Windows 10: How is the TPM involved when encrypting system drives with BitLocker?

Let's say I encrypt my laptop's hard drive with BitLocker and the protectors set are a numerical password (so the recovery key that I can access at aka.ms/myrecoverykey) and a TPM & PIN (so when I start the laptop to get into Windows it needs to recognize the TPM and I need to enter a PIN/password to unlock the drive and boot Windows).

Now let's say my laptop is having problems and I can't get it to start up but I want to get the data off the drive. So I pull the drive and connect it to another computer...but remember how one of the protectors was the TPM and the PIN? I can't just enter that PIN to unlock it. It needs the TPM to be present, too. But I should be able to enter my recovery key and the drive will unlock without the TPM being present, right?

TL;DR: if a drive is encrypted with BitLocker and the protectors are the TPM and a PIN (both required at the same time) or a recovery key I can plug the drive into another computer and enter the recovery key to unlock it without the TPM being present, right?

submitted by /u/FloatingMilkshake
[link] [comments]

:)

 

How to Use Bitlocker on Only Non System Drive and without TPM


I want to use Bitlocker on my Non System E Drive without TPM. I read somewhere to do the following for without TPM:

" Under Local Computer Policy navigate to Computer Configuration \ Administrative Templates \ Windows Components \ Bit Locker Drive Encryption \ Operating System Drives and double click on Require additional authentication at startup." and so on.

but I am confused because the above note is mentioning "Operating System Drives " wherein I want to turn on Bitlocker on Non System Drive.

Can we turn bitlocker "on" on Non System Drives without turning it "on" on System Drives and Can we turn it "on" on
a Single Folder instead of Drive.

Please advise step by step.

 

Bitlocker with TPM installed

Hi! I was able to encrypt my system drive with bitlocker with TPM.

Now I'm trying to use bitlocker to my other data drives but bitlocker can't use TPM.

Any help?

 

Bitlocker without TPM

Hi there,

I'm trying to use Bitlocker without TPM

My version is Windows 10 Home, and I try to follow -

To turn on BitLocker Drive Encryption on a computer without a compatible TPM

1. Click Start, type gpedit.mscin the Start Search box, and then press ENTER.
2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
3. In the Local Group Policy Editor console tree, click Local Computer Policy, click Administrative Templates, click Windows Components, and then clickBitLocker Drive Encryption.
4. Double-click the setting Control Panel Setup: Enable Advanced Startup Options.
5. Select the Enabled option, select the Allow BitLocker without a compatible TPM check box, and then click OK.

You have changed the policy setting so that you can use a startup key instead of a TPM.

1. Close the Local Group Policy Editor.
2. To force Group Policy to apply immediately, you can click Start, typegpupdate.exe /forcein the Start Search box, and then press ENTER.
3. Click Start, click Control Panel, click Security, and then click BitLocker Drive Encryption.
4. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
5. On the BitLocker Drive Encryption page, click Turn On BitLocker. This will only appear with the operating system volume.
6. On the Set BitLocker Startup Preferences page, select the Require Startup USB Key at every startup option. This is the only option available for non-TPM configurations. This key must be inserted each time before you start
   the computer.
7. Insert your USB flash drive in the computer, if it is not already there.
8. On the Save your Startup Key page, choose the location of your USB flash drive, and then click Save.
9. On the Save the recovery password page, you will see the following options:

· Save the password on a USB drive. Saves the password to a USB flash drive.

· Save the password in a folder. Saves the password to a folder on a network drive or other location.

· Print the password. Prints the password

While I have a problem on step 4.

Double-click the setting Control Panel Setup: Enable Advanced Startup Options.

I can find "BitLocker Drive Encryption" on my group policy editor, while I cannot find
Control Panel Setup: Enable Advanced Startup Options anywhere.

Thank you for your help.

Best Regards,

Yan