Per User BitLocker USB Encryption

[FN-GM]

Hi,

 

I am using this guide to force staff to have read only USB drives unless they encrypt via bitlocker. - https://blogs.technet.microsoft.com/askpfeplat/2013/06/09/how-to-enable-user-based-controlenforcement-of-bitlocker-on-removable-data-drives/

 

When they insert the drive they are prompted to encrypt. However data can still be copied onto the drive if they don't.

 

Does anyone have any suggestions please?

 

Thanks

[Michael]

There's no real solution to this, however the likes of NetSupport DNA includes USB Management, so you can block all connected USB Storage devices and only allow authorised devices or none at all. Entirely up to you.

[gshaw]

It's do-able via GPP... https://blogs.technet.microsoft.com/askpfeplat/2013/06/09/how-to-enable-user-based-controlenforcement-of-bitlocker-on-removable-data-drives/

 

Edit: just noticed the OP's link was the same It does work here and gives access denied on write in our tests, you sure you put all the keys on?

Edited February 3, 2017 by gshaw

[FN-GM]

There's no real solution to this, however the likes of NetSupport DNA includes USB Management, so you can block all connected USB Storage devices and only allow authorised devices or none at all. Entirely up to you.

 

That wouldn't meet our requirements. Plus it costs

 

It's do-able via GPP... https://blogs.technet.microsoft.com/askpfeplat/2013/06/09/how-to-enable-user-based-controlenforcement-of-bitlocker-on-removable-data-drives/

 

Edit: just noticed the OP's link was the same It does work here and gives access denied on write in our tests, you sure you put all the keys on?

@gshaw I think so will double check. You don't happen to have a screenshot of your GPP please so I can double check?

 

Thanks

[gshaw]

@FN-GM click to enlarge

 

 

Each one has an item-level targeting setting applied so the BitLocker only gets enabled for a specified group.

 

So effectively a per-User GPO sets HKLM level policies via the GPP.

Edited February 13, 2017 by gshaw

[FN-GM]

Just to confirm 0 is off and 1 is on?

 

What client OS are you using?

 

I have attach my polices. I want to make the drives read only until you encrypt. The user also gets prompted to encrypt. Do they look ok please?

 

I can't see why it doesn't work, so thinking it might be me!!

[Blue_Cookeh]

Are you using MBAM from the MDOP suite? The MBAM group policies have this as a specific policy (not preference) setting. USB sticks are read only until encrypted. I then make this "per user" by using loopback processing IIRC.

 

Honestly, if you aren't the cost of MDOP is worth it for MBAM alone. I gave one of our SLT access to the help desk portion of the MBAM site and they can lookup recovery keys for any laptop or USB stick in seconds.

Edited February 13, 2017 by Blue_Cookeh

[gshaw]

@Blue_Cookeh

 

No just plain Windows BitLocker. MDOP had a stupid per device licensing policy last time I looked at it, which for 3000 machines came out as a significant cost. How many are you licensing it for or does it come under FTE count now?

 

Did also hear MDOP was included with Windows 10 on Software Assurance so not sure if that changes the situation for Win7 on EES bearing in mind we get downgrade rights.

 

Would much prefer a native GPO, really poor that it wasn't included as standard imo.

@FN-GM yeah that should do it, it seems you can still format the drive with force encrypt set to 1 but you can't put any files on it without BitLocker enabled.

Edited February 13, 2017 by gshaw

[Blue_Cookeh]

@Blue_Cookeh

 

No just plain Windows BitLocker. MDOP had a stupid per device licensing policy last time I looked at it, which for 3000 machines came out as a significant cost. How many are you licensing it for or does it come under FTE count now?

 

Did also hear MDOP was included with Windows 10 on Software Assurance so not sure if that changes the situation for Win7 on EES bearing in mind we get downgrade rights.

 

Would much prefer a native GPO, really poor that it wasn't included as standard imo.

@FN-GM yeah that should do it, it seems you can still format the drive with force encrypt set to 1 but you can't put any files on it without BitLocker enabled.

 

I had it added on to our licensing probably 2 years ago and our licensing guys (Pugh, now Millgate) both said they were included under the FTE count... I hope they're right!

[Arthur]

MDOP had a stupid per device licensing policy last time I looked at it

MDOP has been included with EES since August 2015. As long you renewed your EES subscription after the release of W10 you'll be covered.

 

www.edugeek.net/forums/enterprise-software/158113-mdop-2015-released.html#post1395587

Edited February 13, 2017 by Arthur

[FN-GM]

Hello,

 

To be sure, if I setup MBAM I can manage per user BitLocker stuff, and store the recovery keys for these users?

 

Thanks

[gshaw]

Are you using MBAM from the MDOP suite? The MBAM group policies have this as a specific policy (not preference) setting. USB sticks are read only until encrypted. I then make this "per user" by using loopback processing IIRC.

@Blue_Cookeh if you get a moment could you check your GPO settings please? The MBAM settings seem to be Computer-based and I always thought Loopback only works the other way i.e. applying Per User stuff to Computers

[Blue_Cookeh]

@Blue_Cookeh if you get a moment could you check your GPO settings please? The MBAM settings seem to be Computer-based and I always thought Loopback only works the other way i.e. applying Per User stuff to Computers

 

Yes, you're right! I'll take a look at our config next week, this is definitely how we've got it setup one way or another since staff USBs are encrypted and kids arent!

[mdrabble]

Just gone over the guide and I'm getting nothing..... no prompt or denied access.

 

Instead of using the group method, I am currently testing on a test user - so the user targeting is for a user and not member of group.

 

Apart from the 3 registry entries to set the attributes, is there anything else I need to do? -

 

I take it these are placed under the User GPP and not Computer GPP

Edited November 28, 2017 by mdrabble

[FN-GM]

I couldn't get it working. We are going ready only for USB drives instead.

[mdrabble]

@gshaw just noticed one of your registry enteries is for HKLM\System\CurrentControlSet

 

Which is covered on the weblink at the top of the page - could you let me know what the full entry is for that key please.

 

I suspect that may be why my attempt isnt working as I put the last entry under the same location as the others.

 

Cheers

[gshaw]

@MRDabble here you go, straight export from my GPP page

 

That will enable BitLocker for the user it's applied to

 

Name	Order	Action	Hive	Key	Value Name	Type	Value Data
RDVAllowBDE	3	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVAllowBDE	REG_DWORD	00000001
RDVAllowBDE	4	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVAllowBDE	REG_DWORD	00000000
RDVConfigureBDE	1	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVConfigureBDE	REG_DWORD	00000001
RDVConfigureBDE	2	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVConfigureBDE	REG_DWORD	00000000
RDVDenyCrossOrg	5	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVDenyCrossOrg	REG_DWORD	00000001
RDVDenyCrossOrg	6	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVDenyCrossOrg	REG_DWORD	00000000
RDVDenyWriteAccess	7	Update	HKEY_LOCAL_MACHINE	SYSTEM\CurrentControlSet\Policies\Microsoft\FVE	RDVDenyWriteAccess	REG_DWORD	00000001
RDVDenyWriteAccess	8	Update	HKEY_LOCAL_MACHINE	SYSTEM\CurrentControlSet\Policies\Microsoft\FVE	RDVDenyWriteAccess	REG_DWORD	00000000

[mdrabble]

Now working! - It was the very last entry that was the issue. Once added it now prompts as excepted.

 

@FN-GM This now works for me - looks like we didn't have the last registry key in the correct place - we had it under HKLM\SOFTWARE\Policies\Microsoft\FVE instead of HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE

[gshaw]

Now working! - It was the very last entry that was the issue. Once added it now prompts as excepted.

 

@FN-GM This now works for me - looks like we didn't have the last registry key in the correct place - we had it under HKLM\SOFTWARE\Policies\Microsoft\FVE instead of HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE

Yeah the CCS entry only got mentioned down in the comments on the page

 

@MRDabble once you go into production with this you may need to have a second policy that sets the values in the opposite direction for any users you don't want encryption forced. Otherwise when you log off the HKLM settings are still in effect and users will get encryption prompts.

Edited December 5, 2017 by gshaw

[eddyc]

Sorry to drag up an old thread. @gshaw I have just tried your GPO preferences as per below but am not getting any prompts after a GPupdate.

 

We are using Windows 10 x64 1709 Education. Is there a feature that needs to be enabled to make this work?

 

Cheers, Eddyc

 

 

@MRDabble here you go, straight export from my GPP page

 

That will enable BitLocker for the user it's applied to

 

Name	Order	Action	Hive	Key	Value Name	Type	Value Data
RDVAllowBDE	3	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVAllowBDE	REG_DWORD	00000001
RDVAllowBDE	4	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVAllowBDE	REG_DWORD	00000000
RDVConfigureBDE	1	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVConfigureBDE	REG_DWORD	00000001
RDVConfigureBDE	2	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVConfigureBDE	REG_DWORD	00000000
RDVDenyCrossOrg	5	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVDenyCrossOrg	REG_DWORD	00000001
RDVDenyCrossOrg	6	Update	HKEY_LOCAL_MACHINE	SOFTWARE\Policies\Microsoft\FVE	RDVDenyCrossOrg	REG_DWORD	00000000
RDVDenyWriteAccess	7	Update	HKEY_LOCAL_MACHINE	SYSTEM\CurrentControlSet\Policies\Microsoft\FVE	RDVDenyWriteAccess	REG_DWORD	00000001
RDVDenyWriteAccess	8	Update	HKEY_LOCAL_MACHINE	SYSTEM\CurrentControlSet\Policies\Microsoft\FVE	RDVDenyWriteAccess	REG_DWORD	00000000

[mdrabble]

@eddyc this works fine on 1709

 

Have you made sure the RVDenyWriteAccess is under SYSTEM\CurrentControlSet\Policies\Microsoft\FVE

[eddyc]

Hey, thanks for the reply. Yes I have.

 

Do I need MBAM installed too or should this work natively with just the OS?

 

@eddyc this works fine on 1709

 

Have you made sure the RVDenyWriteAccess is under SYSTEM\CurrentControlSet\Policies\Microsoft\FVE

[mdrabble]

I've not looked at MBAM - I supposed I should do if that is the correct support method.....

 

Mine works directly from GPO using registry settings and Item-Level Targetting to apply/remove the registry settings.

[eddyc]

I must be missing something then, sadly I do not get any prompts or anything despite copying those GPP to the letter! :-(

 

I've not looked at MBAM - I supposed I should do if that is the correct support method.....

 

Mine works directly from GPO using registry settings and Item-Level Targetting to apply/remove the registry settings.

[mdrabble]

@eddyc PM me you email address and I'll send over the html report from group policy for my Bitlocker settings.