diff --git a/windows/security/operating-system-security/data-protection/bitlocker/_bitlocker-group-policy-settings.md b/windows/security/operating-system-security/data-protection/bitlocker/_bitlocker-group-policy-settings.md index 5ab4435990..c9ffeb82d2 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/_bitlocker-group-policy-settings.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/_bitlocker-group-policy-settings.md @@ -43,40 +43,6 @@ This policy setting is used to require, allow, or deny the use of smart cards wi > [!NOTE] > These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive by using any of the protectors that are available on the drive. -### Configure use of passwords on fixed data drives - -This policy setting is used to require, allow, or deny the use of passwords with fixed data drives. - -| Item | Info | -|:---|:---| -|**Policy description**|With this policy setting, it can be specified whether a password is required to unlock BitLocker-protected fixed data drives.| -|**Drive type**|Fixed data drives| -|**Policy path**|*Computer Configuration* > *Administrative Templates* > *Windows Components* > *BitLocker Drive Encryption* > *Fixed Data Drives*| -|**Conflicts**|To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled.| -|**When enabled**|Users can configure a password that meets the defined requirements. To require the use of a password, select **Require password for fixed data drive**. To enforce complexity requirements on the password, select **Require complexity**.| -|**When disabled**|The user isn't allowed to use a password.| -|**When not configured**|Passwords are supported with the default settings, which don't include password complexity requirements and require only eight characters.| - -#### Reference: Configure use of passwords on fixed data drives - -When set to **Require complexity**, a connection to a domain controller is necessary to validate the complexity of the password when BitLocker is enabled. - -When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. However, if no domain controllers are found, the password is accepted regardless of the actual password complexity, and the drive is encrypted by using that password as a protector. - -When set to **Do not allow complexity**, no password complexity validation is performed. - -Passwords must be at least eight characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. - -> [!NOTE] -> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. - -For the complexity requirement setting to be effective, the Group Policy setting **Computer Configuration** > **Windows Settings** > **Security Settings** > **Account Policies** > **Password Policy** > **Password must meet complexity requirements** must also be enabled. This policy setting is configured on a per-computer basis. The policy setting also applies to both local user accounts and domain user accounts. Because the password filter that's used to validate password complexity is located on the domain controllers, local user accounts can't access the password filter because they're not authenticated for domain access. When this policy setting is enabled, if a local user account signs in, and a drive is attempted to be encrypted or a password changed on an existing BitLocker-protected drive, an **Access denied** error message is displayed. In this situation, the password key protector can't be added to the drive. - -Enabling this policy setting requires that a device is connected to a domain before adding a password key protector to a BitLocker-protected drive. Users who work remotely and have periods of time in which they can't connect to the domain should be made aware of this requirement so that they can schedule a time when they'll be connected to the domain to turn on BitLocker or to change a password on a BitLocker-protected data drive. - -> [!IMPORTANT] -> Passwords can't be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in *Computer Configuration* > *Windows Settings* > *Security Settings* > *Local Policies* > *Security Options* specifies whether FIPS compliance is enabled. - ### Configure use of smart cards on removable data drives This policy setting is used to require, allow, or deny the use of smart cards with removable data drives. diff --git a/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-warning-for-other-disk-encryption.md b/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-warning-for-other-disk-encryption.md index 46316add2e..dd754855d0 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-warning-for-other-disk-encryption.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/includes/allow-warning-for-other-disk-encryption.md @@ -7,6 +7,32 @@ ms.topic: include ### Allow warning for other disk encryption +With this policy you can disable all notification for encryption, warning prompt for other disk encryption, and turn on encryption silently. + +> [!IMPORTANT] +> This policy applies to Microsoft Entra joined devices only. + +This policy takes effect only if [Require device encryption](../policy-settings.md?tabs=os#require-device-encryption) policy is enabled. + +> [!WARNING] +> When you enable BitLocker on a device with third party encryption, it may render the device unusable and will require reinstallation of Windows. + +The expected values for this policy are: + +- Enabled (default): warning prompt and encryption notification is allowed +- Disabled: warning prompt and encryption notification are suppressed. Windows will attempt to silently enable BitLocker + +> [!NOTE] +> When you disable the warning prompt, the OS drive's recovery key will back up to the user's Microsoft Entra ID account. When you allow the warning prompt, the user who receives the prompt can select where to back up the OS drive's recovery key. +> +> The endpoint for a fixed data drive's backup is chosen in the following order: +> +> 1. The user's Windows Server Active Directory Domain Services account +> 2. The user's Microsoft Entra ID account +> 3. The user's personal OneDrive (MDM/MAM only) +> +> Encryption will wait until one of these three locations backs up successfully. + | | Path | |--|--| | **CSP** | `./Device/Vendor/MSFT/BitLocker/`[AllowWarningForOtherDiskEncryption](/windows/client-management/mdm/bitlocker-csp#allowwarningforotherdiskencryption) | diff --git a/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-use-of-passwords-for-fixed-data-drives.md b/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-use-of-passwords-for-fixed-data-drives.md index ba5c268c69..d7f83ada9b 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-use-of-passwords-for-fixed-data-drives.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/includes/configure-use-of-passwords-for-fixed-data-drives.md @@ -9,6 +9,33 @@ ms.topic: include This policy setting specifies whether a password is required to unlock BitLocker-protected fixed data drives. If you choose to permit the use of a password, you can require that a password be used, enforce complexity requirements on the password, and configure a minimum length for the password. For the complexity requirement setting to be effective the Group Policy setting "Password must meet complexity requirements" located in Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\ must be also enabled. Note: These settings are enforced when turning on BitLocker, not when unlocking a volume. BitLocker will allow unlocking a drive with any of the protectors available on the drive. If you enable this policy setting, users can configure a password that meets the requirements you define. To require the use of a password, select "Require password for fixed data drive". To enforce complexity requirements on the password, select "Require complexity". When set to "Require complexity" a connection to a domain controller is necessary when BitLocker is enabled to validate the complexity the password. When set to "Allow complexity" a connection to a domain controller will be attempted to validate the complexity adheres to the rules set by the policy, but if no domain controllers are found the password will still be accepted regardless of actual password complexity and the drive will be encrypted using that password as a protector. When set to "Do not allow complexity", no password complexity validation will be done. Passwords must be at least 8 characters. To configure a greater minimum length for the password, enter the desired number of characters in the "Minimum password length" box. If you disable this policy setting, the user is not allowed to use a password. If you do not configure this policy setting, passwords will be supported with the default settings, which do not include password complexity requirements and require only 8 characters. Note: Passwords cannot be used if FIPS-compliance is enabled. The "System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing" policy setting in Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options specifies whether FIPS-compliance is enabled. +This policy setting is used to require, allow, or deny the use of passwords with fixed data drives. + +To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled. + +Users can configure a password that meets the defined requirements. To require the use of a password, select **Require password for fixed data drive**. To enforce complexity requirements on the password, select **Require complexity**. + +**When disabled** The user isn't allowed to use a password. +**When not configured** Passwords are supported with the default settings, which don't include password complexity requirements and require only eight characters. + +When set to **Require complexity**, a connection to a domain controller is necessary to validate the complexity of the password when BitLocker is enabled. + +When set to **Allow complexity**, a connection to a domain controller is attempted to validate that the complexity adheres to the rules set by the policy. However, if no domain controllers are found, the password is accepted regardless of the actual password complexity, and the drive is encrypted by using that password as a protector. + +When set to **Do not allow complexity**, no password complexity validation is performed. + +Passwords must be at least eight characters. To configure a greater minimum length for the password, enter the desired number of characters in the **Minimum password length** box. + +> [!NOTE] +> These settings are enforced when turning on BitLocker, not when unlocking a drive. BitLocker allows unlocking a drive with any of the protectors that are available on the drive. + +For the complexity requirement setting to be effective, the Group Policy setting **Computer Configuration** > **Windows Settings** > **Security Settings** > **Account Policies** > **Password Policy** > **Password must meet complexity requirements** must also be enabled. This policy setting is configured on a per-computer basis. The policy setting also applies to both local user accounts and domain user accounts. Because the password filter that's used to validate password complexity is located on the domain controllers, local user accounts can't access the password filter because they're not authenticated for domain access. When this policy setting is enabled, if a local user account signs in, and a drive is attempted to be encrypted or a password changed on an existing BitLocker-protected drive, an **Access denied** error message is displayed. In this situation, the password key protector can't be added to the drive. + +Enabling this policy setting requires that a device is connected to a domain before adding a password key protector to a BitLocker-protected drive. Users who work remotely and have periods of time in which they can't connect to the domain should be made aware of this requirement so that they can schedule a time when they'll be connected to the domain to turn on BitLocker or to change a password on a BitLocker-protected data drive. + +> [!IMPORTANT] +> Passwords can't be used if FIPS compliance is enabled. The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting in *Computer Configuration* > *Windows Settings* > *Security Settings* > *Local Policies* > *Security Options* specifies whether FIPS compliance is enabled. + | | Path | |--|--| | **CSP** | Not available | diff --git a/windows/security/operating-system-security/data-protection/bitlocker/includes/require-device-encryption.md b/windows/security/operating-system-security/data-protection/bitlocker/includes/require-device-encryption.md index 3b12ff902b..731685b57f 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/includes/require-device-encryption.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/includes/require-device-encryption.md @@ -7,10 +7,15 @@ ms.topic: include ### Require device encryption -This policy setting determines whether BitLocker is required on a drive.\ -If you disable the policy, BitLocker isn't turned off for the system drive, but it stops prompting the user to turn BitLocker on. +This policy setting determines whether BitLocker is required: -Encryptable fixed data volumes are treated similarly to OS volumes. However, fixed data volumes must meet other criteria to be considered encryptable: +- If enabled, encryption is triggered on all drives silently or non-silently based on [Allow warning for other disk encryption](../policy-settings.md?tabs=os#allow-warning-for-other-disk-encryption) policy +- If disabled, BitLocker isn't turned off for the system drive, but it stops prompting the user to turn BitLocker on. + +> [!NOTE] +> Typically, BitLocker follows the [Choose drive encryption method and cipher strength](../policy-settings.md?tabs=os#choose-drive-encryption-method-and-cipher-strength) policy configuration. However, this policy setting will be ignored for self-encrypting fixed drives and self-encrypting OS drives. + +Encryptable fixed data volumes are treated similarly to OS volumes, but they must meet other criteria to be encryptable: - It must not be a dynamic volume - It must not be a recovery partition diff --git a/windows/security/operating-system-security/data-protection/bitlocker/policy-settings.md b/windows/security/operating-system-security/data-protection/bitlocker/policy-settings.md index 42b4dbc181..a696b64607 100644 --- a/windows/security/operating-system-security/data-protection/bitlocker/policy-settings.md +++ b/windows/security/operating-system-security/data-protection/bitlocker/policy-settings.md @@ -77,7 +77,7 @@ The following table lists the BitLocker policies applicable to all drive types, |[Enable use of BitLocker authentication requiring preboot keyboard input on slates](#enable-use-of-bitlocker-authentication-requiring-preboot-keyboard-input-on-slates)|✅|✅| |[Enforce drive encryption type on operating system drives](#enforce-drive-encryption-type-on-operating-system-drives)|✅|✅| |[Require additional authentication at startup](#require-additional-authentication-at-startup)|✅|✅| -|[Require Device Encryption](#require-device-encryption)|✅|❌| +|[Require device encryption](#require-device-encryption)|✅|❌| |[Reset platform validation data after BitLocker recovery](#reset-platform-validation-data-after-bitlocker-recovery)|❌|✅| |[Use enhanced Boot Configuration Data validation profile](#use-enhanced-boot-configuration-data-validation-profile)|❌|✅|