Windows 10: Enable password option to usb key bitlocker protected ssd

I have my SSD OS with bitlocker enabled without compatible TPM using USB key where when I boot the PC I need to insert the USB key.I want to add the password opinion, so I will be able to either insert the password or plug the USB key.Any idea how to do that?Thanks

:)

 

Use USB as a password/key

You ask if there is a way to prevent bootup unless a USB Key is plugged in. This is possible, and it helps protect your data if your harddrive/computer is stolen.

However, you also mentioned that you want the USB Key to prevent someone with remote access to your computer from logging in. This second part to your question doesn't really make any sense. If someone has remote access to your system, it assumes that the system is already booted. In which case, the USB Key required for booting is of no relevance.

Perhaps what you are really asking is if there is a way to disable Remote Access, or if there is a way to only enable Remote Access when certain conditions are met (e.g. if a USB Key is inserted). One way to do this is to write a script. For now, in this answer, I will just show you how to require a USB Key to boot up to Windows.

I am assuming you do not have a TPM (Trusted Platform Module). Most people don't have this in their PCs. If you do have a TPM, you can probably skip step 1 to 4. If you don't know whether or not you have a TPM, you should just perform step 1 to 4. Even if you do have TPM, performing those steps shouldn't be of any harm.

Attached at the end of the answer are a few images relevant to the steps.

1. Open Group Policy Editor. Do this by searching gpedt.msc in Windows Search.
   
2. Navigate to Computer Configuration/Administrative Templates/Windows Components/BitLocker Drive Encryption/Operating System Drives.
   
3. Double Click Require Additional Authentication at Startup.
   
4. Select Enable and make sure Allow BitLocker without a... is checked.
   
5. Open BitLocker settings by searching Manage BitLocker.
   
6. Select your Boot Drive (Usually, it is C and click Turn on BitLocker.
   
7. Insert your USB Key, and follow the steps of the prompt.
   

When finished, you will be required to insert your USB Key every time you boot up the Computer in order for it to boot into Windows. In addition, if your Hard Drive or Computer is stolen, and the thief does not have your USB Key, your data will be protected.

Below are some relavent images. The first one is for Step 2 and 3. The second one is for Step 4.

Step 2 and 3 Reference




Step 4 Reference

 

extend bitlocker protection with pin, usb pen drive, or TPM

Hi, I was reading elsewhere, and not covered by this guide, that I could extend bitlocker protection with a pin and even an usb pen drive in addition to the key stored in the tpm. Is there a simple step by the step guide that shows you how to do this correctly? I was briefly looking at different settings in the local group policy editor and found some relevant options, however, I don't want to try to turn it on without having some guidance. Thank-you.

 

Clone Bitlocker enable drive to SSD

ok so to clarify. I need to disable bitlocker, clone my drive, and then re-enable bitlocker on the ssd?

and the recovery key should stay the same.