BitLocker Countermeasures (Windows 10) – Windows security | Microsoft Docs
– Сьюзан нахмурилась. – Итак, вы полагаете, что Северная Дакота – реальное лицо. – Боюсь, что .
BitLocker automatic device encryption hardware requirements · The device contains a TPM (Trusted Platform Module), either TPM or TPM TPM is used in Windows 11 for a number of features, including Windows Hello for identity protection and BitLocker for data protection. BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or.
Any more feedback? The more you tell us the more we can help. Can you help us improve? Resolved my issue. Clear instructions. Easy to follow. No jargon. Pictures helped. Didn’t match my screen. Incorrect instructions. You would first create the startup key needed for BitLocker using the —protectors option and save it to the USB drive on E: and then begin the encryption process. You’ll need to reboot the computer when prompted to complete the encryption process.
It’s possible to encrypt the operating system volume without any defined protectors by using manage-bde. Use this command:. This will encrypt the drive using the TPM as the protector. If users are unsure of the protector for a volume, they can use the -protectors option in manage-bde to list this information by executing the following command:.
Another example is a user on a non-TPM hardware who wishes to add a password and SID-based protector to the operating system volume. In this instance, the user adds the protectors first. This is done with the command:. This command requires the user to enter and then confirm the password protectors before adding them to the volume.
With the protectors enabled on the volume, the user just needs to turn BitLocker on. Data volumes use the same syntax for encryption as operating system volumes but they don’t require protectors for the operation to complete. We recommend that you add at least one primary protector and a recovery protector to a data volume. A common protector for a data volume is the password protector.
In the example below, we add a password protector to the volume and turn on BitLocker. Windows PowerShell cmdlets provide an alternative way to work with BitLocker. Using Windows PowerShell’s scripting capabilities, administrators can integrate BitLocker options into existing scripts with ease. The list below displays the available BitLocker cmdlets. Similar to manage-bde, the Windows PowerShell cmdlets allow configuration beyond the options offered in the control panel.
As with manage-bde, users need to consider the specific needs of the volume they’re encrypting prior to running Windows PowerShell cmdlets. A good initial step is to determine the current state of the volume s on the computer. You can do this using the Get-BitLocker volume cmdlet.
The output from this cmdlet displays information on the volume type, protectors, protection status, and other useful information. Occasionally, all protectors may not be shown when using Get-BitLockerVolume due to lack of space in the output display.
If you don’t see all of the protectors for a volume, you can use the Windows PowerShell pipe command to format a listing of the protectors. In the event that there are more than four protectors for a volume, the pipe command may run out of display space.
For volumes with more than four protectors, use the method described in the section below to generate a listing of all protectors with protector ID. If you want to remove the existing protectors prior to provisioning BitLocker on the volume, you can utilize the Remove-BitLockerKeyProtector cmdlet. Accomplishing this requires the GUID associated with the protector to be removed.
A simple script can pipe out the values of each Get-BitLockerVolume return to another variable as seen below:. Using this information, we can then remove the key protector for a specific volume using the command:. Ensure the entire GUID, with braces, is included in the command. Using the BitLocker Windows PowerShell cmdlets is similar to working with the manage-bde tool for encrypting operating system volumes.
Windows PowerShell offers users a lot of flexibility. For example, users can add the desired protector as part command for encrypting the volume. Below are examples of common user scenarios and steps to accomplish them using the BitLocker cmdlets for Windows PowerShell.
The example below adds one additional protector, the StartupKey protectors, and chooses to skip the BitLocker hardware test.
In this example, encryption starts immediately without the need for a reboot. Data volume encryption using Windows PowerShell is the same as for operating system volumes. You should add the desired protectors prior to encrypting the volume. Last, encryption begins.
This protector can be added to both operating system and data volumes, although it doesn’t unlock operating system volumes in the pre-boot environment. The protector requires the SID for the domain account or group to link with the protector. BitLocker can protect a cluster-aware disk by adding an SID-based protector for the Cluster Name Object CNO that lets the disk properly failover and be unlocked to any member computer of the cluster.
For users who wish to use the SID for the account or group, the first step is to determine the SID associated with the account. This doesn’t require the use of additional features.
In the example below, the user wishes to add a domain SID-based protector to the previously encrypted operating system volume. The user knows the SID for the user account or group they wish to add and uses the following command:. To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet, Windows Explorer, manage-bde command-line tool, or Windows PowerShell cmdlets. Each option offers different levels of detail and ease of use.
We’ll look at each of the available methods in the following section. Checking BitLocker status with the control panel is the most common method used by most users. Once opened, the status for each volume is displayed next to the volume description and drive letter.
Available status return values with the control panel include:. If a drive is pre-provisioned with BitLocker, a status of “Waiting for Activation” displays with a yellow exclamation icon on the volume. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume isn’t in a protected state and needs to have a secure key added to the volume before the drive is fully protected. Once complete, the control panel will update to reflect the new status.
Using the control panel, administrators can choose Turn on BitLocker to start the BitLocker Drive Encryption wizard and add a protector, like PIN for an operating system volume or password if no TPM exists , or a password or smart card protector to a data volume. The drive security window displays prior to changing the volume status. Selecting Activate BitLocker will complete the encryption process.
Administrators who prefer a command-line interface can utilize manage-bde to check volume status. Manage-bde is capable of returning more information about the volume than the graphical user interface tools in the control panel. For example, manage-bde can display the BitLocker version in use, the encryption type, and the protectors associated with a volume. Jessica Shee is a senior tech editor at iBoysoft.
Throughout her 3 years of experience, Jessica has written many informative and instructional articles in data recovery, data security, and disk management to help a lot of readers secure their important documents and take the best advantage of their devices.
Updated on Wednesday, June 22, Written by Amanda Wong. Approved by Jessica Shee. Free Download. Amanda Wong Amanda is one of the main columnists at iBoysoft. Jessica Shee Jessica Shee is a senior tech editor at iBoysoft. Resources How to Tutorials Library News.