Bitlocker without TPM - Startup Key (USB) and Password possible??

[nickb23]

Hi Guys,

 

We want to start encrypting laptops using Bitlocker at one of our schools, but as they do not have TPM modules, we want to try and use Startup Keys (USBs) with a Password. This is so that the teacher can leave the usb in all the time (one of the tiny ones) so that it wont get lost or left at home / school, and have the encryption protection of having to put a password in. Googling it seems to show that Microsoft removed this option with Windows 7, but I was wondering if anyone had got it to work? It seems to be either this of VeraCrypt..

 

Thanks in advance...

 

 

Nick

[3s-gtech]

It's there in Windows 7 Enterprise, or with Windows 8.1 you can do it without the memory stick. Won't work in Pro. Veracrypt will work - they (apparently) fixed the boot waiting issue.

[nickb23]

thanks 3s. Do you know where in 7? Also read that veracrypt has dropped waiting times by half, which is nice.

[3s-gtech]

From MS's own guide (again, note this is only for Windows 7 Enterprise and Ultimate):

 

Open Bitlocker Drive Encryption by clicking the Start button Picture of the Start button, clicking Control Panel, clicking Security, and then clicking Bitlocker Drive Encryption.

 

Click Turn On BitLocker. This opens the BitLocker setup wizard. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

 

Follow the instructions in the wizard.

[nickb23]

Done that, but the only option it gives me is to create a startup key. Because I don't have a TPM, "Require a PIN at every startup" is greyed out.

 

I can create a startup key on a usb stick, but I want to use that in conjunction with putting in a PIN or Password.

 

All machines have Win7 64bit Enterprise.

[3s-gtech]

Apologies, I didn't give enough extra info. To do that you need to use manage-bde: https://technet.microsoft.com/en-us/library/jj647767(v=ws.11).aspx

[Fazza]

There's a local group policy you need to edit/enable so you can just enter a password shortly after you power on your computer rather than use a USB memory stick.

[3s-gtech]

That only works with 8.0 and newer.

[Fazza]

That only works with 8.0 and newer.

 

We did it on a load of Windows 7 laptops that didnt have a TPM chip in them a few years back. I've just found a link showing how to do it on a Windows 7 computer here:

 

How To Use BitLocker on Drives without TPM