Windows 10: Guidance for configuring BitLocker to enforce software encryption

Brink · Nov 6, 2018

Microsoft is aware of reports of vulnerabilities in the hardware encryption of certain self-encrypting drives (SEDs). Customers concerned about this issue should consider using the software only encryption provided by BitLocker Drive Encryption™. On Windows computers with self-encrypting drives, BitLocker Drive Encryption™ manages encryption and will use hardware encryption by default. Administrators who want to force software encryption on computers with self-encrypting drives can accomplish this by deploying a Group Policy to override the default behavior. Windows will consult Group Policy to enforce software encryption only at the time of enabling BitLocker.

To check the type of drive encryption being used (hardware or software):

Run ‘manage-bde.exe -status’ from elevated command prompt.

If none of the drives listed report "Hardware Encryption" for the Encryption Method field, then this device is using software encryption and is not affected by vulnerabilities associated with self-encrypting drive encryption.

For drives that are encrypted using a vulnerable form of hardware encryption, you can mitigate the vulnerability by switching to software encryption using Bitlocker with a Group Policy.

Note: After a drive has been encrypted using hardware encryption, switching to software encryption on that drive will require that the drive be unencrypted first and then re-encrypted using software encryption. If you are using BitLocker Drive Encryption, changing the Group Policy value to enforce software encryption alone is not sufficient to re-encrypt existing data.

IMPORTANT: You do NOT need to reformat the drive or reinstall any applications after changing BitLocker settings.

To mitigate vulnerabilities associated with self-encrypting drives on Windows systems:

Configure and deploy a Group Policy to enable forced software encryption.

Fully turn off BitLocker to decrypt the drive.

Enable BitLocker again.

For more information on Bitlocker and Group Policy settings to enforce software encryption:

Bitlocker Overview

BitLocker Device Encryption in Windows 10

BitLocker frequently asked questions (FAQ)

Bitlocker and Encrypted Hard Drives

Encrypted Hard Drive Device Guide

BitLocker Group Policy Settings

Security Updates

The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see the Microsoft Support Lifecycle.

Product Platform Article Download Impact Severity Supersedence Windows 10 for 32-bit Systems None None Windows 10 for x64-based Systems None None Windows 10 Version 1607 for 32-bit Systems None None Windows 10 Version 1607 for x64-based Systems None None Windows 10 Version 1703 for 32-bit Systems None None Windows 10 Version 1703 for x64-based Systems None None Windows 10 Version 1709 for 32-bit Systems None None Windows 10 Version 1709 for 64-based Systems None None Windows 10 Version 1709 for ARM64-based Systems None None Windows 10 Version 1803 for 32-bit Systems None None Windows 10 Version 1803 for ARM64-based Systems None None Windows 10 Version 1803 for x64-based Systems None None Windows 10 Version 1809 for 32-bit Systems None None Windows 10 Version 1809 for ARM64-based Systems None None Windows 10 Version 1809 for x64-based Systems None None Windows 8.1 for 32-bit systems None None Windows 8.1 for x64-based systems None None Windows RT 8.1 None None Windows Server 2012 None None Windows Server 2012 (Server Core installation) None None Windows Server 2012 R2 None None Windows Server 2012 R2 (Server Core installation) None None Windows Server 2016 None None Windows Server 2016 (Server Core installation) None None Windows Server 2019 None None Windows Server 2019 (Server Core installation) None None Windows Server, version 1709 (Server Core Installation) None None Windows Server, version 1803 (Server Core Installation) None None
Mitigations

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

Microsoft has not identified any workarounds for this vulnerability.

Acknowledgements

See acknowledgements for more information.

Disclaimer

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

Revisions

Version Date Description 1.0 11/06/2018 Information published.
Click to expand...

Source: https://portal.msrc.microsoft.com/en...sory/ADV180028

:)

Aswin_Anand · Nov 6, 2018

BitLocker Encrypted Hard Drive to MAC

Hi,

Thank you for posting your query in Microsoft Community. I regret the inconvenience caused to you. Let me help you.

I suggest you to perform below mentioned steps to disable BitLocker.

To disable BitLocker I would suggest you try the following steps and see if it helps.

Press Windows key + X and click on
Control Panel.

Change View by from Category
to Large Icons/Small Icons.

Click on BitLocker Drive Encryption and click on
Turn BitLocker Off.

Follow on screen instructions. Click on Decrypt the Drive
when the message appears.

I would suggest you click on the link below and refer the following article.

Scenario 12: Turning Off BitLocker Drive Encryption (Windows 7)

Scenario 12: Turning Off BitLocker Drive Encryption (Windows 7)

(You can refer the steps in the above link as they are applicable for Windows 10 as well)

Check if it helps.

I hope the information helps. Please keep us posted on the issue. We will be happy to assist you accordingly.

Thank you.

Yashwanth Kotakuri · Nov 6, 2018

Device Encryption not avaiable

Hello Fraczek,

Thank you for contacting Microsoft Community.

We understand your concern in this regard.

Are you referring to BitLocker Drive Encryption?

What preventing you from doing this?

Did you get any error message or code while doing this?

Before you come up with the above information, suggest you to refer the article

Help protect your files using BitLocker Drive Encryption and see if it help you.

Do refer the article
Windows BitLocker Drive Encryption Step-by-Step Guide and check if it help you with the required information.

Keep us posted if you require further assistance.

Ernie San · Nov 6, 2018

Bitlocker

Thank you for the clarification. You may do an additional configuration of BitLocker, to do so check the article about
Windows 10 with BitLocker Drive Encryption, find and follow the Step-by-Step Configuration
in the same link.

Let us know the result.

Windows 10: Guidance for configuring BitLocker to enforce software encryption

Guidance for configuring BitLocker to enforce software encryption

Guidance for configuring BitLocker to enforce software encryption

Guidance for configuring BitLocker to enforce software encryption

Guidance for configuring BitLocker to enforce software encryption - Similar Threads - Guidance configuring BitLocker

Reset drive while enforcing bitlocker encryption

Reset drive while enforcing bitlocker encryption

Bitlocker encryption

Encryption Software

BitLocker encryption missing PIN configuration

Guidance on Bitlocker Encryption setup - Removable USB Flash Drives

Guidance on Bitlocker Encryption setup - Removable USB Flash Drives

Windows guidance for Bluetooth key length enforcement

Encryption software