Jayloax

You guys are both right - I went and checked it out. I was mistaken.

Hi, what I said is correct, but perhaps could have been written more clearly. Yes, Bitlocker recovery is triggered when there is a change to the PCRs, such as changes to the boot order, or extracting the drive, or changing some hardware. By following the steps I suggested, it mitigates the attack vectors for most of them. I think drilling into the PCRs would be too deep for this post as it looked to me like the poster was asking for a place to start. To answer your question about booting into the tool, you misunderstood. I'm not saying you can boot from the login screen, but if you turn on a laptop and it gets to the Windows login screen, then from an attackers side, I can see that Bitlocker is decrypted. Knowing that, I can then reboot the system and boot into something like a USB running Hirens Boot CD, I could continue to activate and change the admin credentials, then reboot back into Windows and then login. There's that, or if you can boot into a Windows recovery environment, then you can do the classical 'ease of access' exploit. I'm new to forums so don't know the rules, so I was trying to be a bit more non-comittal regarding the specifics of how to actually hack/bypass the accounts, but, again, if the boot order is done properly and USB booting is disabled until needed (which I know many IT techs out there leave as default), then these vectors are mitigated.

Hi, I wanted to give my considerations for this as when I read it, I feel like there are other things that may not yet be implemented, but are of significant importance. 1. install bitlocker on laptops - if it gets stolen nobody can get data. is that right? Configuring Bitlocker alone will not achieve this. Bitlocker will encrypt the drive - that's true. But if you use the TPM to store the key, then whenever a user turns on the laptop, the TPM will unlock it and load the laptop to the Windows login screen. This is more convinient for the user, but you must make sure if you choose this route you password protect the BIOS and disable other boot options such as USB or PXE. Because if I got hold of a laptop which got to the login screen, I'd boot into a particular tool, enable the local admin account, whip the password off it and then reboot into Windows, log into the local admin account and then move laterally into your C:\users\ to find your files. [Source, I've done this before for folk] With this method, Bitlocker will only prompt for the recovery key if some of the hardware is changed, or the drive is taken from the laptop and put in a caddy/another machine to try and read. If you use a USB drive to unlock the laptop, then you should assume that the staff member will store that USB in the same laptop bag as the laptop. It's stupid, but they do it. If not 'they might loose it' - so there's some irony there. If you set an encryption password, then set it to a small sentence of random words. Don't use the traditional aOa8w&"£! nonsense becuase they're only going to write it on a post-it note and keep it with the laptop. A pass 'phrase' such as 'Housing delicate stewards.' would work better, allow them to remember it easier. They'll probably complain it's very long at first, but the reality is, they spend their days typing sentences and once it's engrained, it'll be something they never forget. In terms of managing Bitlocker recovery codes, the best way would be on Active Directory. In theory, you should have that locked down and secure and have more than 1 DC in play with backups. So using GPO, you can configure it to store those codes. It's very easy to do and there will be a guide or Youtube video demonstrating it. If not, and you're doing it all manually for some reason, store them in some vault like Keepass, don't use Excel. (again, I've seen this happen) They all log on with a local account on laptops Am I to setup bitlocker to encrypt the whole drive? will users be asked a secondary password during boot? In my opinion, whilst Bitlocker is a good thing to do, the guys in this thread are right, you have some other priorities first. 1. Remove admin rights to everyone that isn't you. If they need printers, remote support and install them. It takes 1 mistake to be completely ransomed. 2. Set BIOS passwords on every machine. 3. Look at the boot orders and remove anything you don't need. 4. Setup a test laptop and get that VPN working. 5. Make sure nobody is using a local account. 6. Similar to setting up Bitlocker, now look into LAPS. 7. Be happy in that you're now in a much better position. Maybe you have these in place already, maybe not, but I'd rather mention it than not. Hope it helps.