mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
119 lines
9.0 KiB
YAML
119 lines
9.0 KiB
YAML
### YamlMime:FAQ
|
|
metadata:
|
|
title: Using BitLocker with other programs FAQ
|
|
description: Learn how to integrate BitLocker with other software on a device.
|
|
ms.prod: windows-client
|
|
ms.technology: itpro-security
|
|
author: frankroj
|
|
ms.author: frankroj
|
|
manager: aaroncz
|
|
ms.topic: faq
|
|
ms.date: 11/08/2022
|
|
title: Using BitLocker with other programs FAQ
|
|
summary: |
|
|
**Applies to:**
|
|
- Windows 10 and later
|
|
- Windows Server 2016 and later
|
|
|
|
|
|
sections:
|
|
- name: Ignored
|
|
questions:
|
|
- question: |
|
|
Can I use EFS with BitLocker?
|
|
answer: |
|
|
Yes, Encrypting File System (EFS) can be used to encrypt files on a BitLocker-protected drive. BitLocker helps protect the entire operating system drive against offline attacks, whereas EFS can provide additional user-based file level encryption for security separation between multiple users of the same computer. EFS can also be used in Windows to encrypt files on other drives that aren't encrypted by BitLocker. The root secrets of EFS are stored by default on the operating system drive; therefore, if BitLocker is enabled for the operating system drive, data that is encrypted by EFS on other drives is also indirectly protected by BitLocker.
|
|
|
|
- question: |
|
|
Can I run a kernel debugger with BitLocker?
|
|
answer: |
|
|
Yes. However, the debugger should be turned on before enabling BitLocker. Turning on the debugger ensures that the correct measurements are calculated when sealing to the TPM, allowing the computer to start properly. If debugging needs to be turned on or off when using BitLocker, be sure to suspend BitLocker first to avoid putting the computer into recovery mode.
|
|
|
|
- question: |
|
|
How does BitLocker handle memory dumps?
|
|
answer: |
|
|
BitLocker has a storage driver stack that ensures memory dumps are encrypted when BitLocker is enabled.
|
|
|
|
- question: |
|
|
Can BitLocker support smart cards for pre-boot authentication?
|
|
answer: |
|
|
BitLocker doesn't support smart cards for pre-boot authentication. There's no single industry standard for smart card support in the firmware, and most computers either don't implement firmware support for smart cards, or only support specific smart cards and readers. This lack of standardization makes supporting them difficult.
|
|
|
|
- question: |
|
|
Can I use a non-Microsoft TPM driver?
|
|
answer: |
|
|
Microsoft doesn't support non-Microsoft TPM drivers and strongly recommends against using them with BitLocker. Attempting to use a non-Microsoft TPM driver with BitLocker may cause BitLocker to report that a TPM isn't present on the computer and not allow the TPM to be used with BitLocker.
|
|
|
|
- question: |
|
|
Can other tools that manage or modify the master boot record work with BitLocker?
|
|
answer: |
|
|
We don't recommend modifying the master boot record on computers whose operating system drives are BitLocker-protected for several security, reliability, and product support reasons. Changes to the master boot record (MBR) could change the security environment and prevent the computer from starting normally and complicate any efforts to recover from a corrupted MBR. Changes made to the MBR by anything other than Windows might force the computer into recovery mode or prevent it from booting entirely.
|
|
|
|
- question: |
|
|
Why is the system check failing when I'm encrypting my operating system drive?
|
|
answer: |
|
|
The system check is designed to ensure the computer's BIOS or UEFI firmware is compatible with BitLocker and that the TPM is working correctly. The system check can fail for several reasons:
|
|
|
|
- The computer's BIOS or UEFI firmware can't read USB flash drives.
|
|
- The computer's BIOS, uEFI firmware, or boot menu doesn't have reading USB flash drives enabled.
|
|
- There are multiple USB flash drives inserted into the computer.
|
|
- The PIN wasn't entered correctly.
|
|
- The computer's BIOS or UEFI firmware only supports using the function keys (F1-F10) to enter numerals in the pre-boot environment.
|
|
- The startup key was removed before the computer finished rebooting.
|
|
- The TPM has malfunctioned and fails to unseal the keys.
|
|
|
|
- question: |
|
|
What can I do if the recovery key on my USB flash drive can't be read?
|
|
answer: |
|
|
Some computers can't read USB flash drives in the pre-boot environment. First, check the BIOS or UEFI firmware and boot settings to ensure that the use of USB drives is enabled. If it isn't enabled, enable the use of USB drives in the BIOS or UEFI firmware and boot settings, and then try to read the recovery key from the USB flash drive again. If the USB flash drive still can't be read, the hard drive will need to be mounted as a data drive on another computer so that there's an operating system to attempt to read the recovery key from the USB flash drive. If the USB flash drive has been corrupted or damaged, a recovery password may need to be supplied or use the recovery information that was backed up to AD DS. Also, if the recovery key is being used in the pre-boot environment, ensure that the drive is formatted by using the NTFS, FAT16, or FAT32 file system.
|
|
|
|
- question: |
|
|
Why am I unable to save my recovery key to my USB flash drive?
|
|
answer: |
|
|
The **Save to USB** option isn't shown by default for removable drives. If the option is unavailable, it means that a system administrator has disallowed the use of recovery keys.
|
|
|
|
- question: |
|
|
Why am I unable to automatically unlock my drive?
|
|
answer: |
|
|
Automatic unlocking for fixed data drives requires the operating system drive to also be protected by BitLocker. If a computer is being used that doesn't have a BitLocker-protected operating system drive, then the fixed drive can't be automatically unlocked. For removable data drives, automatic unlocking can be added by right-clicking the drive in Windows Explorer and selecting **Manage BitLocker**. Password or smart card credentials that were supplied when BitLocker was turned on can still be used to unlock the removable drive on other computers.
|
|
|
|
- question: |
|
|
Can I use BitLocker in Safe Mode?
|
|
answer: |
|
|
Limited BitLocker functionality is available in Safe Mode. BitLocker-protected drives can be unlocked and decrypted by using the **BitLocker Drive Encryption** Control Panel item. Right-clicking to access BitLocker options from Windows Explorer isn't available in Safe Mode.
|
|
|
|
- question: |
|
|
How do I "lock" a data drive?
|
|
answer: |
|
|
Both fixed and removable data drives can be locked by using the Manage-bde command-line tool and the -lock command.
|
|
|
|
> [!NOTE]
|
|
> Ensure all data is saved to the drive before locking it. Once locked, the drive will become inaccessible.
|
|
|
|
The syntax of this command is:
|
|
|
|
```cmd
|
|
manage-bde.exe <driveletter> -lock
|
|
````
|
|
|
|
Outside of using this command, data drives will be locked on shutdown and restart of the operating system. A removable data drive will also be locked automatically when the drive is removed from the computer.
|
|
|
|
- question: |
|
|
Can I use BitLocker with the Volume Shadow Copy Service?
|
|
answer: |
|
|
Yes. However, shadow copies made prior to enabling BitLocker will be automatically deleted when BitLocker is enabled on software-encrypted drives. If a hardware encrypted drive is being used, the shadow copies are retained.
|
|
|
|
- question: |
|
|
Does BitLocker support virtual hard disks (VHDs)?
|
|
answer: |
|
|
BitLocker should work like any specific physical machine within its hardware limitations as long as the environment (physical or virtual) meets Windows Operating System requirements to run.
|
|
- With TPM: Yes, it's supported.
|
|
- Without TPM: Yes, it's supported (with password protector).
|
|
|
|
BitLocker is also supported on data volume VHDs, such as those used by clusters, if running Windows 10, Windows 8.1, Windows 8, Windows Server 2016, Windows Server 2012 R2, or Windows Server 2012.
|
|
|
|
- question: |
|
|
Can I use BitLocker with virtual machines (VMs)?
|
|
answer: |
|
|
Yes. Password protectors and virtual TPMs can be used with BitLocker to protect virtual machines. VMs can be domain joined, Azure AD-joined, or workplace-joined (via **Settings** > **Accounts** > **Access work or school** > **Connect**) to receive policy. Encryption can be enabled either while creating the VM or by using other existing management tools such as the BitLocker CSP, or even by using a startup script or sign-in script delivered by Group Policy. Windows Server 2016 also supports [Shielded VMs and guarded fabric](/windows-server/virtualization/guarded-fabric-shielded-vm/guarded-fabric-and-shielded-vms-top-node) to protect VMs from malicious administrators.
|