BitLocker Locks

[T_Lister]

Good afternoon forum,

 

I'm curious as to whether anyone has found BitLocker to lock by itself, or for the password to just stop working so the recovery key has to be used? I have staff claiming that their laptop has just 'locked'. Over the past few months I have not seen this happen and I can only presume that it is user error. If anyone is finding that it doesn't work properly, please let me know.

 

I am using Windows 10 LTSC.

 

Thanks in advance.

[mavhc]

If the PCR triggers are activated, it requires the recovery key. They can be activated by a failed boot/shutdown and attempt to auto recover, so yeah, it can happen pretty much by itself

[T_Lister]

Anyway of stopping it?

[mavhc]

https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings ctrl-f for PCR

[T_Lister]

To make sure I have this clear in my head:

 

Allow Secure Boot for integrity validation - Enable

Config TPM Platform validation profile for native UEFI firmware config - Enable and tick PCR 7

 

Should I enable and tick PCR 7 for the other TPM platforms?

[mavhc]

Probably

[KevinB]

To add to the mix... If it's a Dell laptop sometimes a BIOS update will auto install and blammo goes your TPM data requiring the recovery key to boot the first time.

[mavhc]

Yeah, that's what that PCR 7 thing is about, avoiding stuff like that

[T_Lister]

They're Lenovo, HP or Stone mainly. I've applied all three PCR 7 policies for now and the allow secure boot for integrity, we'll see how that goes.

[T_Lister]

So here's a good one. Sent my technician out to sort out the encryption as they were adament they were locked. After telling me they weren't putting a wrong password in, he finds out that they didn't know they didn're realise they had to put a password in...

 

Thanks for you help though, I've applied the settings anyway.