W10 Bitlocker Hard Disk From One Laptop to Another - Change TPM Password?

[Fazza]

I've got to laptops that are exactly the same (Lenovo T410). One has a broken NIC so I've taken the SSD out of it and put it in the spare working one.

 

The hard disk is encrypted with BitLocker.

 

When I power on the laptop and it asks me for a password, I've gotten the BitLocker password from AD after entering it Windows loads and I can log on OK.

 

 

What do I need to do with BitLocker so I can use this hard drive in this laptop on a permanent basis. i.e. Do I have to un-encrypt the hard disk and then re-encrypt it to update the TPM chip etc. or is there a command I can run to update the TPM chip or hard disk?

 

Hope that makes sense!

[jthompson]

This is what I do, but this is for Win7, but I don't know if it's different for Win10.

 

Boot into Windows (giving the recovery key on boot) and run the following two commands in a prompt

manage-bde -protectors -delete C: -type TPM
manage-bde -protectors –add C: -tpm

 

This removes the record of the old TPM and adds the current one in its place.

 

If you run

manage-bde -status

you should then see listed a TPM chip as one of the protectors, along with a numerical password, which is the recovery key.

Edited November 23, 2017 by jthompson

[ITJS2015]

You could try this on your laptop https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bitlocker-pin-on-windows/ Half way down the page it mentions to change the pin.

 

Not to sure what it will do when your on AD but i presume that it will update it to a database but the key represents the unique drive itself not the laptop

 

You can move drives to different machines and unlock it with your bitlock password and also use it in a CADDY.

 

It would make sense to in-encrypt the drive and re do it to see if you get a different code for the laptop but i am sure the code represents the HDD itself. As long you have an register of who laptop it is assigned to you shouldn't have a problem.

 

I have print outs but also have it AD but i write on the paper who it goes to and if they leave i image my machine and create a new bitlocker code

[ITJS2015]

I am sure that windows 7 enterprise only has bitlocker, you make have problems encrypting professional as its not on there

[Fazza]

This is what I do, but this is for Win7, but I don't know if it's different for Win10.

 

Boot into Windows (giving the recovery key on boot) and run the following two commands in a prompt

manage-bde -protectors -delete C: -type TPM
manage-bde -protectors –add C: -tpm

 

This removes the record of the old TPM and adds the current one in its place.

 

Thanks! That worked a treat!

 

 

I am sure that windows 7 enterprise only has bitlocker, you make have problems encrypting professional as its not on there

 

This thread is in the Windows 10 Forum so I'm not using Windows 7.

 

 

Not to sure what it will do when your on AD but i presume that it will update it to a database but the key represents the unique drive itself not the laptop

 

I ran the manage-bde -protectors -get c: command to get the protector ID and then updated/synched to AD using the manage-bde -protectors -adbackup c: -id command.

 

I was expecting it to change/update something in AD but only the password from when the original laptop was encrypted was there so I have removed the HDD, put is on a SATA to USB adapter and then entered the old password from AD and it has unlocked it so I can read/write to it. I was kind of expecting a new password to have been created and then updated to AD but it seems to be the other way around and the laptop has been updated with the password on the HDD hence why nothing has changed in AD. Whether this is because it's a like-for-like laptop or if this is just how it works I dont know.

[jthompson]

The computer's account in AD is essentially the instance of Windows on the HDD, so the recovery key that you've had to type in to boot, and the key stored in AD are unchanged when you simply transplant the HDD into a different laptop.