Chapter 11 – BitLocker Drive Encryption

-

 Windows Server Group Policy (GPO) Master Handbook

Chapter 11 – BitLocker Drive Encryption

Learning Objectives

Learn to deploy and manage BitLocker using Group Policy, TPM, recovery keys, Active Directory integration, and enterprise best practices.

1. Group Policy Path

Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption

2. What is BitLocker?

BitLocker encrypts operating system, fixed, and removable drives to protect data if a device is lost or stolen. It integrates with TPM and can automatically store recovery information in Active Directory or Microsoft Entra ID.

3. BitLocker Components

TPM, PIN, Startup Key (USB), Recovery Password, Recovery Key, Network Unlock, BitLocker Recovery Service.

4. Drive Types

Operating System Drives, Fixed Data Drives, and Removable Data Drives (BitLocker To Go). Configure each independently through Group Policy.

5. TPM Requirements

TPM 2.0 is recommended. Configure policies to require TPM only, TPM+PIN, TPM+Startup Key, or TPM+PIN+Startup Key based on organizational security requirements.

6. Recovery Key Management

Configure 'Choose how BitLocker-protected operating system drives can be recovered' to back up recovery passwords and key packages to Active Directory before encryption starts.

7. Enterprise Recommended Settings

Use XTS-AES 256 where organizational policy requires it, require TPM, store recovery keys in Active Directory or Microsoft Entra ID, prevent users from skipping recovery key backup, and encrypt used space only for new devices when appropriate.

8. PowerShell Commands

Get-BitLockerVolume
Enable-BitLocker
Disable-BitLocker
Backup-BitLockerKeyProtector
Manage-bde -status
Manage-bde -protectors -get C:

9. Troubleshooting

Verify TPM is initialized (tpm.msc), confirm the BitLocker Drive Encryption Service is running, check recovery key backup, review Event Viewer, verify GPO application using gpresult /h, and use manage-bde -status to confirm encryption state.

10. Best Practices

Back up recovery keys before enabling encryption, test on pilot devices, document recovery procedures, encrypt all portable devices, and monitor compliance.

11. Interview Questions

What is BitLocker? Difference between TPM and TPM+PIN? What is BitLocker To Go? How do you recover a BitLocker-protected drive? How do you verify BitLocker status?

12. Practical Lab

Create a BitLocker GPO, require TPM, configure recovery key backup to Active Directory, enable BitLocker on a test machine, run gpupdate /force, verify encryption with Get-BitLockerVolume and confirm recovery key storage.

Common BitLocker Policies

Policy

Recommended

Purpose

Require additional authentication at startup

Enabled

Configure TPM/PIN

Store recovery information in AD DS

Enabled

Centralized recovery

Choose drive encryption method

XTS-AES 256 (per policy)

Encryption strength

Allow BitLocker without compatible TPM

Disabled (unless required)

Security

Deny write access to removable drives not protected

Enabled

Protect USB media

BitLocker To Go

Enabled

Encrypt removable drives

Recovery password

48-digit

Emergency recovery

Microsoft Learn References

BitLocker Overview

BitLocker Group Policy Settings

BitLocker PowerShell

BitLocker Recovery

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more