implementing-disk-encryption-with-bitlocker

Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise. Activates for requests involving BitLocker encryption, disk encryption, TPM configuration, or data-at-rest protection.

Zur Installation springen

Repository: xalgord/xalgorix
Letzte Quellaktivität: 6. Juni 2026 um 16:41
Erkannte Sprache von SKILL.md: Englisch
Sterne: 813
Forks: 146

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Zurück zur Suche Zurück zur Installation

name	implementing-disk-encryption-with-bitlocker
description	Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise. Activates for requests involving BitLocker encryption, disk encryption, TPM configuration, or data-at-rest protection.
domain	cybersecurity
subdomain	endpoint-security
tags	["endpoint","encryption","BitLocker","TPM","data-protection","windows-security"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Implementing Disk Encryption with BitLocker

When to Use

Use this skill when:

Encrypting Windows endpoints to protect data at rest for compliance (PCI DSS, HIPAA, GDPR)
Deploying BitLocker across enterprise fleet via Intune, SCCM, or GPO
Configuring TPM-based encryption with PIN or USB startup key for enhanced security
Managing BitLocker recovery keys in Active Directory or Azure AD

Do not use this skill for Linux disk encryption (use LUKS/dm-crypt) or macOS (use FileVault).

Common Misconfigurations & Verification

TPM-only (no PIN): Enable-BitLocker -TpmProtector unlocks transparently and is exposed to cold-boot and DMA/"evil maid" attacks. Confirm laptops use TpmAndPin — (Get-BitLockerVolume C:).KeyProtector should list TpmPin, not just Tpm and RecoveryPassword.
DMA / open ports: Thunderbolt/FireWire/M.2 DMA can read keys from RAM. Verify Kernel DMA Protection (msinfo32 → "Kernel DMA Protection: On") or the "Disable new DMA devices when this computer is locked" policy is set.
Used Space Only on repurposed drives: leaves prior deleted data unencrypted in free space. Check manage-bde -status C: for Conversion Status: Used Space Only Encrypted on reused disks.
Recovery key not escrowed: if a key was never backed up to AD/Azure AD, TPM failure means permanent data loss. Confirm escrow exists before relying on it.
Verification: manage-bde -status C: must show Protection Status: Protection On, Percentage Encrypted: 100.0%, Encryption Method: XTS-AES 256. Protection On only appears after protectors are active — a drive can be 100% encrypted with protection suspended (manage-bde -protectors -get C: to confirm), which leaves the key in the clear.

Prerequisites

Windows 10/11 Pro, Enterprise, or Education edition
TPM 2.0 chip (recommended; TPM 1.2 supported with limitations)
UEFI firmware with Secure Boot enabled (recommended)
Separate system partition (200 MB minimum, created automatically by Windows installer)
Active Directory or Azure AD for recovery key escrow

Workflow

Step 1: Verify TPM and System Requirements

# Check TPM status
Get-Tpm
# ManufacturerId, ManufacturerVersion, TpmPresent, TpmReady, TpmEnabled

# Check TPM version (2.0 required for best compatibility)
(Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm).SpecVersion

# Check UEFI/Secure Boot
Confirm-SecureBootUEFI
# Returns True if Secure Boot is enabled

# Check BitLocker readiness
$vol = Get-BitLockerVolume -MountPoint "C:"
$vol.VolumeStatus  # Should be "FullyDecrypted"
$vol.ProtectionStatus  # Should be "Off"

Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption

Operating System Drives:
  - Require additional authentication at startup: Enabled
    - Allow BitLocker without compatible TPM: Disabled (enforce TPM)
    - Configure TPM startup: Allow TPM
    - Configure TPM startup PIN: Allow startup PIN with TPM
    - Configure TPM startup key: Allow startup key with TPM

  - Choose how BitLocker-protected OS drives can be recovered: Enabled
    - Allow data recovery agent: True
    - Configure storage of recovery information to AD DS: Enabled
    - Save recovery info to AD DS for OS drives: Store recovery passwords and key packages
    - Do not enable BitLocker until recovery information is stored: Enabled

  - Choose drive encryption method and cipher strength:
    - OS drives: XTS-AES 256-bit (Windows 10 1511+)
    - Fixed drives: XTS-AES 256-bit
    - Removable drives: AES-CBC 256-bit (for cross-platform compatibility)

Fixed Data Drives:
  - Choose how BitLocker-protected fixed drives can be recovered: Enabled
    - Store recovery passwords in AD DS: Enabled

Removable Data Drives:
  - Control use of BitLocker on removable drives: Enabled
  - Configure use of passwords for removable drives: Require complexity

# Enable BitLocker with TPM-only protector (transparent to user)
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 `
  -TpmProtector -SkipHardwareTest

# Enable BitLocker with TPM + PIN (recommended for laptops)
$pin = ConvertTo-SecureString "123456" -AsPlainText -Force
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 `
  -TpmAndPinProtector -Pin $pin

# Add recovery password protector
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

# Backup recovery key to Active Directory
Backup-BitLockerKeyProtector -MountPoint "C:" `
  -KeyProtectorId (Get-BitLockerVolume -MountPoint "C:").KeyProtector[1].KeyProtectorId

# Encrypt fixed data drives
Enable-BitLocker -MountPoint "D:" -EncryptionMethod XtsAes256 `
  -RecoveryPasswordProtector -AutoUnlockEnabled

Intune → Endpoint Security → Disk encryption → Create Profile

Platform: Windows 10 and later
Profile: BitLocker

Settings:
  BitLocker base settings:
    - Encryption for operating system drives: Require
    - Encryption for fixed data drives: Require
    - Encryption for removable data drives: Require

  Operating system drive settings:
    - Additional authentication at startup: Require
    - TPM startup: Allowed
    - TPM startup PIN: Required (for high-security endpoints)
    - Encryption method: XTS-AES 256-bit
    - Recovery: Escrow to Azure AD

  Fixed drive settings:
    - Encryption method: XTS-AES 256-bit
    - Recovery: Escrow to Azure AD

  Assign to: All managed Windows devices (or specific groups)

# View recovery key on local system
(Get-BitLockerVolume -MountPoint "C:").KeyProtector |
  Where-Object {$_.KeyProtectorType -eq "RecoveryPassword"} |
  Select-Object KeyProtectorId, RecoveryPassword

# Retrieve recovery key from Active Directory (requires RSAT)
Get-ADObject -Filter {objectClass -eq "msFVE-RecoveryInformation"} `
  -SearchBase "CN=COMPUTER01,OU=Workstations,DC=corp,DC=example,DC=com" `
  -Properties msFVE-RecoveryPassword |
  Select-Object -ExpandProperty msFVE-RecoveryPassword

# Retrieve recovery key from Azure AD
# Azure Portal → Azure AD → Devices → [device] → BitLocker keys
# Or via Microsoft Graph API:
# GET /devices/{id}/bitlockerRecoveryKeys

# Check encryption status across fleet
manage-bde -status C:

# Expected output for encrypted drive:
#   Conversion Status: Fully Encrypted
#   Percentage Encrypted: 100.0%
#   Encryption Method: XTS-AES 256
#   Protection Status: Protection On
#   Key Protectors: TPM, Numerical Password

# PowerShell compliance check
$vol = Get-BitLockerVolume -MountPoint "C:"
if ($vol.ProtectionStatus -eq "On" -and $vol.VolumeStatus -eq "FullyEncrypted") {
    Write-Host "COMPLIANT: BitLocker enabled and fully encrypted"
} else {
    Write-Host "NON-COMPLIANT: BitLocker status - Protection: $($vol.ProtectionStatus), Volume: $($vol.VolumeStatus)"
}

Term	Definition
TPM (Trusted Platform Module)	Hardware security chip that stores BitLocker encryption keys and provides measured boot integrity
XTS-AES 256	Encryption cipher used by BitLocker; XTS mode provides better protection for disk encryption than CBC
Recovery Key	48-digit numerical password used to unlock BitLocker-encrypted drive when TPM authentication fails
Key Protector	Method used to unlock BitLocker (TPM, TPM+PIN, recovery password, startup key, smart card)
Used Space Only Encryption	Encrypts only sectors containing data; faster initial encryption but may leave remnant data in free space
Full Disk Encryption	Encrypts entire volume including free space; slower but more secure for drives that previously contained data