Bitlocker - need advice

[5nowman]

All,

 

Hi. Hope you are all well.

We issue laptops to teachers. They have all been told not to store stuff on their desktop and this has been violated.

 

We need to setup bitlocker and windows 11 asap. I have never setup bitlocker.

What we want:

 

1. install bitlocker on laptops - if it gets stolen nobody can get data. is that right?

They all log on with a local acocunt on laptops

Am I to setup bitlocker to encrypt the whole drive?

will users be asked a secondary password during boot?

 

If windows fails to boot or gets corrupt, no data will be restored from the laptop.. just a fresh format. That will be the rule.

 

Do  I need to mess around with the recovery passcord at that point?

 

2. How are you all getting users to login to their laptops from home? Laptops are on a DC and have a local acocunt for teachers to login with.

 

Any quick info would be appreciated.

 

Kind regards

 

5nowman

[timbo343]

Are you in a position where you add them to Intune or get your on-premAD up to Entra AD and go from there.

 

Where are staff saving the data to whilst they are offsite?

 

We have our laptops added to Intune and our onprem AD is sync'd to Entra.

 

Staff can then login to their devices from where ever using their on-prem credentials.

 

We enable ALL laptops that go offsite with BitLocker and enforce a pre-boot passcode so staff are forced to enter this code to boot into windows - this is not a BIOS pre-boot passcode, instead BitLocker has the ability to boot into Windows with a key.

 

We keep a copy of the recovery key incase we need it.

 

You are most likely going to need each laptop back to set up and audit however I dont see that as a bad thing.

[andy_nic]

i have bit locker on devices, which saves the bit locker recovery key to Active Directory, this is done via GPO and done just after the laptop is finished building with MDT and Intune Devices in to Azure. staff login with there normal domain accounts, everything is on OneDrive, but if there is a issue with bit locker normally after a windows update, we just give the the code over the phone or ask them to come in and its back to normal. i've recovered a device once or twice using PowerShell and CMD as the laptops  failed to boot/ got corrupted, the copied the profile off to a USB drive, but now days everything syncs apart from download and music, so we just reimage after speaking ton the member of staff. 

[Olliedawg]

As above you can configure bitlocker with either GPO or Intune. 

 

We store our bitlocker keys in the AD Computer Object.

[k-strider]

our staff laptops auto encrypt via a gpo. i cant find the site i used / followed to set this up  but this is the gpo settings with a scheduled task that runs the below batch file

the passwords are stored in AD.

 

you definatley want to bitlock anything that goes off site and ideally everything that could be stolen... remember that downloads goes to c:\users\username\downloads by default which could include personal/sensitive data 

 

Worst case if they arent domain joined or in azure is you have to get each one and right click the drive encrypt it and keep the recovery key somewhere... you will want these because ocasionally (sometimes after driver updates) it wants the recovery key to boot..

@echo off

set test /a = "qrz"

for /F "tokens=3 delims= " %%A in ('manage-bde -status %systemdrive% ^| findstr "    Encryption Method:"') do (
	if "%%A"=="AES" goto EncryptionCompleted
	)

for /F "tokens=3 delims= " %%A in ('manage-bde -status %systemdrive% ^| findstr "    Encryption Method:"') do (
	if "%%A"=="XTS-AES" goto EncryptionCompleted
	)

for /F "tokens=3 delims= " %%A in ('manage-bde -status %systemdrive% ^| findstr "    Encryption Method:"') do (
	if "%%A"=="None" goto TPMActivate
	)

goto ElevateAccess

:TPMActivate

powershell Get-BitlockerVolume

echo.
echo  =============================================================
echo  = It looks like your System Drive (%systemdrive%\) is not              =
echo  = encrypted. Let's try to enable BitLocker.                =
echo  =============================================================
for /F %%A in ('wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get IsEnabled_InitialValue ^| findstr "TRUE"') do (
if "%%A"=="TRUE" goto nextcheck
)

goto TPMFailure

:nextcheck
for /F %%A in ('wmic /namespace:\\root\cimv2\security\microsofttpm path win32_tpm get IsEnabled_InitialValue ^| findstr "TRUE"') do (
if "%%A"=="TRUE" goto starttpm
)

goto TPMFailure

:starttpm
powershell Initialize-Tpm

:bitlock

manage-bde -protectors -disable %systemdrive%
bcdedit /set {default} recoveryenabled No
bcdedit /set {default} bootstatuspolicy ignoreallfailures

manage-bde -protectors -delete %systemdrive% -type RecoveryPassword
manage-bde -protectors -add %systemdrive% -RecoveryPassword
for /F "tokens=2 delims=: " %%A in ('manage-bde -protectors -get %systemdrive% -type recoverypassword ^| findstr "       ID:"') do (
	echo %%A
	manage-bde -protectors -adbackup %systemdrive% -id %%A
)

manage-bde -protectors -enable %systemdrive%
manage-bde -on %systemdrive% -SkipHardwareTest


:VerifyBitLocker
for /F "tokens=3 delims= " %%A in ('manage-bde -status %systemdrive% ^| findstr "    Encryption Method:"') do (
	if "%%A"=="AES" goto Inprogress
	)

for /F "tokens=3 delims= " %%A in ('manage-bde -status %systemdrive% ^| findstr "    Encryption Method:"') do (
	if "%%A"=="XTS-AES" goto Inprogress
	)

for /F "tokens=3 delims= " %%A in ('manage-bde -status %systemdrive% ^| findstr "    Encryption Method:"') do (
	if "%%A"=="None" goto EncryptionFailed
	)

:TPMFailure
echo.
echo  =============================================================
echo  = System Volume Encryption on drive (%systemdrive%\) failed.           =
echo  = The problem could be the Tpm Chip is off in the BiOS.     =
echo  = Make sure the TPMPresent and TPMReady is True.            =
echo  =                                                           =
echo  = See the Tpm Status below                                  =
echo  =============================================================

powershell get-tpm

echo  Closing session in 30 seconds...
TIMEOUT /T 30 /NOBREAK
Exit

:EncryptionCompleted
echo.
echo  =============================================================
echo  = It looks like your System drive (%systemdrive%) is                   =
echo  = already encrypted or it's in progress. See the drive      =
echo  = Protection Status below.                                  =
echo  =============================================================

powershell Get-BitlockerVolume

echo  Closing session in 20 seconds...
TIMEOUT /T 20 /NOBREAK
Exit

:ElevateAccess
echo  =============================================================
echo  = It looks like your system require that you run this       =
echo  = program as an Administrator.                              =
echo  =                                                           =
echo  = Please right-click the file and run as Administrator.     =
echo  =============================================================

echo  Closing session in 20 seconds...
TIMEOUT /T 20 /NOBREAK
Exit

 

[mavhc]

> We issue laptops to teachers. They have all been told not to store stuff on their desktop and this has been violated.

 

Where do they store their stuff?

 

> if it gets stolen nobody can get data. is that right?

 

Only if no one knows the password of the user

 

> They all log on with a local account on laptops

 

Why? Do you not have a Domain Controller?

 

> Am I to setup bitlocker to encrypt the whole drive?

 

Yes.

 

> will users be asked a secondary password during boot?

 

It depends. Do the laptops have TPM? If so that will store the bitlocker password for you and release it as long as it thinks no one's tried to hack the laptop

 

> If windows fails to boot or gets corrupt, no data will be restored from the laptop.. just a fresh format. That will be the rule.

 

I end up just adding every place they can save to the backup/network storage, either File Server or OneDrive

 

> Do  I need to mess around with the recovery password at that point?

 

You'll possibly need the recovery password, plan to have them all recorded centrally, I have to type one in about once a month

 

> How are you all getting users to login to their laptops from home? Laptops are on a DC and have a local account for teachers to login with.

 

When you say Local Account, what do you mean?

 

[altecsole]

If you have Endpoint Security installed, like Sophos, you can also use that for device encryption.

[5nowman]

Basically users have a local administrator account. 

 

They VPN to the school server and access 1 share.

 

The laptops are on the domain so when they use them at school they can login using their domain credentials.

 

No profile roaming.

 

I find if they login at home using their domain credentials lots of things do not work. 

 

Do people just get staff to use their domain credentials and when at home it loads just their local apps, no start menu redirection etc?

 

Bitlocker: so I can encrypt the drive, make a note of the key incase windows updates screws it up. Does it as users for the key upon bootup?

 

Thank you all for your help so far.

 

5nowman

 

[3s-gtech]

We use a device profile with Always On VPN, so it works the same at home as in school. Same profile for both, and everything connects as it would (albeit slower). The profile is local, but it's not a local account. Redirection is used, but it just works - planning to migrate away from it to an extent so we now redirect Start Menus to a local copy of the folder.

 

As long as your machines have a TPM 2.0 module, you just encrypt using that. No password required, unless it has a fit (sometimes turning it off and on again fixes that). You can have a password too, but little point. You can use Powershell, MDT build process or GP to store the Bitlocker key in the AD object - we use a PS script. They then show in the Bitlocker Recover tab.

[mbedford]

Honestly, you have larger issues here than just device encryption.  Firstly, stop giving your users local admin, anywhere, especially remote users with VPN access.  

 

Get your users to use there domain accounts with restricted permissions.  I understand your pain with domain accounts on remote devices, but local admin access is not the right solution.

 

Take a look at AOVPN (Always On VPN) - https://learn.microsoft.com/en-us/windows-server/remote/remote-access/overview-always-on-vpn 

 

We use it, its a bit of a pain to setup, but once done, it provides seamless connectivity to our network for remote users, allowing them to use domain logins and get a more or less similar experience to that onsite.

 

[5nowman]

3 minutes ago, mbedford said:

Honestly, you have larger issues here than just device encryption.  Firstly, stop giving your users local admin, anywhere, especially remote users with VPN access.  

 

Get your users to use there domain accounts with restricted permissions.  I understand your pain with domain accounts on remote devices, but local admin access is not the right solution.

 

Take a look at AOVPN (Always On VPN) - https://learn.microsoft.com/en-us/windows-server/remote/remote-access/overview-always-on-vpn 

 

We use it, its a bit of a pain to setup, but once done, it provides seamless connectivity to our network for remote users, allowing them to use domain logins and get a more or less similar experience to that onsite.

 

They have local admin as they need this for printers scanners at home etc.

 

We have sophos end point which protects them.

 

On a grand scale we find chrome notifications causing the most chaos regarding popups sometimes however this is not dependent on administrator rights.

 

[5nowman]

7 minutes ago, mbedford said:

Honestly, you have larger issues here than just device encryption.  Firstly, stop giving your users local admin, anywhere, especially remote users with VPN access.  

 

Get your users to use there domain accounts with restricted permissions.  I understand your pain with domain accounts on remote devices, but local admin access is not the right solution.

 

Take a look at AOVPN (Always On VPN) - https://learn.microsoft.com/en-us/windows-server/remote/remote-access/overview-always-on-vpn 

 

We use it, its a bit of a pain to setup, but once done, it provides seamless connectivity to our network for remote users, allowing them to use domain logins and get a more or less similar experience to that onsite.

 

would this work with smoothwall vpn?

[mbedford]

Just now, 5nowman said:

would this work with smoothwall vpn?

AOVPN is the VPN service, you wouldn't route it through another VPN service.  Instead you would configure your on prem firewall to allow the AOVPN connection from the outside world into your AOVPN end point server and from there into your network.

[altecsole]

37 minutes ago, 5nowman said:

 

They have local admin as they need this for printers scanners at home etc.

 

Yikes! Giving then administrator access so that they can install a printer isn't recommended. 

[5nowman]

23 minutes ago, altecsole said:

Yikes! Giving then administrator access so that they can install a printer isn't recommended. 

 

 

A lot of staff don't even use their laptops. It is a waste! The ones that do are the good ones that don't mess around!

Each case needs it's own security and standards.. there isn't really a one that fits all.

 

not just printers lol.. that would be nuts! 

 

 

[timbo343]

1 hour ago, 5nowman said:

Basically users have a local administrator account. 

 

They VPN to the school server and access 1 share.

 

The laptops are on the domain so when they use them at school they can login using their domain credentials.

 

No profile roaming.

 

I find if they login at home using their domain credentials lots of things do not work. 

 

Do people just get staff to use their domain credentials and when at home it loads just their local apps, no start menu redirection etc?

 

Bitlocker: so I can encrypt the drive, make a note of the key incase windows updates screws it up. Does it as users for the key upon bootup?

 

Thank you all for your help so far.

 

5nowman

 

We set a BitLocker boot up key so that only that member of staff who has been allocated the device can boot into it.

[3s-gtech]

Yes, I should add - they should not be system admins. That's your role on a machine, and isn't necessary for any use cases here including when they're used at home with their own printers etc. While staff can install apps from the Store here, nothing else - it would be a security risk and a licensing headache.

[5nowman]

28 minutes ago, timbo343 said:

We set a BitLocker boot up key so that only that member of staff who has been allocated the device can boot into it.

I am guessing this is a alphanumeric key not a physical usb key.

 

This sounds like a good plan!

[5nowman]

22 minutes ago, 3s-gtech said:

Yes, I should add - they should not be system admins. That's your role on a machine, and isn't necessary for any use cases here including when they're used at home with their own printers etc. While staff can install apps from the Store here, nothing else - it would be a security risk and a licensing headache.

They get just about enough elevated rights to do their work. A custom group.

[timbo343]

7 minutes ago, 5nowman said:

I am guessing this is a alphanumeric key not a physical usb key.

 

This sounds like a good plan!

Yes, it'a configured as a windows pre-boot key made up of numbers at least 6 digits.

 

[TwistedHelixis]

I have deployed bitlocker to all our staff devices via group policy and more recently from Google Workspace.

 

in both instances, I enable pin number access, which asks the user for a pin number before the drive even boots.

 

Both Windows server and also my deployment software (Action1) automatically keep a copy of the bitlocker recovery key, should a windows update or hardware mess things up a bit, I can always decrypt the drive.

[jmak]

One reason for implementing Bitlocker I haven't seen covered is MS habit of encrypting a drive even when it isn't configured. We've had this several times at work - I was very sceptical until I saw the mea culpa from MS and I then suffered it at home. Don't know what I was supposed to do about that - my personal machine has Windows Home which theoretically doesn't even support Bitlocker, but after an update it wanted a Bitlocker key before booting. 

 

Definitely set up an automated way to store the keys.

[Steve21]

2 hours ago, jmak said:

One reason for implementing Bitlocker I haven't seen covered is MS habit of encrypting a drive even when it isn't configured. We've had this several times at work - I was very sceptical until I saw the mea culpa from MS and I then suffered it at home. Don't know what I was supposed to do about that - my personal machine has Windows Home which theoretically doesn't even support Bitlocker, but after an update it wanted a Bitlocker key before booting. 

 

Definitely set up an automated way to store the keys.

Just as a note, That's probably "Device Encryption" Device Encryption in Windows - Microsoft Support - It's an automatic encryption on supported devices that doesn't need bitlocker licensing, but also you can't control it via the normal bitlocker tools as it backs up to personal MS accounts only and not AD etc

Steve

[mavhc]

1. You don't need to and should never give anyone admin rights, 1 virus and you're totally screwed

2. You can set GPO to allow printers to install, this is rarely and issue anyway with Windows 10/11, maybe you needed this for XP era

3. Home will auto encrypt if you have a method to backup your recovery key, eg you signed in with a MS account, so it's stored on your online account

4. You can disable chrome notifications as they do seem to be mostly used for scam popups, although installing ublock origin lite helps with that.

5. You can "always available offline" the share where the start menu is, same with home drive

[5nowman]

On 18/06/2025 at 17:07, TwistedHelixis said:

I have deployed bitlocker to all our staff devices via group policy and more recently from Google Workspace.

 

in both instances, I enable pin number access, which asks the user for a pin number before the drive even boots.

 

Both Windows server and also my deployment software (Action1) automatically keep a copy of the bitlocker recovery key, should a windows update or hardware mess things up a bit, I can always decrypt the drive.

does having a pin mean you don't see to backup that recovery key?

 

or you still need key?

 

I am planning to bitlocker all laptops one by one and backup key for each on a usb stick. same stick just save file.

Add pin number too.