BitLocker, How To Protect Data On Hard Drives And SSDs And Ask For A Password At Startup

Design BitLocker on TPM-empowered frameworks to incite for a PIN when you turn on the machine. In the GDPR period, BitLocker ought to be an apparatus generally utilized on your Windows 10 notepads and convertibles to safeguard the information put away on similar gadgets successfully.

What’s more, this is whether or not SSDs or customary hard drives are utilized on their machines. We have committed two top-to-bottom articles to BitLocker: BitLocker, what it is, how it works, and why it ought to be initiated according to a GDPR point of view, and BitLocker, how key recuperation and USB opening work.

In the first place, we made sense of what BitLocker is and the way that it works (which, we remind you, permits you to scramble the items in all capacity units, including the framework one, in Windows 10 Ace, Venture, and Training yet isn’t accessible in the Home version of the working framework); in the subsequent, we figured out how it is possible to design a USB stick to be utilized for opening the framework safeguarded with BitLocker. As such, if you don’t embed the USB stick designed for use with BitLocker while booting Windows 10, the framework won’t boot, and all information will remain scrambled.

Focus on USB sticks and removable drives is great, particularly assuming they contain private data and individual information. The gamble of losing and leaving their substance helpless before outsiders are excessively high. In the article USB stick safeguarded with BitLocker To Go: how it Works, we perceived how to utilize a device likewise present in Windows 10 Home to safeguard what is put away on external drives, whether glimmer drives (counting SSDs) or hard drives.

What Is The TPM Chip?

Naturally, the items in client-determined drives are encoded on BitLocker-scrambled Windows 10 frameworks safeguarded with Confided in Stage Module (TPM ) chips. However, nothing is provoked at boot. Admittance to the framework is conceivable by demonstrating the right passwords for the different records designed on the login screen.

On frameworks safeguarded with BitLocker, “games, for example, those delineated in the article Failed to remember secret word Windows 10: selective, how to get to the framework don’t work because an aggressor can’t beat the cryptographic security utilizing bootable media.

The TPM chip is available on all advanced laptops, and its essential goal is to help the right working of encryption-based arrangements.

To guarantee your framework utilizes the TPM chip introduced on the motherboard, press Windows+R, then, at that point, type tpm. MSC. The TPM prepared-for-use sign affirms that the framework is outfitted with the chip being referred to; any other way, the presence of the message Can’t find a viable TPM addresses its absence. BitLocker requires a TPM variant 1.2 chip to work.

However, the units (counting the framework one) can likewise be encoded without depending on the chip (with an answer considered less secure). Expecting that you have proactively initiated framework unit encryption with BitLocker on a framework outfitted with a TPM chip, we should perceive how to mention a PIN when it is feasible to begin the machine.

Also Read: A Complete Guide On How To Recover Permanently Deleted Files From Windows And Mac

How To Require A PIN When Starting The Machine To Unlock BitLocker-Protected Drives

Suppose you wanted to count on an additional level of security and ensure that the login screen with the list of accounts does not appear immediately on startup. In that case, you can use a USB stick to unlock the system, as already seen in the BitLocker article, how key retrieval and USB unlock work, or require you to enter a PIN of your choice when you turn on your Windows 10 device. To configure the entry of a PIN when starting a system protected with a TPM chip, follow a few simple steps:

• Make sure, as seen above, that a TPM chip is present on the PC.
• Press the key combination Windows+R then type gpedit. MSC.
• Navigate to Computer Configuration, Administrative Templates, Windows Components, BitLocker Drive Encryption, and Operating System Drives, then double-click the Require additional authentication at startup rule in the right panel.
• Choose the Enabled option above, uncheck the Allow BitLocker without a compatible TPM box, then set the drop-down menus below as shown.
• Press the OK button, then type cmd in the Windows 10 search box. Press the CTRL+SHIFT+ENTER key combination to open the command prompt with administrator rights.
• Issue the following command to check the status of the BitLocker configuration: manage-bde -status.
• Use the following command to ask BitLocker to force the user to enter a PIN when starting the PC before the actual boot phase: manage-bde -protectors -add c: -TPMAndPIN The indication c: obviously refers to the previously encrypted system unit containing Windows 10.
• You will be asked to enter a numeric PIN (” Enter the PIN to be used to protect the volume “): this is the “pass,” which, from now on, must be entered each time the machine is started.
• Typing manage-bde -status again, the item TPM and PIN should appear immediately under Key protections at the bottom of the screen.
• Restarting the PC, the previously chosen PIN will be immediately requested with a screen similar to the one in the figure displayed.
• If you forget your PIN, you can always unlock BitLocker and access Windows 10 by pressing the ESC key and using the recovery code generated by the system when configuring BitLocker.

If you boot from Windows installation media or a Windows kernel-based emergency boot disk, the BitLocker-encrypted drive will not be accessible because it is protected. In the article Recover files from a drive encrypted with Bitlocker we presented the manage-bde command to unlock encrypted drives, including the system one. When encrypting the drive with BitLocker, you must indicate the real recovery key exported.

As an important final note, when configuring the Require additional authentication at startup policy, under Configure TPM startup PIN, you should not select Require startup PIN with TPM but select Allow startup PIN with TPM. In the first case, if you try to encrypt, for example, an external drive with BitLocker To Go, the error message ” The Group Policy settings relating to BitLocker startup options cannot be applied because they conflict “.To resolve this, if you had previously selected the Require startup PIN with TPM option, replace it with Allow startup PIN with TPM and restart the system.

How To Turn Off The PIN Prompt On BitLocker-Protected System Startup

Assume you impair the PIN passage brief at framework startup. You should re-run the Gathering Strategy Manager ( gpedit. msc ) and set the Require extra validation at startup strategy to Not arranged. After clicking alright, you should open the order brief with chairperson freedoms and type the accompanying: Oversee bde – defenders – add c: – TPM. This will return to utilizing just the TPM chip to open the BitLocker-safeguarded hard drive.

Also Read: How To Install A Second Hard Drive?