2. How to Enable the Use of BitLocker on Computers without
TPM
If TPM hardware is not available, BitLocker can store
decryption keys on a USB flash drive instead of using a built-in TPM
module. Using BitLocker in this configuration can be risky, however,
because if the user loses the USB flash drive, the encrypted volume
is no longer accessible and the computer cannot start without the
recovery key. Windows 7 does not make this option available by
default.
To use BitLocker encryption on a computer without a
compatible TPM, you need to change a computer Group Policy setting
by performing these steps:
-
Open the Group Policy Object Editor by clicking Start,
typing gpedit.msc, and pressing
Enter. Respond to the UAC prompt that appears.
-
Navigate to Computer Configuration\Administrative
Templates\Windows Components\BitLocker Drive
Encryption\Operating System Drives.
-
Enable the Require Additional Authentication At Startup
setting. Then select the Allow BitLocker Without A Compatible
TPM check box. Click OK.
If you plan to deploy BitLocker in an enterprise using USB
flash drives instead of TPM, you should deploy this setting with
domain-based Group Policy settings.
3. How to Enable BitLocker Encryption
Individual users can enable BitLocker from Control Panel, but
most enterprises should use AD DS to manage keys.
Note
MORE INFO CONFIGURING AD DS TO BACK UP
BitLocker
For detailed instructions on how to
configure AD DS to back up BitLocker and TPM recovery information,
read "Configuring Active Directory to Back up Windows BitLocker
Drive Encryption and Trusted Platform Module Recovery Information"
at http://go.microsoft.com/fwlink/?LinkId=78953.
To enable BitLocker from Control Panel, perform these
steps:
-
Perform a full backup of the computer, and then run a
check of the integrity of the BitLocker partition using
ChkDsk.
-
Open Control Panel. Click the System And Security link.
Under BitLocker Drive Encryption, click the Protect Your
Computer By Encrypting Data On Your Disk link.
-
On the BitLocker Drive Encryption page, click Turn On
BitLocker.
-
On the BitLocker Drive Encryption Setup page, click
Next.
-
If the Preparing Your Drive For BitLocker page appears,
click Next. If you are required to restart your computer, do
so.
-
If the Turn On The TPM Security Hardware page appears,
click Next, and then click Restart.
-
If the volume is the system volume and the choice has not
been blocked by a Group Policy setting, in the Set BitLocker
Startup Preferences dialog box (shown in Figure 2), select your
authentication choice. The choices vary depending on whether the
computer has a built-in TPM chip.
The choices include the following:
-
Use BitLocker Without Additional
Keys Uses the TPM to verify the integrity of the
operating system at every startup. This option does not
prompt the user during startup, providing completely
transparent protection.
-
Require PIN At Every
Startup Uses the TPM to verify the integrity of the
operating system at startup and requires the user to type a
PIN to verify the user's identity. This option provides
additional protection but can inconvenience the user. If you
choose to use a PIN, the Enter A Startup Pin page appears.
Type your PIN and then click Set PIN.
-
Require Startup USB Key At Every
Startup Does not require TPM hardware. This option
requires the user to insert a USB key containing the
decryption key at startup. Alternatively, users can type a
recovery key to gain access to the encrypted system
partition. If you choose to use a USB key, the Save Your
Startup Key page appears. Select the startup key and then
click Save.
Note
REQUIRING BOTH A STARTUP USB
KEY AND A PIN
The BitLocker wizard allows
you to choose either a PIN or a startup USB key. If you
want to use both, use the Manage-bde command-line tool.
For example, to protect the C:\ drive with both using a
startup key located on the E:\ drive, you would run the
command manage-bde
–protectors –add C: -TPMAndPINAndStartupKey –tsk
E:.
-
On the Save The Recovery Password page, choose the
destination (a USB drive, a local or remote folder, or a
printer) to save your recovery password. The recovery password
is a small text file containing brief instructions, a drive
label and password ID, and the 48-digit recovery password. Save
the password and the recovery key on separate devices and store them in
different locations. Click Next.
-
On the Encrypt The Volume page, select the Run BitLocker
System Check check box and click Continue if you are ready to
begin encryption. Click Restart Now. Upon rebooting, BitLocker
ensures that the computer is fully compatible and ready to be
encrypted.
-
BitLocker displays a special screen confirming that the
key material was loaded. Now that this has been confirmed,
BitLocker begins encrypting the C:\ drive after Windows 7
starts, and BitLocker is enabled.
BitLocker encrypts the drive in the background so that you can
continue using the computer.
