To view the recovery passwords for a computer**
|
||||
|
||||
1. In **Active Directory Users and Computers**, locate and then click the container in which the computer is located.
|
||||
2. Right-click the computer object, and then click **Properties**.
|
||||
3. In the **Properties** dialog box, click the **BitLocker Recovery** tab to view the BitLocker recovery passwords that are associated with the computer.
|
||||
1. In **Active Directory Users and Computers**, locate and then click the container in which the computer is located.
|
||||
2. Right-click the computer object, and then click **Properties**.
|
||||
3. In the **Properties** dialog box, click the **BitLocker Recovery** tab to view the BitLocker recovery passwords that are associated with the computer.
|
||||
|
||||
**To copy the recovery passwords for a computer**
|
||||
|
||||
1. Follow the steps in the previous procedure to view the BitLocker recovery passwords.
|
||||
2. On the **BitLocker Recovery** tab of the **Properties** dialog box, right-click the BitLocker recovery password that you want to copy, and then click **Copy Details**.
|
||||
3. Press CTRL+V to paste the copied text to a destination location, such as a text file or spreadsheet.
|
||||
1. Follow the steps in the previous procedure to view the BitLocker recovery passwords.
|
||||
2. On the **BitLocker Recovery** tab of the **Properties** dialog box, right-click the BitLocker recovery password that you want to copy, and then click **Copy Details**.
|
||||
3. Press CTRL+V to paste the copied text to a destination location, such as a text file or spreadsheet.
|
||||
|
||||
**To locate a recovery password by using a password ID**
|
||||
|
||||
1. In Active Directory Users and Computers, right-click the domain container, and then click **Find BitLocker Recovery Password**.
|
||||
2. In the **Find BitLocker Recovery Password** dialog box, type the first eight characters of the recovery password in the **Password ID (first 8 characters)** box, and then click **Search**.
|
||||
1. In Active Directory Users and Computers, right-click the domain container, and then click **Find BitLocker Recovery Password**.
|
||||
2. In the **Find BitLocker Recovery Password** dialog box, type the first eight characters of the recovery password in the **Password ID (first 8 characters)** box, and then click **Search**.
|
||||
By completing the procedures in this scenario, you have viewed and copied the recovery passwords for a computer and used a password ID to locate a recovery password.
|
||||
|
||||
## More information
|
||||
|
||||
@ -101,7 +101,9 @@ sections:
|
||||
|
||||
The syntax of this command is:
|
||||
|
||||
<code>manage-bde <i>driveletter</i> -lock</code>
|
||||
``` syntax
|
||||
manage-bde <driveletter> -lock
|
||||
````
|
||||
|
||||
Outside of using this command, data drives will be locked on shutdown and restart of the operating system. A removable data drive will also be locked automatically when the drive is removed from the computer.
|
||||
|
||||
|
||||
@ -52,15 +52,15 @@ You can also use an Active Directory Domain Services (AD DS) protector for prote
|
||||
- BitLocker service interrupts the request and uses the BitLocker protect/unprotect APIs to unlock or deny the request.
|
||||
- BitLocker will unlock protected volumes without user intervention by attempting protectors in the following order:
|
||||
|
||||
1. Clear key
|
||||
2. Driver-based auto-unlock key
|
||||
3. **ADAccountOrGroup** protector
|
||||
1. Clear key
|
||||
2. Driver-based auto-unlock key
|
||||
3. **ADAccountOrGroup** protector
|
||||
|
||||
a. Service context protector
|
||||
|
||||
b. User protector
|
||||
|
||||
4. Registry-based auto-unlock key
|
||||
4. Registry-based auto-unlock key
|
||||
|
||||
> [!NOTE]
|
||||
> A Windows Server 2012 or later domain controller is required for this feature to work properly.
|
||||
@ -73,14 +73,14 @@ BitLocker encryption is available for disks before these disks are added to a cl
|
||||
The advantage of encrypting volumes prior to adding them to a cluster is that the disk resource need not be suspended to complete the operation.
|
||||
To turn on BitLocker for a disk before adding it to a cluster:
|
||||
|
||||
1. Install the BitLocker Drive Encryption feature if it isn't already installed.
|
||||
2. Ensure the disk is an NTFS-formatted one and has a drive letter assigned to it.
|
||||
3. Identify the name of the cluster with Windows PowerShell.
|
||||
1. Install the BitLocker Drive Encryption feature if it isn't already installed.
|
||||
2. Ensure the disk is an NTFS-formatted one and has a drive letter assigned to it.
|
||||
3. Identify the name of the cluster with Windows PowerShell.
|
||||
|
||||
```powershell
|
||||
Get-Cluster
|
||||
```
|
||||
4. Enable BitLocker on the volume of your choice with an **ADAccountOrGroup** protector, using the cluster name. For example, use a command such as:
|
||||
4. Enable BitLocker on the volume of your choice with an **ADAccountOrGroup** protector, using the cluster name. For example, use a command such as:
|
||||
|
||||
```powershell
|
||||
Enable-BitLocker E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$
|
||||
@ -88,31 +88,31 @@ To turn on BitLocker for a disk before adding it to a cluster:
|
||||
> [!WARNING]
|
||||
> You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker enabled volume to either be shared in a Cluster Shared Volume or to fail over properly in a traditional failover cluster.
|
||||
|
||||
5. Repeat the preceding steps for each disk in the cluster.
|
||||
5. Repeat the preceding steps for each disk in the cluster.
|
||||
|
||||
6. Add the volume(s) to the cluster.
|
||||
6. Add the volume(s) to the cluster.
|
||||
|
||||
### Turning on BitLocker for a clustered disk using Windows PowerShell
|
||||
|
||||
When the cluster service owns a disk resource already, the disk resource needs to be set into maintenance mode before BitLocker can be enabled. To turn on the Bitlocker for a clustered disk using Windows PowerShell, perform the following steps:
|
||||
|
||||
1. Install the BitLocker drive encryption feature if it isn't already installed.
|
||||
2. Check the status of the cluster disk using Windows PowerShell.
|
||||
1. Install the BitLocker drive encryption feature if it isn't already installed.
|
||||
2. Check the status of the cluster disk using Windows PowerShell.
|
||||
|
||||
```powershell
|
||||
Get-ClusterResource "Cluster Disk 1"
|
||||
```
|
||||
3. Put the physical disk resource into maintenance mode using Windows PowerShell.
|
||||
3. Put the physical disk resource into maintenance mode using Windows PowerShell.
|
||||
|
||||
```powershell
|
||||
Get-ClusterResource "Cluster Disk 1" | Suspend-ClusterResource
|
||||
```
|
||||
4. Identify the name of the cluster with Windows PowerShell.
|
||||
4. Identify the name of the cluster with Windows PowerShell.
|
||||
|
||||
```powershell
|
||||
Get-Cluster
|
||||
```
|
||||
5. Enable BitLocker on the volume of your choice with an **ADAccountOrGroup** protector, using the cluster name. For example, use a command such as:
|
||||
5. Enable BitLocker on the volume of your choice with an **ADAccountOrGroup** protector, using the cluster name. For example, use a command such as:
|
||||
|
||||
```powershell
|
||||
Enable-BitLocker E: -ADAccountOrGroupProtector -ADAccountOrGroup CLUSTER$
|
||||
@ -121,42 +121,42 @@ When the cluster service owns a disk resource already, the disk resource needs t
|
||||
> [!WARNING]
|
||||
> You must configure an **ADAccountOrGroup** protector using the cluster CNO for a BitLocker-enabled volume to either be shared in a cluster-shared Volume or to fail over properly in a traditional failover cluster.
|
||||
|
||||
6. Use **Resume-ClusterResource** to take back the physical disk resource out of maintenance mode:
|
||||
6. Use **Resume-ClusterResource** to take back the physical disk resource out of maintenance mode:
|
||||
|
||||
```powershell
|
||||
Get-ClusterResource "Cluster Disk 1" | Resume-ClusterResource
|
||||
```
|
||||
7. Repeat the preceding steps for each disk in the cluster.
|
||||
7. Repeat the preceding steps for each disk in the cluster.
|
||||
|
||||
### Adding BitLocker-encrypted volumes to a cluster using manage-bde
|
||||
|
||||
You can also use **manage-bde** to enable BitLocker on clustered volumes. The steps needed to add a physical disk resource or CSV2.0 volume to an existing cluster are:
|
||||
|
||||
1. Verify that the BitLocker drive encryption feature is installed on the computer.
|
||||
2. Ensure new storage is formatted as NTFS.
|
||||
3. Encrypt the volume, add a recovery key and add the cluster administrator as a protector key using the**manage-bde** command line interface (see example):
|
||||
1. Verify that the BitLocker drive encryption feature is installed on the computer.
|
||||
2. Ensure new storage is formatted as NTFS.
|
||||
3. Encrypt the volume, add a recovery key and add the cluster administrator as a protector key using the**manage-bde** command line interface (see example):
|
||||
|
||||
- `manage-bde.exe -on -used <drive letter> -RP -sid domain\CNO$ -sync`
|
||||
|
||||
1. BitLocker will check to see if the disk is already part of a cluster. If it is, administrators will encounter a hard block. Otherwise, the encryption continues.
|
||||
2. Using the -sync parameter is optional. However, using -sync parameter has the following advantage:
|
||||
1. BitLocker will check to see if the disk is already part of a cluster. If it is, administrators will encounter a hard block. Otherwise, the encryption continues.
|
||||
2. Using the -sync parameter is optional. However, using -sync parameter has the following advantage:
|
||||
- The -sync parameter ensures the command waits until the encryption for the volume is completed. The volume is then released for use in the cluster storage pool.
|
||||
|
||||
4. Open the Failover Cluster Manager snap-in or cluster PowerShell cmdlets to enable the disk to be clustered.
|
||||
4. Open the Failover Cluster Manager snap-in or cluster PowerShell cmdlets to enable the disk to be clustered.
|
||||
|
||||
|
||||
- Once the disk is clustered, it's enabled for CSV.
|
||||
|
||||
|
||||
5. During the resource online operation, cluster checks whether the disk is BitLocker encrypted.
|
||||
5. During the resource online operation, cluster checks whether the disk is BitLocker encrypted.
|
||||
|
||||
1. If the volume isn't BitLocker enabled, traditional cluster online operations occur.
|
||||
2. If the volume is BitLocker enabled, the following check occurs:
|
||||
1. If the volume isn't BitLocker enabled, traditional cluster online operations occur.
|
||||
2. If the volume is BitLocker enabled, the following check occurs:
|
||||
|
||||
|
||||
- If volume is **locked**, BitLocker impersonates the CNO and unlocks the volume using the CNO protector. If these actions by BitLocker fail, an event is logged. The logged event will state that the volume couldn't be unlocked and the online operation has failed.
|
||||
|
||||
6. Once the disk is online in the storage pool, it can be added to a CSV by right-clicking the disk resource and choosing "**Add to cluster shared volumes**".
|
||||
6. Once the disk is online in the storage pool, it can be added to a CSV by right-clicking the disk resource and choosing "**Add to cluster shared volumes**".
|
||||
CSVs include both encrypted and unencrypted volumes. To check the status of a particular volume for BitLocker encryption: administrators must do the following task:
|
||||
|
||||
- Utilize the **manage-bde -status** command with a path to the volume.
|
||||
|
||||
Reference in New Issue
Block a user