How to enable BitLocker on a Windows Laptop.

Transcription

1 How to enable BitLocker on a Windows Laptop. If the operating system on your Windows laptop matches any in the list below then your device will have Bitlocker installed on your machine as default. This means that you can continue with this document and follow the guidelines to enable Bitlocker. Version Windows Vista Ultimate Windows Vista Enterprise Windows 7 Ultimate Windows 7 Enterprise Windows 8/8.1 Pro Windows 8/8.1 Enterprise Windows 10 Pro Windows 10 Enterprise Bitlocker If you are operating on any Vista or Win 7 editions then we advise that you take up the option of upgrading for free to Win 10. Within the next year Microsoft will no longer be supporting Vista or Win 7 and all of Intrinsic Applications are compatible with Win 10. Your laptop may already be encrypted with Bitlocker. To check do the following: Win 8/8.1 (Pro or Enterprise) Navigate to Control Panel. Click on "BitLocker Drive Encryption", Under "BitLocker Drive Encryption - Hard Disk Drives", if you see the following text: "Windows (C :) On", then your hard drive is encrypted. Win 10 (Pro or Enterprise) Select the start icon on the desktop and type Manage Bitlocker in the Ask me anything search bar. Select the Manage Bitlocker (Control Panel) icon. If you see the following text: "Windows (C :) Bitlocker On", then your hard drive is encrypted. Backing up data Before you go any further, now is the time to ensure that all data currently held on your laptop is indeed backed up securely in line with Intrinsic security policy. Laptops should not be treated as a permanent storage location for files, they should be thought of just as a way of temporarily taking documents away from their usual secure and regularly backed-up location (probably a network drive, encrypted USB/external hard drive or Microsoft OneDrive Cloud storage solution etc.). Note: For larger firms that use a Citrix Server data on this is already protected through the company network domain. Backing up of company data will be required if you have files saved elsewhere on your machine. (E.g. My documents etc)

2 To back up your data you can use any of the following: 1. USB/Memory stick (Encrypted if available but not essential at this stage) 2. Your own company network drive 3. External Hardware (E.g. External Hard-drive, CD s or DVD s) 4. Cloud storage We advise that you use Microsoft OneDrive as we know this is a compliant model. Other sites may be available but Dropbox is not advised. If you want to take up this option then please visit sign up and following the instructions. The following 3 steps apply to options 1, 2 & 3 above: Locate all the company data you want to back up. Transfer all this data to the device or your own company network drive. Remove any USB/Memory sticks or hardware devices from your laptop. That s it you have successfully backed up your data and are now ready to proceed with enabling Bitlocker. Enabling Bitlocker Notes: Encrypting a drive can vary in time depending on the size of the drive but you can safely continue to work while this happens but please note you may experience performance issues during this time. It is advised that you have a USB or External Hardware device on hand to store your Bitlocker recovery key during the set up process. Win 8/8.1/10 (Pro or Enterprise) For Win 8 or 8.1 navigate to Control Panel. Click on "BitLocker Drive Encryption" and then select Turn on Bitlocker. For Win 10 select the start icon on the desktop and type Manage Bitlocker in the Ask me anything search bar. Select the Manage Bitlocker (Control Panel) icon and then select Turn on Bitlocker. If you see the following message it means that you re enabling BitLocker on a device that doesn t have a Trusted Platform Module (TPM), you ll see a message saying your administrator must set the Allow BitLocker without a compatible TPM option. (If you don t see this message, skip to page 5)

3 To fix this issue you will need to do the following Open the Local Group Policy Editor In Windows 8.1, go to the Start screen and search for the words group policy. Then, click or tap the Edit group policy search result. In Windows 10, go to the search box on the taskbar and type group or group policy. Then, click or tap the Edit group policy" search result.

4 Alternatively, you can enter: gpedit.msc in the search box and press enter This will bring up the Local Group Policy Editor, which looks like this. On the left-hand panel, go to the Computer Configuration section and open the following folders: Administrative Templates -> Windows Components -> BitLocker Drive Encryption -> Operating System Drives Now look at the right hand panel and search for a setting named: "Require additional authentication at startup". Double click/tap on it to open this setting. A window with the properties of this policy is shown. Change the value of this policy to Enabled. Then, check the option which says "Allow BitLocker without a compatible TPM" and press OK.

5 When done, close the Local Group Policy Editor window. You can now use BitLocker to encrypt your system drive without having a TPM chip in your computer. Next, you ll see the Choose how to unlock your drive at startup screen. Select enter a password and then insert & confirm this is the next screen and select next. BitLocker will provide you with a recovery key. This key can be used to access your encrypted files if you ever lose your main key for example, if you forget your password or if the computer with the TPM dies and you have to remove the drive. We advise that you save the recovery key to a USB flash drive. Under no circumstances should this be stored with your laptop; if it is, then there is no point in encrypting your disk(s) and you will not be complying with your obligations under data protection law.

6 In the next window select Encrypt entire drive when selecting how much of the drive to encrypt. Then tick the Run BitLocker system check box and click Continue Select restart now and enter your password once the laptop has re-booted. Once you have logged back in a window will pop up whilst the drive is encrypting. When the drive has encrypted you will see a message stating Encryption of C: is complete. By completing the above instructions your hard disk is now encrypted. If you need help or assistance, please call or encryption@intrinsicfs.com

7 USB/External Hardware Encryption Any USB/Memory sticks or External Hardware devices will also need to be encrypted. 1. Insert device 2. Open the Bitlocker control panel Win 8/8.1 - Navigate to Control Panel. Click on "BitLocker Drive Encryption" Win 10 - type Manage Bitlocker in the Ask me anything search bar. Select the Manage Bitlocker (Control Panel) icon 3. Select Turn On BitLocker next to the removable drive you want to encrypt. Alternatively you can open my computer and right click on the removable drive you want to encrypt and select Turn on Bitlocker. 4. Bitlocker will then initialise the drive. 5. After BitLocker initializes the drive you will be asked to choose how you want to unlock the drive. Select the first option: Use a password to unlock the drive. Passwords should contain upper and lowercase letters, numbers, spaces and symbols. 6. Next you will be prompted to store the recovery key in the event that you forget your password. Ensure that you don t store the recovery key on the drive you are encrypting. We recommend that you store the recovery key on your personal drive. 7. Click start encrypting to begin the encryption process. 8. A notification will be displayed when encryption is complete. Note that the drive icon will change to indicate that it is now encrypted with BitLocker.