Configuring BitLocker Drive Encryption on a Windows Server 2008 R2 Branch Office Domain Controller (part 4)

Enabling BitLocker Drive Encryption on Additional Data Volumes

There might be situations when BitLocker Drive Encryption is warranted not only on the volume containing the operating system files, but also on the data volumes. This is especially common with domain controllers in branch offices where a lack of physical security and theft are concerns.

When encrypting data volumes with BitLocker, the keys generated for the operating system volume are independent of the drive volume. However, encryption of a data volume is similar to the encryption process of the operating system volume.

Follow these steps to enable BitLocker Drive Encryption for server data volumes:

The data volume must be unlocked each time the server is rebooted. This can be accomplished through a manual or automatic process. The syntax to manually unlock a data volume after every restart consists of the following two options:

• manage-bde -unlock <volume>: -rp <recovery password>

• manage-bde -unlock <volume>: -rk U:\<recovery-key-file name>

The first option uses the recovery password, whereas the second option takes advantage of passing the recovery key to decrypt the data volume. As mentioned in the previous paragraph, it is possible to enable automatic unlocking of a data volume by utilizing the following syntax at the command prompt:

manage-bde –autounlock –enable <volume>:

This command creates a recovery key and stores it on the operating system volume. The data volume is automatically unlocked after each system reboot.

Utilizing the BitLocker Recovery Password

There might be situations when you need to leverage the recovery password to gain access to a volume that is encrypted with BitLocker. This situation might occur when there is an error related to the TPM hardware, one of the boot files becomes corrupt or modified, or if TPM is unintentionally cleared or disabled. The following instructions outline the recovery steps:

Scenarios for when the Recovery Password Is Required

There are a number of different scenarios where a BitLocker recovery would need to be performed; these include (but are not limited to):

• Changing or replacing the motherboard with a new TPM

• Changing the status of the TPM

• Updating the BIOS and or any other ROM on the motherboard

• Attempting to access a BitLocker-enabled drive on a different system.

• Entering the wrong PIN information too many times

• Losing or damaging the USB startup key

Removing BitLocker Drive Encryption

The course of action for turning off BitLocker Drive Encryption is the same for both TPM-based hardware configurations and USB devices. When turning off BitLocker, two options exist. You can either remove BitLocker entirely and decrypt a volume or you can temporarily disable BitLocker so changes can still be made. The following steps depict the process for removing and disabling BitLocker: