[ltsb, 1607] Bitlocker encryption... HELP!

[Koldov]

Hi All,

 

Trying to set-up new laptops, but unfortunately I'm new to the TPM/Bitlocker thing as all our previous laptops were very old (non TPM) and encrypted with Truecrypt.

 

I am hopelessly lost in Google and after reading pages and pages on how to set it up, the information has stopped registering in my brain (think I'm getting too old for this)!

 

I really just want something very simple and for it to appear to the user very much like Truecrypt if possible (you know, we fear change)...

 

So, user boots laptop > enters decryption password > gets to Windows log-in screen.

 

The amount of Bitlocker/TPM related GPO's is mind boggling and some of the settings seem to do the same thing (like setting the options for OS drives AND fixed drives - if you only have one drive is it necessary to configure both?), the instructions are outdated (such as saving TPM passwords in AD), or seem to require extra options installed on the DC (MDOP, MBAM, BitLocker Recovery Password Viewer - can I get it to save passwords in AD without these?), or they are just plain 'over the top' for the scenario I have (let's face it, as much as I take security seriously, we are not Government spies) and I really just want the option to a) turn it on, b) enter the password (and have it saved in AD) and c) stop the users messing with it!

 

Can anyone please point me in the direction of those GPO's?

Edited February 26, 2018 by Koldov

[KevinB]

These are my settings, and it does exactly what you're after. You need to turn it on yourself after building (I expect there's a way of doing it automatically with MDT and/or SCCM TS but I've never felt the need.

 

[johnpd]

I’m also interested in this - When you say turn it on yourself - do you mean enable bitlocker on the drive logged on as admin?

 

I read somewhere that AD bitlocker store is being removed in future versions or there is a limitation coming in - is this right?

 

Currently I do everything for bitlocker by hand including the gpo locally to enable non tpm laptops a password on boot. We then store the keys securely and not with AD.

[KevinB]

I’m also interested in this - When you say turn it on yourself - do you mean enable bitlocker on the drive logged on as admin?

 

Yes, exactly that.

 

I read somewhere that AD bitlocker store is being removed in future versions or there is a limitation coming in - is this right?

 

I've not read that anywhere, but it's worth investigating.

[Koldov]

Thanks for taking the time to point me in the right direction @KevinB.

 

If you or anyone else reading could just enlighten me on the following points. Rather have a bit more understanding than just blindly following, before I pull the trigger....

 

 

This part means that it will save recovery passwords to AD DS, but do I have to do anything on the server to enable that to happen or will it just magically appear on the tabs for the computer properties? If not how do I access this 'recovery password'?

 

 

I get the first part (the enhanced PIN lets you choose letters and special characters for a 'password'), but if I enable the part about 'Recovery Agent' I also need to create that 'Recovery Agent' on the server - following something like this?:

 

https://blogs.technet.microsoft.com/askcore/2015/10/16/setting-up-data-recovery-agent-for-bitlocker/

 

@johnpd - Obviously I can't answer your questions, but from what I have read, this part of the GPO allows you to use 'Bitlocker' on computers without a compatible TPM (don't worry about the bit blocked out in red, that's just me trying to work out what each individual options does).

 

 

The first screenshot above allows the 'Bitlocker' recovery key and details/backup to be stored in AD DS, the second screenshot is to make a 'password' on start-up (at least I hope I understand it correctly). I have also read that the GPO for storing TPM data has been deprecated and is now part of something else called MBAM/MDOP (which I have also read is only available to SA customers and requires a full version of SQL - please someone correct me if I'm wrong).

 

As for enabling 'Bitlocker' on a device, the options I have read about are a scheduled task, or enabling it in the deployment image.

Edited February 27, 2018 by Koldov

[KevinB]

 

[ATTACH=CONFIG]47865[/ATTACH]

 

This part means that it will save recovery passwords to AD DS, but do I have to do anything on the server to enable that to happen or will it just magically appear on the tabs for the computer properties? If not how do I access this 'recovery password'?

 

Setting this option will store the data in AD, and to view it you need to install the Bitlocker Recovery Password Viewer in Roles and Features which adds a tab to the Properties dialog:

 

[ATTACH=CONFIG]47867[/ATTACH]

 

I get the first part (the enhanced PIN lets you choose letters and special characters for a 'password'), but if I enable the part about 'Recovery Agent' I also need to create that 'Recovery Agent' on the server - following something like this?:

 

https://blogs.technet.microsoft.com/askcore/2015/10/16/setting-up-data-recovery-agent-for-bitlocker/

To be honest I haven't looked into that; I blagged most of these settings from one of our LA support guys

[Koldov]

Haha, typical MS...

 

When I looked at the server, I only saw these Bitlocker options and presumed I didn't have it....

 

[Koldov]

Hmmmmm.... Well, I ran 'Bitlocker' on the drive...

 

I was expecting it to ask me for a PIN, but it didn't - it also asked me a couple of questions I thought I'd covered in the GPO...

 

Anyway, I let it encrypt and rebooted... no password asked for! Good job as I hadn't set one - guess it was just using TPM info, which is cool, but not what I want it to do.

 

Looked around for some options and found where to manually choose/add the PIN and now it is asking for password on boot, so all good.

 

However, no recovery information has been stored in AD (good job I saved it to a USB in the wizard).

 

Digging around in Google, it appears there is a setting to allow computers to add info to AD.

 

Can anyone confirm this?

 

I have seen reg hacks, .vbs scripts, PS scripts or manually adding a delegation to to the Root of the Domain in AD....

[KevinB]

AFAIR we didn't need to make any changes to allow the machines to write the recover information back to AD. Given that this hasn't happened for you, and that other settings you thought were set by GP weren't in fact set, are you 100% certain that all of your GPOs are being applied?

[Koldov]

Yeah, I ran RSOP and they all looked OK.

 

But, I decrypted and encrypted the drive again and it has stored the info!

 

I also allowed inheritance of the Default Domain Policy on the OU (I had disabled inheritance for testing as the Default Policy is such a beast now, with lots of old stuff lurking about)...

 

So, it could have been a mixture of the Bitlocker Policy not having been fully implemented, or something to do with the disallowed inheritance (I'm not sure if that means that the 'SELF' attributes the computer needs delegating wasn't applying).

 

Anyway, looks like the articles I was reading was a mixture of old stuff (to do with TPM, Win7, Server 2008 etc).

 

Thanks for your help @KevinB

[KevinB]

No worries @Koldov, you're welcome

[mavhc]

You need to add the bitlocker stuff on the machine you're viewing the AD info on to see the new bitlocker tab

 

http://www.edugeek.net/forums/windows-10/192536-rolling-out-bitlocker-mbam-needed-yes-no-tpm-owner-password.html#post1648918