Windows 10: Bitlocker with TPM and Offline Password Editor

Hi,

If I enable Bitlocker with TPM (i.e. no passcode required on boot-up), and I have the Local Administrator account enabled on the machine (with my normal user account as a standard account), would it be possible for someone with a Hirens Boot CD blank/reset the Local Administrator account password and then gain access to the PC/Laptop using a tool such as this: Offline Windows Password & Registry Editor

Should I be enabling the PIN/Password protection on BitLocker, or does BitLocker prevent these sorts of tools from being used?

Thanks,

Gary

:)

 

remove bitlocker encryption

Hi Leon,

I use a password to unlock the drive. You shouldn't have to use the recovery key to get in each time.

That's what the Trusted Platform Module (TPM) device does is to store the encryption key for you so you don't have to enter anything. Do you have a TPM on your motherboard?

I don't have any TPM on my computers so I just followed this article to enable Bitlocker in the Local Group Policy Editor and then I selected to use the password option:

How to Use BitLocker Without a Trusted Platform Module (TPM)

How to Set Up BitLocker Encryption on Windows

 

Bitlocker on my newer model laptop with TPM chip

I am sorry but the link that you provided was of no use. My bitlocker is apparently working as it should on this Samsung S9 laptop which has a TPM chip, but no TPM module. I took it to a computer shop to discover that the module is missing. We also turned
off bitlocker and the laptop decrypted in about 20 minutes. That is fast considering that there is 80GB+ data on its SSD hard drive.

I am no happy that my laptop boots up directly to the Windows password screen. I need it to boot up the the bitlocker password screen first.

Do I possibly need to change the settings on my TPM chip equipped (but not TPM module equipped) laptop as I did on my desktop PCs that do not have TPM chips? On those I changed the settings to authenticate without TPM.

Please help me figure out how to make my laptop boot to the bitlocker password screen before proceeding to the Windows password screen.

 

No. If the boot order is changed then it will prompt for your bitlocker password (the really long 25 digit one).

Secondly even if your bios was set to boot USB first the drive is encrypted so you couldn't do anything with it anyway without unlocking it first. I don't think Hirens has bitlocker support (only TrueCrypt) but even if you have bitlocker support you still need to unlock the drive.

Some boot USBs can unlock bitlocker drives automatically (like Adding BitLocker support to Windows PE - KnowledgeBase - Macrium Reflect Knowledgebase) but you would have to make a conscious decision to do this and leave the USB where you saved the keys plugged in.