Windows 10: Query related to using BitLocker and TPM on PC

Questions about bit-locker and TPM-security for latest windows 10 version 1909 and up or lower.

I’m looking on the web some answer confuse more then it resolves anything.

and i want something to easely fall back for myself and other people

1 Do you require to clear TPM and take ownership of TPM?

a In which versions of windows ?

b What about other versions of windows ?

2 What are the group policy that need to be enabled for bit-locker

a How does each policy need to be configured for use with

i TPM ?

ii Without TPM ?

iii PIN or password ?

iv USB Startup -key?

v Use of both pin and startup-key?

3 When creating USB startup and/or recovery key which format is best used in situation:

a Use with only windows? NTFS, FAT, EXFat, FAT32. Why?

b Use with mac and windows? NTFS, FAT, EXFat, FAT32. Why?

c Can startup key fungate as recovery key? If not why not?

4 How do you enable bit-locker: with settings

a Use of pin only?

b Use of USB startup-key?

c Use of pin and startup-key?



***Original title: Bitlocker and TPM-Security***

:)

 

FingerPrint With TPM and Bitlocker

I want to use fingerprint as bitlocker/TPM's password/PIN. Please Guide me step by step

[Moved from: Windows / Windows 10 / Windows settings]

 

Bitlocker without TPM

Hi there,

I'm trying to use Bitlocker without TPM

My version is Windows 10 Home, and I try to follow -

To turn on BitLocker Drive Encryption on a computer without a compatible TPM

1. Click Start, type gpedit.mscin the Start Search box, and then press ENTER.
2. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
3. In the Local Group Policy Editor console tree, click Local Computer Policy, click Administrative Templates, click Windows Components, and then clickBitLocker Drive Encryption.
4. Double-click the setting Control Panel Setup: Enable Advanced Startup Options.
5. Select the Enabled option, select the Allow BitLocker without a compatible TPM check box, and then click OK.

You have changed the policy setting so that you can use a startup key instead of a TPM.

1. Close the Local Group Policy Editor.
2. To force Group Policy to apply immediately, you can click Start, typegpupdate.exe /forcein the Start Search box, and then press ENTER.
3. Click Start, click Control Panel, click Security, and then click BitLocker Drive Encryption.
4. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
5. On the BitLocker Drive Encryption page, click Turn On BitLocker. This will only appear with the operating system volume.
6. On the Set BitLocker Startup Preferences page, select the Require Startup USB Key at every startup option. This is the only option available for non-TPM configurations. This key must be inserted each time before you start
   the computer.
7. Insert your USB flash drive in the computer, if it is not already there.
8. On the Save your Startup Key page, choose the location of your USB flash drive, and then click Save.
9. On the Save the recovery password page, you will see the following options:

· Save the password on a USB drive. Saves the password to a USB flash drive.

· Save the password in a folder. Saves the password to a folder on a network drive or other location.

· Print the password. Prints the password

While I have a problem on step 4.

Double-click the setting Control Panel Setup: Enable Advanced Startup Options.

I can find "BitLocker Drive Encryption" on my group policy editor, while I cannot find
Control Panel Setup: Enable Advanced Startup Options anywhere.

Thank you for your help.

Best Regards,

Yan

 

Bitlocker in Windows 10 without TPM

As others here, I have my Win8.1 C: drive encrypted without a TPM and with a password. I am still unsure whether to upgrade to Win10. Your posts:

• Told how to enable Bitlocker on Windows 10
• Seemed limited to the BETA version of Windows 10

QUESTIONS:

• Can I simply upgrade to Win10 without decrypting my C: drive AND still use the same password on Bitlocker?
• Can you confirm that Bitlocker WILL NOT revert to the default Bitlocker settings during the upgrade?
• Will everything work as in your post on the production Win10 upgrade as on the trial versions?

Having to worry about losing a thumbdrive makes me quite uneasy--especially on the road. In the event of theft, the thumbdrive would likely be with the laptop; thus, obviating the reason for using Bitlocker in the first place.

The following points have given me concerns about upgrading to Win10:

From the Win10 Specifications Page:

•BitLocker To Go requires a USB flash drive (Windows 10 Pro only).

•BitLocker requires either Trusted Platform Module (TPM) 1.2, TPM 2.0 or a

USB flash drive (Windows 10 Pro and Windows 10 Enterprise only).

Did the post "kennethrallen replied on August 1, 2015S, See post history" relate to a removable drive; did Win10 incorrectly interpret the drive as removable because it was encrypted; or was the problem apparently something else?

Thanks

DJ