Basic BitLocker GPO setup question

[TwistedHelixis]

I look after a very small primary school and would like to encrypt the staff laptop hard drives.

 

I would like to keep things as simple as possible, but have come across a setting in the gpo's that I do not really understand the implications of.

 

Should I enable the setting - provide the unique identifiers for your organization?

 

All the searches I have done on this gpo just churn back the info from the gpo help section.

 

What are the implications of leaving this off or enabling it?

 

Thanks for your time

[Arthur]

What are the implications of leaving this off or enabling it?

That setting is used in combination with another setting called Do not allow write access to devices configured in another organization in the Deny write access to removable drives not protected by BitLocker policy.

 

If you don't provide a unique identifier for your organization it means that Windows can't tell the difference between your encrypted removable drives and those from other schools or organizations.

 

Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Removable Data drives

 

 

http://blogs.catapultsystems.com/gtate/archive/2010/02/07/windows-7-restricting-and-securing-usb-storage-devices/

 

Tightening BitLocker Security for USB Storage Drives

IT can tighten the wrench a bit more to restrict write access to only devices that have been encrypted within the organization. This eliminates users from bringing in encrypted USB drives from outside of the company. To enforce this policy, there is a setting called “Allowed BitLocker identification field” found in the “Provide the unique identifiers for your organization” policy. Before you allow encryption of any devices in your company, you will need to define this field. This will mark the USB flash drive with an identification tag which states that the encryption took place from within the network. The last step you will take is to check the setting called “Do not allow write access to devices configured in another organization” in the group policy “Deny write access to removable drives not protected by BitLocker”. This setting enforces write access to only those drives which have been encrypted within the organization.

[TwistedHelixis]

Many thanks for fully explaining that to me. )

[TwistedHelixis]

2 minor issues left after testing on a very old laptop running windows 10 without TPM.

 

Is it possible to set a pre defined password? basically I am trying to make the Bitlocker users setup part as simple as possible and if I can push the password used from GPO all the better.

 

Can I remove the option to use a USB key for unlocking the laptops from the Bitlocker users setup menu? I just want passwords as an option for my users at the moment.

 

I don't think either is possible after looking through the GPO's but wanted to double check.

 

Thanks