8.5 KiB
title, description, author, ms.author, ms.reviewer, manager, ms.topic, ms.prod, ms.technology, ms.localizationpriority, ms.date
| title | description | author | ms.author | ms.reviewer | manager | ms.topic | ms.prod | ms.technology | ms.localizationpriority | ms.date |
|---|---|---|---|---|---|---|---|---|---|---|
| Personal Data Encryption (PDE) | Personal Data Encryption unlocks user encrypted files at user sign-in instead of at boot. | frankroj | frankroj | rafals | aaroncz | how-to | windows-client | itpro-security | medium | 09/22/2022 |
Personal Data Encryption (PDE)
(Applies to: Windows 11, version 22H2 and later Enterprise and Education editions)
[!INCLUDE Personal Data Encryption (PDE) description]
Prerequisites
Required
- Azure AD joined device
- Windows Hello for Business
- Windows 11, version 22H2 and later Enterprise and Education editions
Not supported with PDE
- FIDO/security key authentication
- Winlogon automatic restart sign-on (ARSO)
- For information on disabling ARSO via Intune, see Disable Winlogon automatic restart sign-on (ARSO)).
- Windows Information Protection (WIP)
- Hybrid Azure AD joined devices
- Remote Desktop connections
Highly recommended
- BitLocker Drive Encryption enabled
- Although PDE will work without BitLocker, it's recommended to also enable BitLocker. PDE is meant to supplement BitLocker and not replace it.
- Backup solution such as OneDrive
- In certain scenarios such as TPM resets or destructive PIN resets, the keys used by PDE to decrypt files can be lost. In such scenarios, any file encrypted with PDE will no longer be accessible. The only way to recover such files would be from backup.
- Windows Hello for Business PIN reset service
- Destructive PIN resets will cause keys used by PDE to decrypt files to be lost. The destructive PIN reset will make any file encrypted with PDE no longer accessible after a destructive PIN reset. Files encrypted with PDE will need to be recovered from a backup after a destructive PIN reset. For this reason Windows Hello for Business PIN reset service is recommended since it provides non-destructive PIN resets.
- Windows Hello Enhanced Sign-in Security
- Provides additional security when authenticating with Windows Hello for Business via biometrics or PIN
- Kernel and user mode crash dumps disabled
- Crash dumps can potentially cause the keys used by PDE decrypt files to be exposed. For greatest security, disable kernel and user mode crash dumps. For information on disabling crash dumbs via Intune, see Disable crash dumps.
- Hibernation disabled
- Hibernation files can potentially cause the keys used by PDE to decrypt files to be exposed. For greatest security, disable hibernation. For information on disabling crash dumbs via Intune, see Disable hibernation.
PDE protection levels
PDE uses AES-CBC with a 256-bit key to encrypt files and offers two levels of protection. The level of protection is determined based on the organizational needs. These levels can be set via the PDE APIs.
| Item | Level 1 | Level 2 |
|---|---|---|
| Data is accessible when user is signed in | Yes | Yes |
| Data is accessible when user has locked their device | Yes | No |
| Data is accessible after user signs out | No | No |
| Data is accessible when device is shut down | No | No |
| Decryption keys discarded | After user signs out | After user locks device or signs out |
PDE encrypted files accessibility
When a file is encrypted with PDE, its icon will show a padlock. If the user hasn't signed in locally with Windows Hello for Business or an unauthorized user attempts to access a PDE encrypted file, they'll be denied access to the file.
Scenarios where a user will be denied access to a PDE encrypted file include:
- User has signed into Windows via a password instead of signing in with Windows Hello for Business biometric or PIN.
- If specified via level 2 protection, when the device is locked.
- When trying to access files on the device remotely. For example, UNC network paths.
- Remote Desktop sessions.
- Other users on the device who aren't owners of the file, even if they're signed in via Windows Hello for Business and have permissions to navigate to the PDE encrypted files.
How to enable PDE
To enable PDE on devices, push an MDM policy to the devices with the following parameters:
- Name: Personal Data Encryption
- OMA-URI: ./User/Vendor/MSFT/PDE/EnablePersonalDataEncryption
- Data type: Integer
- Value: 1
There's also a PDE CSP available for MDM solutions that support it.
Note
Enabling the PDE policy on devices only enables the PDE feature. It does not encrypt any files. To encrypt files, use the PDE APIs to create custom applications and scripts to specify which files to encrypt and at what level to encrypt the files. Additionally, files will not encrypt via the APIs until this policy has been enabled.
For information on enabling PDE via Intune, see Enable Personal Data Encryption (PDE).
Differences between PDE and BitLocker
| Item | PDE | BitLocker |
|---|---|---|
| Release of key | At user sign-in via Windows Hello for Business | At boot |
| Keys discarded | At user sign-out | At reboot |
| Files encrypted | Individual specified files | Entire volume/drive |
| Authentication to access encrypted file | Windows Hello for Business | When BitLocker with PIN is enabled, BitLocker PIN plus Windows sign in |
| Accessibility | Windows Hello for Business is accessibility friendly | BitLocker with PIN doesn't have accessibility features |
Differences between PDE and EFS
The main difference between encrypting files with PDE instead of EFS is the method they use to encrypt the file. PDE uses Windows Hello for Business to secure the keys to decrypt the files. EFS uses certificates to secure and encrypt the files.
To see if a file is encrypted with PDE or EFS:
- Open the properties of the file
- Under the General tab, select Advanced...
- In the Advanced Attributes windows, select Details
For PDE encrypted files, under Protection status: there will be an item listed as Personal Data Encryption is: and it will have the attribute of On.
For EFS encrypted files, under Users who can access this file:, there will be a Certificate thumbprint next to the users with access to the file. There will also be a section at the bottom labeled Recovery certificates for this file as defined by recovery policy:.
Encryption information including what encryption method is being used can be obtained with the command line cipher.exe /c command.
Disable PDE and decrypt files
Currently there's no method to disable PDE via MDM policy. However, in certain scenarios PDE encrypted files can be decrypted using cipher.exe using the following steps:
- Open the properties of the file
- Under the General tab, select Advanced...
- Uncheck the option Encrypt contents to secure data
- Select OK, and then OK again
Important
Once a user selects to manually decrypt a file, they will not be able to manually encrypt the file again.
Windows out of box applications that support PDE
Certain Windows applications support PDE out of the box. If PDE is enabled on a device, these applications will utilize PDE.
- Mail
- Supports encrypting both email bodies and attachments