Locked out of Bitlocker Laptop

[Geoff]

I have a users laptop with Win7 Enterprise that uses Bitlocker drive encryption. It is not on the domain and only has local accounts on it. In her wisdom she has locked herself out of her local account and the admin account too. Normally we'd just use the NTPasswd Reset CD and get back in but Bitlocker prevents this. On the older Truecrypt protected Laptop it was possible to boot with Hirens Boot CD and decrypt the local drive and then run the NTPasswd Reset. However this is not possible with Bitlocker as Hirens is based on XP.

 

Does anyone know of a boot CD that would work in this situation?

[box_l]

Have you tried Kon-boot? KON-BOOT - Your best remedy for forgotten passwords (Windows / Mac OSX)

 

BoX

[Geoff]

I figured it out. I made a WinPE CD with 'manage-bde' installed on it. I downloaded the Windows AIK for Win 7 and installed it. Then used these commands in the Deployment Tools Command Prompt to make a bootable ISO:

 

copype.cmd x86 c:\winpe_x86
dism /mount-wim /wimfile:c:\winpe_x86\winpe.wim /index:1 /mountdir:c:\winpe_x86\mount
dism /image:c:\winpe_x86\mount /add-package /packagepath:"c:\Program Files\Windows AIK\Tools\PETools\x86\WinPE_FPs\WinPE-WMI.cab"
dism /unmount-Wim /mountdir:c:\winpe_x86\mount /commit
copy c:\winpe_x86\winpe.wim c:\winpe_x86\ISO\sources\boot.wim
oscdimg -n -bc:\winpe_x86\etfsboot.com c:\winpe_x86\ISO c:\winpe_x86\winpe_x86.iso

 

Then I burned the ISO and booted the laptop up. I then ran these commands to decrypt the drive:

 

manage-bde -unlock c: -recoverypassword 
manage-bde -off c:

 

The decryption process took a while, you can monitor it's status with:

 

manage-bde -status c:

 

One the drive had fully decrypted and Bitlocker had been removed I rebooted and used my normal tools to reset the local admin password.

Edited May 26, 2015 by Geoff

[cooka]

Cool solution - however, you could have suspended bitlocker using "manage-bde -protectors -disable c:" and "manage-bde -protectors -enable c:" to re-enable the drive after you run the CD / reset the password. It would have only saved you time though

 

EDIT: For anyone that is interested / didn't know, basically that suspends bitlocker protection instead of decrypting the whole drive.

 

Also, on the topic of Bitlocker - I have a script that allows you to back up the .BEK and recovery key to a share / drive. PM me if anyone wants it, or I can paste the code. This can be run on a laptop / PC that is already bitlockerd. Handy if you need to back up recovery keys and don't have AD integration (or if you just want a back up of a back up)

Edited May 26, 2015 by cooka

[FN-GM]

Hang on a second, I thought the idea of Bitlocker was to protect the data so anyone unauthorized cannot get to the data. You have just broken in. Surely that defeats the object of Bit Locker?

 

How would one prevent this?

[Arthur]

How would one prevent this?

Disable booting from USB/DVD media and PXE?

[FN-GM]

Thats easily turned back on by resetting the BIOS password and tweaking the boot settings. Edited May 26, 2015 by FN-GM

[Geoff]

I still needed the recovery key to decrypt the volume (Note that you can't do anything with a USB key/or pin). So aslong as you don't loose those then your data is secure.

[FN-GM]

I still needed the recovery key to decrypt the volume (Note that you can't do anything with a USB key/or pin). So aslong as you don't loose those then your data is secure.

 

Ah right i see! Did she have this printed or something? So basically if it was stolen the data would have been fine?

 

Thanks

[Geoff]

Well ideally you need to turn on the GPO setting so that laptops store their recovery key in Active Directory. For a non-domain laptop like this that would not help. So We have a folder in our IT network share full of keys, bex files and tpm backups for each laptop.

[cooka]

Group policy will back up the recovery key, and the TPM key information too. The script I mentioned above, backs up the recovery key + bek key and I have set it to run on computer start up in GP. This script only runs once on each machine

[Geoff]

To backup the tpm on Win7 into AD you need to fiddle with your AD forest root permissions. There's more info in this Technet blog.

 

https://technet.microsoft.com/en-us/library/dd875529%28v=ws.10%29.aspx

Edited May 27, 2015 by Geoff

[BH_1]

Hello Cooka; I have a user laptop with Bitlocker drive encryption. It runs Windows 7. Ever since a foolish configuration change to ‘correct’ a DNS error in user account, and following a subsequent reboot, I have been locked out. Specifically, I created a kms.txt file in the user home directory, and set the value for hostname in kms.txt file to IP address of the local PC while also disabling the IPv6 in the tcp stack for the wireless NIC only, thinking there was no need for it. But, after the reboot and entering the same valid user credentials, it displays this error message: "There are currently no logon servers available to service the logon request". I have attempted to log on via the wired NIC (while keeping the wireless signal off) in the hope of undoing the wrong configuration changes but I have continued to encounter the same error message. I have also extensively scoured online resources for a solution but none has worked. I would like to reset the local admin password to alternatively log on and possibly undo the config changes above but password reset has not been possible due to Bitlocker/EFS setup. I don’t want to reset the non-admin user credentials as I know 1) they are correct/valid, and 2) would not want to jeopardise permanent loss of access to user data due to EFS encryption. To no avail, I also attempted to mount encrypted NTFS/exFAT partition on Kali Linux Live to reset the local admin password via the Windows sticky keys but the partition would not mount.

 

Can you please recommend a simple and workable resolution? Thanks

[cooka]

Sorry for delay, I have only just seen your post.

 

Can you not remember any login credentials for any users that have previously logged into the machine? If you can you should be to still access the cached account and be able to decrypt the drive.

 

If you cant, and are still unable to access the machine, would use a winpe usb, boot to the stick and use the manage-bde -off C: (or which ever drive you have encrypted). You might need a recovery key for this step.

 

Ref: https://technet.microsoft.com/en-us/library/ff829849.aspx

Edited January 13, 2016 by cooka

[BH_1]

No problem Cooka. Thanks for getting back to me.

 

I do have the correct username and password for my user account, and the desktop encryption login interface does accept those credentials, following which it launches Windows 7. BUT, Windows 7 presents me with yet another login screen. At this point, I provide the same username and password for my user account to Windows 7 but they are not being accepted, and Windows displays the following error message: "There are currently no logon servers available to service the logon request."

 

I must add that in the past I was always able to access my files and applications after submitting the same username and password data only to desktop encryption login interface without any additional requirements by Windows 7 to re-enter my user login credentials. This lock-out situation happened only after the inadvertent configuration changes (i.e., adding the kms.txt file and disabling of IPv6 from wireless NIC) that I made to my user account. Windows 7 always prompts me to enter my user name and password data which are not being accepted, and I have been locked out of my account.

 

I don’t have a local admin password to log into local computer. It is not possible to use password recovery software to reset the local admin password. Also, Windows partition cannot be mounted (likely due to the encrypted disk) onto Linux to reset the local admin password or generate a new one. Appreciate your help with resolving this issue.

[Blue_Cookeh]

No problem Cooka. Thanks for getting back to me.

 

I do have the correct username and password for my user account, and the desktop encryption login interface does accept those credentials, following which it launches Windows 7. BUT, Windows 7 presents me with yet another login screen. At this point, I provide the same username and password for my user account to Windows 7 but they are not being accepted, and Windows displays the following error message: "There are currently no logon servers available to service the logon request."

 

I must add that in the past I was always able to access my files and applications after submitting the same username and password data only to desktop encryption login interface without any additional requirements by Windows 7 to re-enter my user login credentials. This lock-out situation happened only after the inadvertent configuration changes (i.e., adding the kms.txt file and disabling of IPv6 from wireless NIC) that I made to my user account. Windows 7 always prompts me to enter my user name and password data which are not being accepted, and I have been locked out of my account.

 

I don’t have a local admin password to log into local computer. It is not possible to use password recovery software to reset the local admin password. Also, Windows partition cannot be mounted (likely due to the encrypted disk) onto Linux to reset the local admin password or generate a new one. Appreciate your help with resolving this issue.

 

You should use the WinPE boot disk instructions posted a few posts up and mount the BitLocker-suspended drive. You can then use the trick to rename cmd.exe to the sticky keys executable, reboot into Windows, and then hit shift five times to bring up a SYSTEM command prompt and reset the Admin password.

 

Make sure you put the sticky keys and cmd executables back once finished.

[cooka]

Okay - are you able to provide any pictures of the login prompts you are getting so I can see whats going on?

 

You could use a linux based password recovery tool but first you would need to decrypt the drive. Do you have any recovery information? Recovery key? tpm file? is it even encrypted with bitlocker? to decrypt the drive you would need to boot into winpe or simular, mount the drive using mange-bde commands from the documents i posted last time, decrypt the drive, and then run your linux password recovery tool.

[cooka]

You should use the WinPE boot disk instructions posted a few posts up and mount the BitLocker-suspended drive. You can then use the trick to rename cmd.exe to the sticky keys executable, reboot into Windows, and then hit shift five times to bring up a SYSTEM command prompt and reset the Admin password.

 

Make sure you put the sticky keys and cmd executables back once finished.

 

Yes! Try this!

[BH_1]

Okay - are you able to provide any pictures of the login prompts you are getting so I can see whats going on?

 

You could use a linux based password recovery tool but first you would need to decrypt the drive. Do you have any recovery information? Recovery key? tpm file? is it even encrypted with bitlocker? to decrypt the drive you would need to boot into winpe or simular, mount the drive using mange-bde commands from the documents i posted last time, decrypt the drive, and then run your linux password recovery tool.

 

I had misinformed you earlier, my apologies. The laptop uses PGP Whole Disk Encryption. I have always used only my username & passphrase to authenticate. Have none of the other info above that you have listed. Prior to misconfiguration issue described in earlier posts, I was able to access the Windows 7 files and applications simply by entering the username and passphrase information only at the start, when laptop was rebooted, or to unlock it. Please let me know if I can provide any other information. Thanks again.

[BH_1]

Is there any suggestion for resolution? Again, no issue to authenticate to encryption layer (PGP encryption) but cannot authenticate to Windows 7, receiving this error message: "There are currently no logon servers available to service the logon request." Need to undo the inadvertent configuration changes (kms.txt file and IPv6 disablement) to once again restore access to Windows file system. Have not been able to mount Windows file system to Linux even though authentication to encryption layer is possible.