Encrypting*a*Windows*7*Hard*Disk* with%bitlocker%disk%encryption Thisdocumentcontainsthenecessarystepstoencryptthecontentsofaharddrive usingbitlockerandwindows7. Thefollowinginstructionsarederivedfromdocumentationat: http://technet.microsoft.com/en1us/library/cc731549(v=ws.10) http://technet.microsoft.com/en1us/library/dd835565(v=ws.10) 5November2012 DavidAnderson LouArminio 1
EnsureSystemhasaTPMChip EntertheBIOSofthesystemtoverifythepresenceofaTrustedPlatformModule (TPM)chip.TheTPMchipstorestheauthenticationkeyfortheencrypteddrive. WhileBitlockerwillworkonasystemthatdoesnothaveaTPMchip,thiswill requirethesystemusertoinsertausbflashdriveintothecomputerinorderto unlockthedrivewheneveritisstarted. LocatingthesectionoftheBIOSthatshowsandallowsconfigurationoftheTPM chipwillvarybysystem.thefollowingscreenshotshowsthebioslocationona DellLatitudeD630laptop. 2
ActivatetheTPMChip Beforetellingthesystemtostartencryption,itwillbenecessarytoactivatetheTPM chip.thisisatwoqstepprocess.first,ensurethetpmsecuritysettingis On.Ifit isnot,enablethecheckboxandclick Apply. Changingthisvaluewillrequireareboot.Save/ExittheBIOSsettingscreen,then reenterthebiosforthenextstep. 3
ActivatetheTPMModule Next,gototheTPMActivationsettingsandactivatetheTPMModule. Changingthisvaluewillrequireareboot.Save/ExittheBIOSsettingscreen,then reenterthebiosforthenextstep. 4
VerifySystemBootOrder Anotherimportantsettingtoverifyisthebootorderofthesystem.Ifthesystemis settoattempttobootfromausbdevicesbeforetheinternalhdd,attemptingto verifyasavedrecoverykeywillfail,andtheencryptionprocesswillhavetobe restarted(whichwillgenerateanewrecoverykey,whichwillagainneedtobe saved). OnceBIOSsettingsareproperlyset,(shouldnotrequireanotherrestart),allow Windowstostart. 5
StartBitlockerEncryption LogontoWindowsusinganNAUdomainaccountwithadministratorprivilegeson thecomputer.gotostartq>controlpanelq>systemandsecurityq>bitlockerdrive Encryption. Click TurnonBitlocker. 6
Windowswillcheckyourcomputer sconfigurationtomakesureitiscompatible withbitlocker(thiswillfailifthetpmwasnotpreviouslyactivated).thenitwill initializethetpmmodule.beforebeginningtoencryptthedrive,youwillbegiven theopportunitytosavetherecoverykey.therecoverykeywillautomaticallybe senttoactivedirectoryaspartofgrouppolicy,butmakingalocalcopymightbea goodideaaswell.threeoptionsareavailableforsavingthekey:savingtousbflash drive,savingtoafile,andprintingthekey.anyandalloptionsmaybeselected. Beforechoosingwhetheryouwanttosavealocalcopyofthekey,orhowtodoit, youshouldconsiderhowyouintendtosafeguardthekey.ifitisstoredonthedrive youareabouttoencrypt,youwillnotbeabletouseittorecoverthedriveunlessit iscopiedelsewhere,sinceitwillbeinaccessiblefromthatdriveinarecovery scenario.ifitistobestoredonausbflashdriveorprinted,thekeyshouldbe hiddenawayinasafelocation.itshouldnotbekeptwiththesystemthatit recovers.doingthiswouldbelikekeepingakeyinsidethekeywayofthelock.it wouldeffectivelyinvalidatetheprotectiontotheencrypteddrive.onceyouhave securedalocalcopyofthekey,clickthenextbuttontoproceed. YouwillseethefollowingscreensasWindowsbeginstheprocess. 7
8
9
IfyousavedtherecoverykeytoaUSBflashdrive,thedrivewillcontainfilessuchas thefollowing.acopyofyourrecoverykeywillbeautomaticallysavedtothenau domainactivedirectoryserver.itscanrecoverthiskeyintheeventofloss.youdo notneedthekeytouseyourcomputer.itisonlynecessaryifyourharddriveis movedtoanothersystem. Nowyouarereadytostarttheencryptionprocess.Asanaddedsafeguard,youare giventheoptiontoverifytheintegrityofarecoverykeyifyoustoredoneonausb flashdrive.checktheboxonthe Areyoureadytoencryptthisdrive? screenifyou wouldliketodothis.ifyoudidnotverifythatthehddwillbootbeforeausb attacheddevice,thenthismaynotwork,andwillrequirerestartingtheprocess, includinggeneratinganewrecoverykey. Ifyoudecidedtoverifytherecoverykey,youwillneedtorebootwiththeUSBflash driveinsertedinthecomputer.theverificationdoesnottakelong. 10
Afteryoureboot,youwillseeamessageoriginatinginthesystemtrayareaofthe screen(typicallythelowerright)indicatingencryptionisinprogress.youcan verifythisbygoingtothesystemtrayandclickingontheicon[getscreenshot].you willseeawindowlikethis. Encryptionwilltakeplaceinthebackgroundandthesystemcanbeusedwhilethis istakingplace.therewillbeaslightdegradationinperformance,butmaynotbe thatnoticeabledependingontheactivitiesyouperform. 11
Thesystemmaytakeuptoeighthoursormoretoencrypt.Factorswhichaffectthis timearesizeoftheharddisk,speedofthecpu,andwhetheritisbeingusedwhile encryptionistakingplace.ifthesystemisshutdownencryptionwillresumeafterit isrestarted.besuretocheckthesystemtraytoensureencryptionisrunningaftera restart.oncetheharddiskisencrypted,successcanbeverifiedbygoingtocontrol Panel,SystemandSecurity,BitlockerDriveEncryption.Thisscreenwillindicate thatbitlockeristurnedonfortheharddrive. 12
Oncethisprocessiscompleted,yourharddrivewillbeencryptedandyourdata onlyvisibleafteravalidwindowslogin.ifyourcomputerislostorstolen,yourdata willremainprotected.pleasenotethat,althoughyourharddriveisnowencrypted, yoursystembackupswillnotbeencrypted.ifyoubackupasystemcontaining sensitiveinformation,youmustsecureandprotectyourbackupmediatoprevent exposureofyourdata. 13