Per User BitLocker USB Encryption

[eddyc]

Star! PM sent. Thank you

 

@eddyc PM me you email address and I'll send over the html report from group policy for my Bitlocker settings.

[Steve21]

I may be missing the obvious but how is that regkey GPO working? Surely you're setting the HKLM when staff log on, but then you're never unsetting it so it'll stay applied? Or are you doing another GPO that then removes it if a student logs in?

 

Steve

[mdrabble]

I have another GPO which unsets it when students logon.

 

When I get time, I'll will take a look at MBAM

[MYK-IT]

I have followed the instructions (https://blogs.technet.microsoft.com/askpfeplat/2013/06/09/how-to-enable-user-based-controlenforcement-of-bitlocker-on-removable-data-drives/) as mentioned by @FN-GM and @gshaw, to the letter, creating the 2 Security Groups so that the settings can be applied/removed based on membership etc.

 

I also ensured:

 

- RVDenyWriteAccess is under SYSTEM\CurrentControlSet\Policies\Microsoft\FVE

 

- Also created RDVDenyCrossOrg Registry keys, even though this was not mentioned in the Microsoft Technet article.

 

Now, I have it working, but just wanted to confirm if the following results is how it should be?

 

If not a member of BITLOCKER_PROMPT or BITLOCKER_RESTRICT Group - Access is as per normal (Happy with this!)

If member of BITLOCKER_RESTRICT an unencrypted removable drive is Read-Only (Again, happy with this)

If member if BITLOCKER_PROMPT only, nothing happens (is this correct? no prompt)

However, if member of BITLOCKER_RESTRICT and BITLOCKER_PROMPT you do get a prompt (to encrypt, or carry on read-only) if unencrypted

 

Thanks.

[fiza]

I just revisiting this as I need to implement it for our Primary School as they are getting MicroBits.

I am trying to set the GPO but cannot find HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE

 

This is on Server 2008 R2. Am I missing something?

[gshaw]

I have followed the instructions (https://blogs.technet.microsoft.com/askpfeplat/2013/06/09/how-to-enable-user-based-controlenforcement-of-bitlocker-on-removable-data-drives/) as mentioned by @FN-GM and @gshaw, to the letter, creating the 2 Security Groups so that the settings can be applied/removed based on membership etc.

 

I also ensured:

 

- RVDenyWriteAccess is under SYSTEM\CurrentControlSet\Policies\Microsoft\FVE

 

- Also created RDVDenyCrossOrg Registry keys, even though this was not mentioned in the Microsoft Technet article.

 

Now, I have it working, but just wanted to confirm if the following results is how it should be?

 

If not a member of BITLOCKER_PROMPT or BITLOCKER_RESTRICT Group - Access is as per normal (Happy with this!)

If member of BITLOCKER_RESTRICT an unencrypted removable drive is Read-Only (Again, happy with this)

If member if BITLOCKER_PROMPT only, nothing happens (is this correct? no prompt)

However, if member of BITLOCKER_RESTRICT and BITLOCKER_PROMPT you do get a prompt (to encrypt, or carry on read-only) if unencrypted

 

Thanks.

 

I did tweak my GPP a bit and just had just the one group, BitLocker-Enforce which sets all the keys.

 

The GPP is then as simple as one set of keys turning it on and another set turning it off, with the condition of whether the user is in BitLocker-Enforce or not.

 

I just revisiting this as I need to implement it for our Primary School as they are getting MicroBits.

I am trying to set the GPO but cannot find HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE

 

This is on Server 2008 R2. Am I missing something?

 

@fiza do you mean if you browse the registry from the UI when editing the GPP on the server? Quite possibly as I'm not sure if BitLocker client keys would be on Windows Server. Either do it remotely via RSAT tools or just copy \ paste the path from the quotes on page 2

Edited October 29, 2018 by gshaw

[fiza]

I did tweak my GPP a bit and just had just the one group, BitLocker-Enforce which sets all the keys.

 

The GPP is then as simple as one set of keys turning it on and another set turning it off, with the condition of whether the user is in BitLocker-Enforce or not.

 

 

 

@fiza do you mean if you browse the registry from the UI when editing the GPP on the server? Quite possibly as I'm not sure if BitLocker client keys would be on Windows Server. Either do it remotely via RSAT tools or just copy \ paste the path from the quotes on page 2

Yes I mean on the server. I will try it using RSAT.

[tri_94]

Hi "Gshaw" any chance I can grab a copy of the settings your using please.

 

Thanks

[gshaw]

Hi "Gshaw" any chance I can grab a copy of the settings your using please.

 

Thanks

 

@tri_94 which bit in particular?

 

On Computer Settings I configure these...

 

• BitLocker encryption to AES 256-bit
  
• only our organisation ID allowed (bit controversial but ensures we can recover any encrypted sticks)
  
• Store recovery passwords and key packages in AD
  
• configure DRA certificate and assign to policy
  

 

On the User side it's all GPP registry settings using the keys I posted on the previous page.

 

• RDVConfigureBDE
  
• RDVAllowBDE
  
• RDVDenyCrossOrg
  
• RDVDenyWriteAccess
  

The way I do it differently is just one group called BitLocker-Enforce and inside that I put any groups I want to have it enabled for e.g. Staff.

 

The GPP sets those keys either to 1 if a member of the BitLocker-Enforce group or 0 if not. That way BitLocker is configured at each login to make sure it's correct for the current user.

[tri_94]

Thank you

[sonofsanta]

So I've been working through this, because just setting removable media to read-only has brought me naught but complaints, even though HAP+ and OneDrive are both there and both much better (they have actual back ups! IMAGINE)

 

I've so very almost got it working, with a couple of holes I've not seen mentioned above patched (or almost); thanks especially to @gshaw for all your posts.

 

SO RIGHT NOW I have a load of settings just set in the GPO, because it's easier and more self-documenting than registry settings:

 

• Default folder for recovery password
  
• Encryption method & cipher strength
  
• Unique ID for org
  
• Store recovery info in AD (require, passwords & key packages
  
• Removable Data Drives\Disable Smart Cards
  
• Removable Data Drives\Enforce Encryption Type to Used Space Only
  
• Removable Data Drives\Configure use of passwords (to set requirements)
  
• Removable Data Drives\How RDD can be recovered (save to AD, do not encrypt until saved to AD)
  

 

Then all of that can, essentially, be turned on with the single regkey HKLM\System\CurrentControlSet\Policies\Microsoft\FVE\RDVDenyWriteAccess. That's being set to 1 with GPP if a user is a member of a group, and turned to 0 if they're not, as others have described above.

 

That works really well! But there were two holes:

 

1) if a user connected a removable drive in before logging on, it opened normally, without requiring encryption, because it was plugged in before BitLocker was required. I'm now running a start up script to import the above regkey set to 1 to make sure it is enabled when a computer is first booted; I'm explicitly doing it as a startup script because if I set it as a computer GPP, then it'd end up being set for everyone at policy refresh (and so many problems would be solved if policy refresh went Computer -> User the same as logon, not the other way round)

 

2) if a user locks the workstation, and someone not in the group logs on, that resets the regkey to 0, disabling BitLocker. When the staff member comes back and unlocks, the logon policy doesn't run, the regkey isn't reset to 1, the user can now write to unencrypted media.

 

That last one is where I'm almost at a solution. I've pushed out a scheduled task that runs a script to reset the reg key to 1 on workstation unlock, and that does fix the hole, but it applies to everyone, and will slowly get on my nerves (I don't want the restriction for IT staff, and we're forever locking/unlocking). When I'm setting up the task on the server it offers me the ability to set a security group i.e. only when users belonging to DL - Require Bitlocker unlock a workstation, but for whatever reason my 1803 Win10 machine doesn't offer that option when setting up a Scheduled Task, and if I try and use that option it fails with a complaint that the XML is invalid. It's exactly what I need and I can't have it. I'm not setting up 130 individual tasks for specific staff users!

 

I can't apply the scheduled task as a user GPP filtered by group, because then it just overwrites in the same way as the reg key i.e. an unprotected user logs on, that disables the scheduled task, they log off and the protected user unlocks, the script doesn't run because the scheduled task wasn't re-enabled by logon. I've tried triggering a gpupdate /force on unlock, but that doesn't seem to set the registry--it obviously only does that at logon, not refresh (I've confirmed this by watching event viewer--the refresh does happen, it's not a problem with the scheduled task).

 

Any ideas on how to fix the latter hole? Is there a way of workstation-based PowerShell/command scripts checking the membership and only updating the reg key if true, perhaps?

[sonofsanta]

Sorted!

 

Right. Further to the above, then:

 

* Running a startup script to grant permissions to the reg key (SetACL.exe is sat in the Startup scripts folder for the GPO alongside this batch file):

SetACL.exe -on "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Policies\Microsoft\FVE" -ot reg -actn ace -ace "n:Authenticated Users;p:full"

 

That's not necessary for the GPP, because those run in the system context, but are necessary for the scheduled tasks that run on lock/unlock.

 

There are two scheduled tasks set up. One of them just runs a simple batch file to enable the reg key when a workstation is locked; otherwise a user could connect their device just after an unprotected user has locked the machine, then log on, and have write access to an unencrypted device. This scheduled task ensures that any locked device has BitLocker enabled.

 

.reg file:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE]
"RDVDenyWriteAccess"=dword:00000001

.bat file:

regedit.exe /s enableBitlockerRequirement.reg

Both those files are in a folder with all the other scripts that computers/users need to run. Scheduled task set up (make sure you untick the box to only run on AC power!):

 

The same script & regkey is also set as a logoff script through GPO, for the same reason as it's being set on Lock (i.e. devices connected before login)

 

The harder problem was the other scheduled task, for Unlock. Having made sure that the computer always has BitLocker enabled if it's currently on a login screen, I need to make sure the group membership is re-evaluated on Unlock. I need to do that without having the ActiveDirectory module imported in PowerShell, otherwise I have to install RSAT everywhere. And so, my inelegant and kludged together PowerShell script!

# $group below should be set to the Group Name as shown in AD, without domain prefix, e.g.
$group = "BitLocker Required for Removable Drives"
# have to get username below through this method, not $env:username, because latter returns COMPUTER$ (which is the account running the scheduled task). Interrogating Win32_ComputerSystem returns logged on user.
# username is returned in format DOMAIN\username though, and domain needs stripping out--hence Substring(5) used later. Adjust the 5 to match the length of your domain name + 1 (to account for the \ ) e.g. to remove DOMAIN\ use .Substring(7)
$user = Get-CimInstance –ClassName Win32_ComputerSystem | Select-Object -expand UserName
$RegistryPath = "HKLM:\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE"
$Name = "RDVDenyWriteAccess"
$on = "1"
$off = "0"
# group membership code below taken from https://social.technet.microsoft.com/Forums/scriptcenter/en-US/1aac9c7f-a6e6-4f25-93bc-e39c2ee50535/powershell-login-script-to-map-a-drive-if-a-user-is-a-member-of-a-ad-group?forum=ITCG
# does NOT require RSAT and ActiveDirectory module, so works on normal Win10 workstation
$memberOf = ([ADSISEARCHER]"samaccountname=$($user.Substring(5))").Findone().Properties.memberof -replace '^CN=([^,]+).+$','$1'

if($memberOf -contains $group)
{
 New-ItemProperty -Path $RegistryPath -Name $Name -Value $on -PropertyType DWORD -Force | Out-Null
} else {
 New-ItemProperty -Path $RegistryPath -Name $Name -Value $off -PropertyType DWORD -Force | Out-Null  
}

 

The Scheduled Task is pretty much the same; the trigger is on Unlock instead (obvs) and the program started is PowerShell, not just a batch file:

 

With all that done, in this post and the one above, BitLocker is now enabled:

• at startup
  
• at logoff
  
• when locked
  
• whenever a user in the relevant group logs on or unlocks a machine
  

 

The only remaining loophole--and it's impossible to close--is if a user who is not protected is logged on, a removable drive is connected, that user locks/logs off and a protected user logs on... then they can still write to the unencrypted removable media. But you can't protect against that unless you just enable BitLocker for everyone (in which case none of this faffing about is necessary and you can just set it all in the Computer GPO); I've spoken with the Head and the DPO here and they're happy to accept this edge case, as it's so unlikely (and involves all sorts of behaviour that is otherwise terrible anyway).

 

Now I just have to write up the guide and explain it to everyone. Wish me luck with that part...

[gshaw]

@sonofsanta do you have Fast User Switching enabled? We don't so if a user is logged in they're the only person who has access to the machine so we haven't come across that problem.

 

Nice work finding all the possible pitfalls and solutions, might nab that startup idea

[sonofsanta]

@sonofsanta do you have Fast User Switching enabled? We don't so if a user is logged in they're the only person who has access to the machine so we haven't come across that problem.

 

Nice work finding all the possible pitfalls and solutions, might nab that startup idea

 

We do, yeah--we enabled auto-locking after 15 minutes, so it seemed only sensible to enable fast user switching alongside it, after years of putting it off!

[Marcs_Dad]

Just came across this thread, but we have been running a system across the board for all users since September 2017. Our system relies on Sophos Enterprise Console (Device Control) and a GPO to manage the Bitlocker side of things. Here's a quick rundown of how it works.

 

1. All members of staff are issued with their own 8GB memory stick that is BitLocker encrypted and issued to them via an Asset Management System (so we can track down any lost devices). It is a bit of a task to encrypt them all (130 odd) in advance, but it was a one off. When we encrypted them, we saved each of the encryption keys so we can bail them out.

2. A Sophos device control policy was created and distributed via the whole client computer estate. Only the devices mentioned in step 1 were enabled. If a user tries to plug in any other removable storage device, it gets blocked by the Sophos policy, and logged (by user and computer).

3. User owned potable storage devices can be enabled, but have to be allowed via the IT Technicians Office. User owned devices are only enabled read only.

4. If a user owned and enabled portable storage device is detected, BitLocker will kick in and ask the user if they wan to encrypt the device. If they encrypt the device, it becomes writable.

5. Visitors to the school need to run their portable devices via the IT Technicians Office.

6. Students can also bring in their portable storage devices for authorisation, but most just use our remote access provision. The students are really caught in the cross fire as it was the staff I wanted to control, but it had to be across all users.

 

Summary. The system has worked well so far, and our GDPR Policy makes it very clear that anybody playing fast and loose with PII data is making a serious career decision.

If a school issued device is lost or stolen, then we simply remove it from the device control policy.

[sonofsanta]

Amendment/clarification to the above: running the batch file to enable BitLocker as a logoff script meant logoff took ten minutes, God alone knows why, recreated it as a Scheduled Task by copying the ...OnLock scheduled task and setting it to fire on event System: Microsoft-Windows-Winlogon: 7002. That works, and works without slowing everything down. IDK, and I'm fed up of trying to work out why when it comes to Win10 ¯\_(ツ)_/¯

[fiza]

@gshaw - I have followed everything above and I did same as you, but set 2 groups (GrpRestrict & GrpUnrestrict). If you are a member of GrpRestrict then the registry settings are set to 1. If member of GrpUnrestrict then everything set to 0.

 

Under Computer Configuration>Admin Templates>Windows Components>Bitlocker Drive Encryption I have ;

 

Store Bitlocker Recovery Information in AD > Enabled

 

Nothing else set at that level

 

Inside Removable Data Drives do I need to set ;

 

Deny Write access to drives not protected by Bitlocker to enabled ? Or do I leave it and let the Registry settings control that?

 

If I enable it then Bitlocker is applied to all users regardless of group.

If I Leave it un-configured then Bitlocker is not enforcred on anyone.

 

My registry settings look exactly like yours, I have one to set it to 1 and then a corresponding one to set it to 0 depending in which group the user is in.

 

I just cant seem to get it to work the way it should.

[sonofsanta]

@gshaw - I have followed everything above and I did same as you, but set 2 groups (GrpRestrict & GrpUnrestrict). If you are a member of GrpRestrict then the registry settings are set to 1. If member of GrpUnrestrict then everything set to 0.

 

Under Computer Configuration>Admin Templates>Windows Components>Bitlocker Drive Encryption I have ;

 

Store Bitlocker Recovery Information in AD > Enabled

 

Nothing else set at that level

 

Inside Removable Data Drives do I need to set ;

 

Deny Write access to drives not protected by Bitlocker to enabled ? Or do I leave it and let the Registry settings control that?

 

If I enable it then Bitlocker is applied to all users regardless of group.

If I Leave it un-configured then Bitlocker is not enforcred on anyone.

 

My registry settings look exactly like yours, I have one to set it to 1 and then a corresponding one to set it to 0 depending in which group the user is in.

 

I just cant seem to get it to work the way it should.

 

Don't set the GPO on Removable Data Drives--that's what the RDVDenyWriteAccess key is (the GPO literally sets that key). It sounds like the reg key isn't working. Are you definitely setting that last key under CurrentControlSet, in a different place to the others? The full path is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE and the keyname is RDVDenyWriteAccess.

 

There's no need for two groups, btw--Item Level Targeting can do "is not a member of group" as well, so with one group you set it if someone is a member, unset it if they're not.

[fiza]

Don't set the GPO on Removable Data Drives--that's what the RDVDenyWriteAccess key is (the GPO literally sets that key). It sounds like the reg key isn't working. Are you definitely setting that last key under CurrentControlSet, in a different place to the others? The full path is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE and the keyname is RDVDenyWriteAccess.

 

There's no need for two groups, btw--Item Level Targeting can do "is not a member of group" as well, so with one group you set it if someone is a member, unset it if they're not.

 

Definitely set the last key under the right path which is different to the others. The reason I set 2 groups was because it wasn't working for me with the "is not a member of" setting.

 

I even tried setting Loop back processing on the Computer Group Policy but that didnt help either.

[gshaw]

@gshaw - I have followed everything above and I did same as you, but set 2 groups (GrpRestrict & GrpUnrestrict). If you are a member of GrpRestrict then the registry settings are set to 1. If member of GrpUnrestrict then everything set to 0.

 

Under Computer Configuration>Admin Templates>Windows Components>Bitlocker Drive Encryption I have ;

 

Store Bitlocker Recovery Information in AD > Enabled

 

Nothing else set at that level

 

Inside Removable Data Drives do I need to set ;

 

Deny Write access to drives not protected by Bitlocker to enabled ? Or do I leave it and let the Registry settings control that?

 

If I enable it then Bitlocker is applied to all users regardless of group.

If I Leave it un-configured then Bitlocker is not enforcred on anyone.

 

My registry settings look exactly like yours, I have one to set it to 1 and then a corresponding one to set it to 0 depending in which group the user is in.

 

I just cant seem to get it to work the way it should.

 

@fiza yup as per above post leave the GPO settings and let the registry keys make the changes. The only things you need to configure on the Removable Storage is the encryption strength and backup of Recovery information

 

Allow data recovery agent Enabled

Configure user storage of BitLocker recovery information:

Allow 48-digit recovery password

Allow 256-bit recovery key

Omit recovery options from the BitLocker setup wizard Enabled

Save BitLocker recovery information to AD DS for removable data drives Enabled

Configure storage of BitLocker recovery information to AD DS: Backup recovery passwords and key packages

Do not enable BitLocker until recovery information is stored to AD DS for removable data drives Enabled

 

Require password for removable data drive Enabled

Configure password complexity for removable data drives: Allow password complexity

Minimum password length for removable data drive: 8

Note: You must enable the "Password must meet complexity requirements" policy setting for the password complexity setting to take effect.

 

Have you checked with gpresult and gpresult /h that the settings are applying (and also the registry keys?)