Implementing Disk Encryption With Bitlocker

Implementing Disk Encryption with BitLocker

When to Use

Use this skill when:

• Encrypting Windows endpoints to protect data at rest for compliance (PCI DSS, HIPAA, GDPR)
• Deploying BitLocker across enterprise fleet via Intune, SCCM, or GPO
• Configuring TPM-based encryption with PIN or USB startup key for enhanced security
• Managing BitLocker recovery keys in Active Directory or Azure AD

Do not use this skill for Linux disk encryption (use LUKS/dm-crypt) or macOS (use FileVault).

Common Misconfigurations & Verification

• TPM-only (no PIN): Enable-BitLocker -TpmProtector unlocks transparently and is exposed to cold-boot and DMA/"evil maid" attacks. Confirm laptops use TpmAndPin — (Get-BitLockerVolume C:).KeyProtector should list TpmPin, not just Tpm and RecoveryPassword.
• DMA / open ports: Thunderbolt/FireWire/M.2 DMA can read keys from RAM. Verify Kernel DMA Protection (msinfo32 → "Kernel DMA Protection: On") or the "Disable new DMA devices when this computer is locked" policy is set.
• Used Space Only on repurposed drives: leaves prior deleted data unencrypted in free space. Check manage-bde -status C: for Conversion Status: Used Space Only Encrypted on reused disks.
• Recovery key not escrowed: if a key was never backed up to AD/Azure AD, TPM failure means permanent data loss. Confirm escrow exists before relying on it.
• Verification: manage-bde -status C: must show Protection Status: Protection On, Percentage Encrypted: 100.0%, Encryption Method: XTS-AES 256. Protection On only appears after protectors are active — a drive can be 100% encrypted with protection suspended (manage-bde -protectors -get C: to confirm), which leaves the key in the clear.

Prerequisites

• Windows 10/11 Pro, Enterprise, or Education edition
• TPM 2.0 chip (recommended; TPM 1.2 supported with limitations)
• UEFI firmware with Secure Boot enabled (recommended)
• Separate system partition (200 MB minimum, created automatically by Windows installer)
• Active Directory or Azure AD for recovery key escrow

Workflow

Step 1: Verify TPM and System Requirements

# Check TPM status
Get-Tpm
# ManufacturerId, ManufacturerVersion, TpmPresent, TpmReady, TpmEnabled

# Check TPM version (2.0 required for best compatibility)
(Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm).SpecVersion

# Check UEFI/Secure Boot
Confirm-SecureBootUEFI
# Returns True if Secure Boot is enabled

# Check BitLocker readiness
$vol = Get-BitLockerVolume -MountPoint "C:"
$vol.VolumeStatus  # Should be "FullyDecrypted"
$vol.ProtectionStatus  # Should be "Off"

Step 2: Configure BitLocker GPO Settings

Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption

Operating System Drives:
  - Require additional authentication at startup: Enabled
    - Allow BitLocker without compatible TPM: Disabled (enforce TPM)
    - Configure TPM startup: Allow TPM
    - Configure TPM startup PIN: Allow startup PIN with TPM
    - Configure TPM startup key: Allow startup key with TPM

  - Choose how BitLocker-protected OS drives can be recovered: Enabled
    - Allow data recovery agent: True
    - Configure storage of recovery information to AD DS: Enabled
    - Save recovery info to AD DS for OS drives: Store recovery passwords and key packages
    - Do not enable BitLocker until recovery information is stored: Enabled

  - Choose drive encryption method and cipher strength:
    - OS drives: XTS-AES 256-bit (Windows 10 1511+)
    - Fixed drives: XTS-AES 256-bit
    - Removable drives: AES-CBC 256-bit (for cross-platform compatibility)

Fixed Data Drives:
  - Choose how BitLocker-protected fixed drives can be recovered: Enabled
    - Store recovery passwords in AD DS: Enabled

Removable Data Drives:
  - Control use of BitLocker on removable drives: Enabled
  - Configure use of passwords for removable drives: Require complexity

Step 3: Enable BitLocker - Command Line

# Enable BitLocker with TPM-only protector (transparent to user)
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 `
  -TpmProtector -SkipHardwareTest

# Enable BitLocker with TPM + PIN (recommended for laptops)
$pin = ConvertTo-SecureString "123456" -AsPlainText -Force
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 `
  -TpmAndPinProtector -Pin $pin

# Add recovery password protector
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

# Backup recovery key to Active Directory
Backup-BitLockerKeyProtector -MountPoint "C:" `
  -KeyProtectorId (Get-BitLockerVolume -MountPoint "C:").KeyProtector[1].KeyProtectorId

# Encrypt fixed data drives
Enable-BitLocker -MountPoint "D:" -EncryptionMethod XtsAes256 `
  -RecoveryPasswordProtector -AutoUnlockEnabled

Step 4: Deploy via Intune (Enterprise)

Intune → Endpoint Security → Disk encryption → Create Profile

Platform: Windows 10 and later
Profile: BitLocker

Settings:
  BitLocker base settings:
    - Encryption for operating system drives: Require
    - Encryption for fixed data drives: Require
    - Encryption for removable data drives: Require

  Operating system drive settings:
    - Additional authentication at startup: Require
    - TPM startup: Allowed
    - TPM startup PIN: Required (for high-security endpoints)
    - Encryption method: XTS-AES 256-bit
    - Recovery: Escrow to Azure AD

  Fixed drive settings:
    - Encryption method: XTS-AES 256-bit
    - Recovery: Escrow to Azure AD

  Assign to: All managed Windows devices (or specific groups)

Step 5: Manage Recovery Keys

# View recovery key on local system
(Get-BitLockerVolume -MountPoint "C:").KeyProtector |
  Where-Object {$_.KeyProtectorType -eq "RecoveryPassword"} |
  Select-Object KeyProtectorId, RecoveryPassword

# Retrieve recovery key from Active Directory (requires RSAT)
Get-ADObject -Filter {objectClass -eq "msFVE-RecoveryInformation"} `
  -SearchBase "CN=COMPUTER01,OU=Workstations,DC=corp,DC=example,DC=com" `
  -Properties msFVE-RecoveryPassword |
  Select-Object -ExpandProperty msFVE-RecoveryPassword

# Retrieve recovery key from Azure AD
# Azure Portal → Azure AD → Devices → [device] → BitLocker keys
# Or via Microsoft Graph API:
# GET /devices/{id}/bitlockerRecoveryKeys

Step 6: Monitor Encryption Status

# Check encryption status across fleet
manage-bde -status C:

# Expected output for encrypted drive:
#   Conversion Status: Fully Encrypted
#   Percentage Encrypted: 100.0%
#   Encryption Method: XTS-AES 256
#   Protection Status: Protection On
#   Key Protectors: TPM, Numerical Password

# PowerShell compliance check
$vol = Get-BitLockerVolume -MountPoint "C:"
if ($vol.ProtectionStatus -eq "On" -and $vol.VolumeStatus -eq "FullyEncrypted") {
    Write-Host "COMPLIANT: BitLocker enabled and fully encrypted"
} else {
    Write-Host "NON-COMPLIANT: BitLocker status - Protection: $($vol.ProtectionStatus), Volume: $($vol.VolumeStatus)"
}

Key Concepts

Tools & Systems

• BitLocker (built-in): Windows full disk encryption feature
• manage-bde.exe: Command-line BitLocker management tool
• BitLocker Recovery Password Viewer: RSAT tool for viewing recovery keys in Active Directory
• MBAM (Microsoft BitLocker Administration and Monitoring): Enterprise BitLocker management (legacy, replaced by Intune)
• Microsoft Intune: Cloud-based BitLocker policy deployment and recovery key management

Common Pitfalls

• Not escrowing recovery keys before encryption: If recovery keys are not saved to AD/Azure AD before encryption, they may be permanently lost if the TPM fails.
• Using TPM-only without PIN: TPM-only mode is transparent but vulnerable to cold boot attacks and evil maid attacks. Add a startup PIN for laptops leaving the office.
• Encrypting used space only on repurposed drives: If a drive previously contained sensitive data, "used space only" encryption leaves deleted data unencrypted in free space. Use full disk encryption for repurposed drives.
• Forgetting removable drives: USB drives and external disks are common data loss vectors. Enforce BitLocker To Go for removable media.
• No pre-provisioning for SCCM deployments: Pre-provision BitLocker during OSD task sequence to encrypt before OS deployment, avoiding the lengthy post-deployment encryption process.