Rolling out Bitlocker - MBAM needed yes/no? TPM Owner Password

[SpaceInvader83]

Hi all,

 

I started to look into rolling out Bitlocker but I now see you need to setup MBAM to save the TPM Owner Password, am i right in thinking that I now need to setup MBAM to do this properly? Or am i misunderstanding this requirement for the TPM owner password?

[Arthur]

I just backup the recovery keys to AD (for both Windows 7 and 10). Never bothered with the TPM owner password.

 

[SpaceInvader83]

Yeah that's where i got up to, after some further reading it seems the TPM owner password is only ever required when you don't have physical access. Microsoft Info

[Blue_Cookeh]

MBAM is still worth deploying IMO since it provides extra policies and the potential for you to delegate key recovery.

[damien_mason]

we use bitlocker and just backup the key to a file or if the device is azure joined you can save the keys to the azure portal.Hope this helps

[mavhc]

I don't have MBAM so I do this:

 

If you don't have TPM 2.0 you may have to enable TPM in BIOS, script with HP's BiosConfigUtility64.exe etc.

 

Create GPO:

Windows Components/BitLocker Drive Encryption

Disable new DMA devices when this computer is locked: Enabled

Prevent memory overwrite on restart: Disabled

Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista): Enabled

Require BitLocker backup to AD DS: Enabled

Select BitLocker recovery information to store: Recovery passwords and key packages

 

Windows Components/BitLocker Drive Encryption/Fixed Data Drives

Choose how BitLocker-protected fixed drives can be recovered: Enabled

Allow data recovery agent: Enabled

Configure user storage of BitLocker recovery information:

Allow 48-digit recovery password

Allow 256-bit recovery key

Omit recovery options from the BitLocker setup wizard: Enabled

Save BitLocker recovery information to AD DS for fixed data drives: Enabled

Configure storage of BitLocker recovery information to AD DS: Backup recovery passwords and key packages

Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives: Enabled

 

Configure use of hardware-based encryption for fixed data drives: Enabled

Use BitLocker software-based encryption when hardware encryption is not available: Enabled

Restrict encryption algorithms and cipher suites allowed for hardware-based encryption: Disabled

Deny write access to fixed drives not protected by BitLocker: Enabled

 

Windows Components/BitLocker Drive Encryption/Operating System Drives

Allow network unlock at startup: Enabled

Allow Secure Boot for integrity validation: Enabled

Choose how BitLocker-protected operating system drives can be recovered: Enabled

Allow data recovery agent: Enabled

Configure user storage of BitLocker recovery information:

Allow 48-digit recovery password

Allow 256-bit recovery key

Omit recovery options from the BitLocker setup wizard: Enabled

Save BitLocker recovery information to AD DS for operating system drives: Enabled

Configure storage of BitLocker recovery information to AD DS: Store recovery passwords and key packages

Do not enable BitLocker until recovery information is stored to AD DS for operating system drives: Enabled

 

Configure use of hardware-based encryption for operating system drives: Enabled

Use BitLocker software-based encryption when hardware encryption is not available: Enabled

Restrict encryption algorithms and cipher suites allowed for hardware-based encryption: Disabled

 

Disallow standard users from changing the PIN or password: Enabled

 

Windows Components/BitLocker Drive Encryption/Removable Data Drives

Configure use of hardware-based encryption for removable data drives: Enabled

Use BitLocker software-based encryption when hardware encryption is not available: Enabled

Restrict encryption algorithms and cipher suites allowed for hardware-based encryption: Disabled

 

Control use of BitLocker on removable drives: Enabled

Allow users to apply BitLocker protection on removable data drives: Enabled

Allow users to suspend and decrypt BitLocker protection on removable data drives: Disabled

 

Deny write access to removable drives not protected by BitLocker: Enabled

Do not allow write access to devices configured in another organization: Enabled

 

Apply that to all user computers, wait a month for it to apply (windows is too stable!)

 

Create a powershell file:

Write-Host "Starting"
$TPM = Get-WmiObject win32_tpm -Namespace root\cimv2\security\microsofttpm | where {$_.IsEnabled().Isenabled -eq 'True'} -ErrorAction SilentlyContinue

Write-Host "TPM = ", $TPM
$WindowsVer = Get-WmiObject -Query 'select * from Win32_OperatingSystem where (Version like "6.2%" or Version like "6.3%" or Version like "10.0%") and ProductType = "1"' -ErrorAction SilentlyContinue
$BitLockerReadyDrive = Get-BitLockerVolume -MountPoint $env:SystemDrive -ErrorAction SilentlyContinue
$SystemDriveBitLockerRDY = Get-BitLockerVolume -MountPoint $env:SystemDrive -ErrorAction SilentlyContinue

Write-Host "WindowsVer = ", $WindowsVer
Write-Host "SystemDriveBitLockerRDY = ", $SystemDriveBitLockerRDY
#If all of the above prequisites are met, then create the key protectors, then enable BitLocker and backup the Recovery key to AD.
if ($WindowsVer -and $TPM -and $SystemDriveBitLockerRDY) {
Write-Host "Starting Encryption"
#Creating the recovery key
Start-Process 'manage-bde.exe' -ArgumentList " -protectors -add $env:SystemDrive -recoverypassword" -Verb runas -Wait

#Adding TPM key
Start-Process 'manage-bde.exe' -ArgumentList " -protectors -add $env:SystemDrive  -tpm" -Verb runas -Wait
sleep -Seconds 15 #This is to give sufficient time for the protectors to fully take effect.

#Enabling Encryption
Start-Process 'manage-bde.exe' -ArgumentList " -on $env:SystemDrive" -Verb runas -Wait

#Getting Recovery Key GUID
$RecoveryKeyGUID = (Get-BitLockerVolume -MountPoint $env:SystemDrive).keyprotector | where {$_.Keyprotectortype -eq 'RecoveryPassword'} | Select-Object -ExpandProperty KeyProtectorID

#Backing up the Recovery to AD.
manage-bde.exe  -protectors $env:SystemDrive -adbackup -id $RecoveryKeyGUID

#Restarting the computer, to begin the encryption process
Restart-Computer}

 

Enable Windows RM, open port 5985 on clients, start the windows rm service with gpp etc.

 

Install bitlocker tools on server, reboot. Should have a bitlocker tab in ADUC computer property windows.

 

In powershell run: Invoke-Command -ComputerName computer001 -FilePath enablebitlocker.ps1

 

Key should appear in AD.

 

Machine will reboot if no one's logged in.

 

Once rebooted encryption will start in the background.

 

run manage-bde.exe -cn dm095 -status

to see the status, crashes on windows 2012 r2 against windows 10, because it doesn't know about new encryption types, but gives you the info you need.

 

Encrypt one by one or add a startup/shutdown script.

[SpaceInvader83]

Excellent thank you, I'm pretty much all sorted GPO wise now and it's working a treat but the help with deployment is great!

[armadillo]

Hi guys, Inkow it's an old thread; I've followed your instructions and I still can't see any key in bitlocker tab in ADUC computer property.

 

Any help is appreciated and thanks in advance.

[mavhc]

https://blogs.technet.microsoft.com/askcore/2010/04/06/how-to-backup-recovery-information-in-ad-after-bitlocker-is-turned-on-in-windows-7/ shows how to do it manually, note that {} in powershell means something, so do it in CMD

[internetuser]

Cheers. For something so simple finding a workable script is a challenge.

 

How have people deployed this script ? via start up script / log out script ? or something else ?

Edited November 26, 2019 by internetuser

[Ertech]

I am looking to rollout BitLocker (AD joined) with TPM 1.2 using automatic unlocks and was wondering if I need to set any trusted platform module services GPOs? - e.g. prevent TPM lockouts?

 

Thanks

Edited February 19, 2020 by Ertech

[mavhc]

You probably want to adjust https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings Configure TPM platform validation profile if you get a lot of issues with requiring a recovery key. Eg if a computer fails to boot and goes into recovery mode, normally power off/on would fix it, but with bitlocker enabled it might trigger a PCR lock

[Koldov]

Regarding the 'owner password' I thought it had been deprecated in GPO/AD (as in it no longer stores it) it is created and then discarded.

 

https://deploywindows.com/2017/06/08/whats-the-story-about-tpm-owner-password-and-bitlocker-recovery-password/

 

I had an incident where a student teacher had locked themselves out (I had the recovery key backed up in AD so it wasn't a problem to unlock it), however they did it again 2 more times in the next couple of days. We have BitLocker set-up with a password/PIN.

 

The problem was, after the first couple of times it wasn't giving her 3 chances or whatever, it was locking her out on the first incorrect attempt (too many PIN attempts).

 

I don't know a great deal about BitLocker, so I did a bit of Googling and it seems quite a common occurrence, I found mostly articles suggesting a reset in 'TPM-Administration' (TPM.MSC)...

 

It seems to require the TPM to be reset and this requires the TPM owner authorisation (and therefore I thought, the owner password).

 

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd851452(v=ws.11)?redirectedfrom=MSDN

 

I didn't try too many other methods like suspending BitLocker and then turning the TPM off to reset it as I wasn't sure if this would actually leave me in a worse position/lose data etc.

 

Is there a better way around it without the owner password?

Edited February 19, 2020 by Koldov

[mavhc]

Step 0 of bitlocker is to make sure there's no personal data on the drive that's not synced elsewhere. Don't trust a tpm chip to continue working, always check there's a current recovery key in AD

[psydii]

Configuration Manager (aka MECM, and formerly called SCCM) now has Bitlocker Management built in. https://docs.microsoft.com/en-us/configmgr/protect/plan-design/bitlocker-management

 

As does Intune. https://docs.microsoft.com/en-us/intune/protect/encrypt-devices

 

The option to just put the recovery keys into AD is also valid option for school-scale deployments, though you lose self-service and a whole heap of reporting capabilities (How do you *know* that your machines are still protected?) To address @armadillo's question from last year, you need to install the Bitlocker management tools to see the Bitlocker tab in ADUC: https://theitbros.com/config-active-directory-store-bitlocker-recovery-keys/

 

For reference those with legacy fleets: enable secure boot (this requires disabling legacy CSM/Bios mode and enabling EUFI Only, reset the TPM) and re-image with a EUFI aware process. For a comparison of TPM1.2 vs TPM2.0 capabilities see this document: https://docs.microsoft.com/en-us/windows/security/information-protection/tpm/tpm-recommendations . As is common with modern management methods, EUFI is step 0. This can be a right pain with some very old devices, but most decent machines since 2012 and many enterprise grade machines from earlier do actually properly support this -though getting firmware updates for such old hardware to fix early bugs can be a challenge.