Windows 10: Windows Boot-up security & Logging

I'm trying to research into more ways of locking company devices down. From the worst case if they were ever stolen it would be hard for your average Jo to access anything and general access on day to day usage/privacy.

Currently using Bitlocker 256 on all HDD's.

Few questions:

1. I have a PC with 3 HDD's, can I password the D:\ and the G:\ to keep stored data separate. So if i walk away from the PC for a few minutes and don't Windows+L the drives are not accessed without a Password.

2. Boot-up, we have Pin's to access our logons. Is there any additional security we can add already built into 10 e.g 2 Step authentication.

3. Many years ago I used to have a flash drive with a few XP boot files on so if the drive was not in the PC it wouldn't boot. Is this a thing anymore, can you make a "Key" to access your Laptop/PC. Hopefully not the old way of moving files but something on the lines of a hashkey 10 looks for before booting passed Bios.

Regards,

MrColletive

:)

 

How to fix Kernel Security Check Failure?

Ok now my pc will boot up to the log in screen, then BSOD (Kernel Security Failure) and restart.

 

BOOT MENU LOGGING IN WINDOWS 10

Fast startup features in win-10 usually makes it pretty tough to get to the bios or boot menu

Shut down

As soon as you press the power button start tapping the F8 key continuously for newer machines.

Ultimately you need to go to Power options by using Winkey+X or right click the start button,

On the top left click on Change what the power button does,

Then click on the link top center paragraph Change settings currently unavailable

Uncheck Use fast startup (recommended)

There is no significant reason to use fast startup all it does is make things tougher to correct if having issues to access the bios.

I'd also disable fast or quick startup in the bios.

Now you can use Winkey+X uu or Power button and shutdown

Then power up and use the tapping F8 on power up.

 

1. Once the drives are unlocked in Windows with BitLocker they do not automatically re-lock - you need to educate your users to lock their workstations before leaving them or set the screensaver to come on after XX amount of time and enable the lock screen from that point.

2. You can set BitLocker to unlock with a USB "Token" - other than that there are plenty of third-party things available - for example I use: Two-Factor Authentication (2FA) Solutions | Secure Access | SafeNet


3. As per 2