Search the Community

Morning All, hope you are all well and having a great day, as they say now watch some lousy "bar5teward" mess it up.... well not sure if you have seen this but Microsoft BitLocker has been hacked, http://arstechnica.com/information-technology/2009/12/first-commercial-tool-cracks-bitlocker/ "sorry " Andy

Hi All, Trying to just get some info before I give this a go my self as it could be a huge waste of time. Can you have Mac OS running VirtualBox or similar, with a Windows 10 VM on which is a domain pc with direct access, will it work? My reasoning for looking into this is with GDPR coming in and everything portable needing encrypting on our network, FileVault sorts out the mac side but i'm struggling to bitlocker the windows side too without breaking the mac side. Second question leading on from that would actually be, can you have mac with bootcamp'ed Windows 10 with filevault and bitlocker both running? Thanks Ross

Hello Edugeekers, I am having an issue with getting Bitlocker to run and encrypt the drive during a a Windows 10 deployment. I am using UI++ with what appears to be the correct script lines; "%ZZBitLocker%". Also have 'Bitlocker enabled' as a part of the SCCM deployment, but cannot get anywhere with it. All help appreciated Thanks, Dan

Hi all. I am currently having some problems configuring a forced Bitlocker USB encryption policy. On the GPO, I have set 'Deny write access to removable drives not protected by BitLocker' to enabled (computer side) which is working correctly, and does require the user to encrypt their drive before using it. However, I am looking for a way to set this policy so that staff are required to encrypt their memory sticks, but students do not need to and can use them freely. I can't see anything on the user side of the policy, does anyone know of a way to do this or has set something similar before? Thanks in advance!

First commercial tool to crack BitLocker arrives (Updated) Source: Ars Technica

There seems to be a bit of publicity about issues surrounding the encryption of laptop data present. Is this something that we should be applying to teacher's laptops if they are taken out of school? If so, is there a way of encrypting data using native Windows tools or does it require third party software? I don't know much about it but presumably the principle is to store the data in such a way that if the laptop is stolen, the contents of the hard drive cannot be retrieved and read?

Hello, I'm in the process of creating a GPO to save BitLocker and TPM information to AD but am having a problem with the TPM options. I can see the Turn on TPM backup to Active Directory Domain Services which I have enabled but I don't see the Require TPM backup to AD DS checkbox in the options pane. My DC is on a Server 2012 server. The account I'm using is in the Domain Admins and Schema Admins group. I have run the Add-TPMSelfWriteACE script which appeared to run correctly. Any ideas why I'm not seeing the checkbox?

Does it really stand for Unfathomably Evil F* Idea? Got some new SSD laptops that will take an image deployed via WDS using legacy with no problem. Unfortunately it seems like I can't use Bitlocker with them unless they're UEFI. So I've reset the BIOS, used the UEFI Deploy boot image I created so long ago that I can't remember why it's different, found out I'm missing some partitioning lines from my unattend.xml which I've corrected (I think), and I still get this error message when it tries to install the image: Windows could not set a partition active on disk 0. The target disk, partition or Volume does not support the specified operation. The error occurred while applying the unattend answer file's setting. Error code: 0x80500024. Googling finds suggestions to remove other disks (there aren't any). Anyone got any ideas? I may just use Veracrypt...

Hi, Anyone followed the MS guide to Network Unlock configuration? Just running through this now https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock#bkmk-stepfour I am up to the step on my WDS server adding the cert.I select the relevant cert to create and it prompts me for more details. The details are under the subject Tab. I tried using the recommended title but it receive the error "dn the string contains an invalid x500 name attribute key oid value or delimiter". There are no strange characters, and I have also tried without spaces....any ideas?Bi

Dear community, I'm struggling to get Bitlocker working on my HP ProBook 4340s under Win 10 pro (64bit). setup: - no TPM module present, but changes made to group policy editor to have Bitlocker working without. - Windows is newly installed on SSD (crucial MX500 250GB) from UEFI USB Windows setup stick, then updated to 20H2(ok, some settings made with OOShutUp against Microsoft spying, that's all) - Partitions have been created as standard during install: a) 100 MB EFI System b) 232,26GB NTFS Boot and Basic Data c) 521 MB NTFS recovery as the Bitlocker option to 'activate' is presented to me this should be ok, otherwise it would complain about wrong partitions, right? - BIOS set to 'native UEFI' (no CSM) and 'secure boot', I heard that this is mandatory to have Bitlocker working (BIOS ver. F.68 04/11/2019) Problem: After activating Bitlocker for C: (the only available anyway) and the necessary reboot, Windows loads normally and gives me the error "BitLocker could not be enabled. The data drive specified is not set to automatically unlock on the current computer and cannot be unlocked automatically. C: was not encrypted." This message is obviously a result of the pre-encryption 'Bitlocker system check'. (that check for automatic decryption fails, regardless whether I choose USB-stick or password as unlocking method) It must have something to do with the startup-sequence, some wrong BIOS settings... but I couldn't figure out which. Toggling 'secure boot' on or off makes no difference. (one guy here recommended turning it off in his special case) other people on the web suspect the mistake in some USB settings, but I tried all available settings (and after all, I don't insist on unlocking via USB, would be nice though) and with even others the problem disappeared by itself and they don't know why... The craziest thing is that it showed me the password-entry-screen ONE time. (unfortunately, at that time I had to quit with escape because I wanted to save the recovery key before it starts encryption) I could never make this screen appear again since then! Somebody out there who is familiar with such machine behavior? :-) Any helpful comment greatly appreciated!

Hi, I have been asked in school to make sure all portable devices that come into school are bitlocker enabled for security which is fine. However I am having an issue with SD cards. IF the sd card is bitlockered then the camera will not use it but with the SD card not being bitlockered the user cannot delete photos from the card on a laptop to clear unwanted photos. Does any one know of a way around this? Thanks.

Just need a quick sanity check on this... - staff PCs, old Stone kit (Intel and MSI motherboards) - no TPM on either motherboard - machines are shared between multiple users Although Bitlocker can in theory be deployed using the USB stick or boot password method is it reasonable to say that's not a feasible method for the scenario above? My thinking being either the USB would stay in the whole time (which defeats the object of it) and similar for password (plus the inevitable glut of helpdesk queries when it gets lost) and realistically for staff machines we simply need to replace the (5-7 year old) hardware with something with TPM support.

I have a question about how Bitlocker works, specifically on Windows 10. There is enough on the internet to explain the basics but I'm struggling to find really clear answers on the below... Would really appreciate any advice you guys can give! I recently decided to protect the single (SSD) hard drive in my Windows 10 laptop with Bitlocker. I have a TPM (Trusted Platform Module), so chose that option, the setup & encyption process was simple enough, and I've not had any problems with it since. I understand the basics of how the TPM module works, checking key OS files/configuration parameters etc. are unchanged before releasing the keys to decrypt the rest of the drive/complete the boot into Windows. I understand how this then protects the data on the hard drive if it's ever removed from my laptop. My understanding is that the TPM decrypts just enough to allow Windows to boot and prompt you for a password, and entering this then decrypts the remainder of the drive... so does this mean the data on the Bitlocker protected drive is then only protected by my Windows password if the whole laptop is stolen? Does using a fingerprint or some other method make any difference? Secondly, on my laptop, I realised my wife's own user account actually had no password set when I enabled Bitlocker, so in this case, there would have been no protection of my data at all if the entire laptop had been stolen!? I've since made her set a password, but due to my lack of understanding of the previous, I now I have lingering doubts about whether this might have compromised my Bitlocker setup & effectiveness.

Hello Guys, Wondering if anyone can help me out. I need to implement BitLocker on some of our Staff Laptops who take them offsite. We have an RM CC4 Network, and the laptops which BitLocker will be on are HP ProBook 450's G5s, and they do have TPM 2.0 support. I have created a GPO on the CC4 Server and applied it to these laptops, and the GPO sets the authentication options to use the TPM and a PIN. Here are the steps I have done. 1. Built the laptop onto CC4, with UEFI and Secure Boot Enabled. 2. After the build, gone into the BIOS and enabled the TPM. (Have to disable it first otherwise Windows 10 machines fail to build on CC4 as per the tech article on the RM website). 3. Logged onto the machine in question, and enabled BitLocker. I put in the users desired PIN, and backup the recovery key. 4. I reboot the machine after the encryption, and this is where I have issues. So, it reboots and I am presented with the screen to enter the users PIN, looks good so far, but I put the PIN in and it just goes straight to the recovery screen asking for the recovery key. If I reboot the machine again, and put in a wrong PIN on purpose, it does tell me the PIN is wrong so I know the PIN is right. Anyways, I do what it asks and type in the Recovery key, but it tells me every time it is invalid! I keep having to rebuild the machine, to get it to boot again. Can anyone tell me if I am missing anything? I have spent 2 days on this now, and I am really stuck. I have asked RM, and they have told me it is not as yet supported on CC4, however they have customers who have successfully implemented this themselves. Many Thanks James

I want to deploy BitLocker onto our laptops when I perform the Windows 7 deployment to them. Has anybody done this with SCCM? The problem I have at the moment is this... I have a task sequence which creates a system partition and a Windows partition. These are then named C: and D: leaving the optical drive as E: - something that my users will struggle to comprehend. What I want to do is deploy Windows like the setup media does (with a hidden 100MB partition). From my Internet readings, I've seen lots of people suffering from my problem with the standard task sequence operations and I've seen people changing the 'extra' drive letter to something like Q: or O: but I don't really like this option either.

Hi, I wonder if someone can help... We have been trying to have a computer policy which is only applied to certain users, i'm sure it not possible but thought i'd ask anyway. We are trying to lock down computers so USB sticks can only be used by staff that are protected via BitLocker. but we want it so students can use memory sticks without protection. Its a computer policy so I know the simplest solution would be to set it at the top of the staff computer OU and apply it down the tree, but if staff find out they can user non-protected memory sticks on student computers it kind of ruins the idea. We have tried the delegation, by giving students "deny" permissions but no luck, we have also tried enabling loopback but no luck either. Its the head of ICT that wants to apply this, so may have to say its for everyone or no-one! Cheers, Tom

Hello, Wondering if anyone could help. I'm trying to configure Bitlocker on windows 7 enterprise (domain joined machines) without TPM. I've set the 'require additional information' GPO and various password complexity ones. However, the only open I get when I turn bitlocker on for a system drive is Require a Startup key at every startup. Is it possible, and how would I configure it to require a password/pin to unlock the drive rather than a usb memory stick? I've read various articles online about how to do it, but I don't get the options they show. Hoping someone can help. Thanks Pete.