Encryption for Staff Laptops - Any Advice or help please

[Bhavesh78]

Hi Guys..

 

good afternoon... i need your advice or help..

 

I'm going to install Windows 10 Edu on all staff laptops soon, Laptops we have are Toshiba L850 & C50 and all are i5. These laptops are 3 or 4 yrs old and still great. When i install Windows 10 Edu on Staff laptops and do bitlocker TPM seems doesnt work as its not compatiblities on them laptops.

 

Can anyone tell what encryption software are better on Windows 10 for staff laptops, similar to trucrypt software.

 

Kind regards

 

bhav

[DJ-1701]

You can use Bitlocker still, you just have to enable the policy to have it work with a password instead of TPM.

 

See the following guide, in the section 'How to ensure you can turn on BitLocker without TPM'.

 

https://www.windowscentral.com/how-use-bitlocker-encryption-windows-10

[3s-gtech]

You can enable Bitlocker on machines without a TPM via Group Policy, for versions of Windows after 7. They have to type a password instead (you can still save the recovery key).

 

Policies

Administrative Templates

Windows Components/BitLocker Drive Encryption/Operating System Drives

Require additional authentication at startup -Enabled

Allow BitLocker without a compatible TPM (requires a password or a startup key on a USB flash drive)

[sted]

you can use bitlocker without a tpm you just need to alter the gpo settings to allow it

 

iirc this setting (there may be more in the same location its a bit of a trial and error job to get it working 1st time))

 

computer config\admin templates\windows components\bitlocker drive encryption\operating system drives\require additional authentication at startup

 

tick the box allow bitlocker without a compatible tpm and in teh dropdowns select allow . . .

 

theres a few other bitlocker setting id want as well mainly one level up store bitlocker recovery info in ad the rest is again a bit of personal preference / trial and error

[DJ-1701]

Is there an echo in here?

[Bhavesh78]

Hi Guys..

thanks for your reply, so that means i have to safe passwords on each USB Stick for each staff laptops when they start their Laptop on.

hmmmmm guess this will be mission task..

[DJ-1701]

Hi Guys..

thanks for your reply, so that means i have to safe passwords on each USB Stick for each staff laptops when they start their Laptop on.

hmmmmm guess this will be mission task..

 

Either you get them to type in a password, or you get them to plug in a USB. Personally I went with the password option for the non-TPM machines.

[sted]

Hi Guys..

thanks for your reply, so that means i have to safe passwords on each USB Stick for each staff laptops when they start their Laptop on.

hmmmmm guess this will be mission task..

 

id go with a pin/password personally as staff ill only leave the pendrive in the same bag as the laptop making it pointless to encrypt it.

 

You dont put passwords on the usb stick bitlocker basically copies a certificate there iirc and without that windows wont boot (short of the 40 digit recovery key). The pen drive it self isnt encrypted i dont think. You can force both pin and password but i suspect that will just generate helpdesk calls

[Bhavesh78]

Hi Guys..

 

thanks for your reply .. its helps..

I have managed to get the Bitlocker working on laptop.

What i did was insert blank USB stick into Laptop, then follow the instruction on bitlocker.. then enter password which i crested..

then it encrypted whole drive , which took while to do that..

then i took the usb stick out the laptop then restarted the laptop.

I get bitlocker splash screen appear, which i have to enter the password (which i created early ) after i entered the password, it went straight to boot windows 10.

 

So i copied and save the bitlocker password from USB stick to school network drive as a safe keeper.

 

is that right how i did??

 

- - - Updated - - -

 

Has anyone tried Sophos Encryption?? any good .. or is it better than bitlocker??

[DJ-1701]

Hi Guys..

 

thanks for your reply .. its helps..

I have managed to get the Bitlocker working on laptop.

What i did was insert blank USB stick into Laptop, then follow the instruction on bitlocker.. then enter password which i crested..

then it encrypted whole drive , which took while to do that..

then i took the usb stick out the laptop then restarted the laptop.

I get bitlocker splash screen appear, which i have to enter the password (which i created early ) after i entered the password, it went straight to boot windows 10.

 

So i copied and save the bitlocker password from USB stick to school network drive as a safe keeper.

 

is that right how i did??

 

Sounds like it.

 

Has anyone tried Sophos Encryption?? any good .. or is it better than bitlocker??

 

I have tried on Windows 7... never got it working right. As for Windows 10, if I remember correctly it just uses BitLocker anyway.

[sted]

i would seriously get windows to record the recovery key in active directory it can save so much hassle and is only a few extra settings and 2 mins work on a dc (or other server with ad tools)

[jmak]

 

Has anyone tried Sophos Encryption?? any good .. or is it better than bitlocker??

 

Yes (I've tried it)

 

No (it's not better than Bitlocker)

 

I have tried on Windows 7... never got it working right. As for Windows 10, if I remember correctly it just uses BitLocker anyway.

 

Is correct (presumably because of the answer above) added to the fact that Bitlocker is available on most editions of Windows now, whereas in 7 and earlier it was enterprise and ultimate editions only.

 

If you're using the enterprise console for AV it might be worth looking at using it to manage your Bitlocker keys, but makes no difference to the encryption of the clients.

 

I couldn't make the GPO automatically store the key in AD work, so I copy it there manually - seems like the first place anyone else trying to support our users would look if I wasn't around.

[minimoo]

I couldn't make the GPO automatically store the key in AD work, so I copy it there manually - seems like the first place anyone else trying to support our users would look if I wasn't around.

 

You need the policies in place to store the key in AD before you enable bitlocker - so might be GPO's not kicking in int ime.

[Arthur]

I'm going to install Windows 10 Edu on all staff laptops soon

What are you using to install Windows 10? MDT, SCCM or something else?

 

Are you booting in UEFI or Legacy (BIOS) mode?

[newpersn]

What are you using to install Windows 10? MDT, SCCM or something else?

 

Are you booting in UEFI or Legacy (BIOS) mode?

 

Kinda of following this.. We use MDT and BIOS mode (Havent got 2012+ DHCP server to add a rule about UEFI PXE boot)

Edited October 5, 2017 by newpersn
typo

[sted]

Kinda of following this.. We use MDT and BIOS mode (Havent got 2012+ DHCP server to add a rule about UEFI PXE boot)

ive never needed to do anything specific to get uefi boot working 2012r2 server and up to date waik/mdt and its worked for me (bar turning it on in the computers nbios as it seems to be uefi network boot is off by default on a lot

[Blue_Cookeh]

Might be worth investing in the MDOP suite from Microsoft. I believe if you're on an EES agreement with Desktop licensing it's already included. MODP MBAM will make your life managing BitLocker 10x easier.

[Fazza]

Check the BIOS settings of your computers as on some of our laptops we had to enable the latest version of TPM (2.0) rather than 1.2 which is what they were set at.

 

On the laptops that we dont have TPM chips on the users simply enter a password after they have POSTed and start to load the OS.

[sted]

fwiw heres my bitlocker settings and where it shows in ad (not going to show you an actual recovery key obviously but you can see where it goes

 

[Bhavesh78]

What are you using to install Windows 10? MDT, SCCM or something else?

 

Are you booting in UEFI or Legacy (BIOS) mode?

 

On the Bois setting it set as CSM booting and install Fresh Windows 10 Edu installation through USB Sticks. I then install all the software into it.

I use Fog server to backup the image and deploy them on each laptops.

I then will manually do bitlocker on each laptops.

[gshaw]

Might be worth investing in the MDOP suite from Microsoft. I believe if you're on an EES agreement with Desktop licensing it's already included. MODP MBAM will make your life managing BitLocker 10x easier.

 

Do you have it running? I started looking at it but the setup seemed a fair bit of work and from what I read online didn't sound entirely convincing?

[Blue_Cookeh]

Do you have it running? I started looking at it but the setup seemed a fair bit of work and from what I read online didn't sound entirely convincing?

 

Yeah, not that much work and it makes managing MBAM across many devices a lot easier since it gives you access to more group policy settings, and a ton of reporting. It integrates well with SCCM if you're using that too.

[gshaw]

Yeah, not that much work and it makes managing MBAM across many devices a lot easier since it gives you access to more group policy settings, and a ton of reporting. It integrates well with SCCM if you're using that too.

 

@Blue_Cookeh does it give true user-based policies for enabling encryption i.e. turning it on for staff and not students in a User GPO?

 

At the moment I'm using a GPP registry kludge to switch the BDD flags on \ off for user groups but it's not ideal and I'd prefer a "proper" policy that sits in User Configuration Administrative Templates.

 

Did you pay extra on EES for it?

Edited October 6, 2017 by gshaw

[gdrinkall]

Im just looking at the Sophos product now on trial, All sophos does is provide a management system for Bitlocker, cost wise on a 3 year deal its about £3 per device per year, not bank breaking but still deciding if its worth it. Next up is MBAM.

[Ertech]

Are you using the Sophos cloud encryption solution? I was wondering if it works with Windows 7 Pro?

 

 

 

Im just looking at the Sophos product now on trial, All sophos does is provide a management system for Bitlocker, cost wise on a 3 year deal its about £3 per device per year, not bank breaking but still deciding if its worth it. Next up is MBAM.