| name | implementing-disk-encryption-with-bitlocker |
| description | Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise. Activates for requests involving BitLocker encryption, disk encryption, TPM configuration, or data-at-rest protection.
|
| domain | cybersecurity |
| subdomain | endpoint-security |
| tags | ["endpoint","encryption","BitLocker","TPM","data-protection","windows-security"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"] |
| mitre_attack | ["T1055","T1547","T1059","T1036","T1573"] |
Implementing Disk Encryption with BitLocker
When to Use
Use this skill when:
- Encrypting Windows endpoints to protect data at rest for compliance (PCI DSS, HIPAA, GDPR)
- Deploying BitLocker across enterprise fleet via Intune, SCCM, or GPO
- Configuring TPM-based encryption with PIN or USB startup key for enhanced security
- Managing BitLocker recovery keys in Active Directory or Azure AD
Do not use this skill for Linux disk encryption (use LUKS/dm-crypt) or macOS (use FileVault).
Prerequisites
- Windows 10/11 Pro, Enterprise, or Education edition
- TPM 2.0 chip (recommended; TPM 1.2 supported with limitations)
- UEFI firmware with Secure Boot enabled (recommended)
- Separate system partition (200 MB minimum, created automatically by Windows installer)
- Active Directory or Azure AD for recovery key escrow
Workflow
Step 1: Verify TPM and System Requirements
# Check TPM status
Get-Tpm
# ManufacturerId, ManufacturerVersion, TpmPresent, TpmReady, TpmEnabled
# Check TPM version (2.0 required for best compatibility)
(Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm).SpecVersion
# Check UEFI/Secure Boot
Confirm-SecureBootUEFI
# Returns True if Secure Boot is enabled
# Check BitLocker readiness
$vol = Get-BitLockerVolume -MountPoint "C:"
$vol.VolumeStatus # Should be "FullyDecrypted"
$vol.ProtectionStatus # Should be "Off"
Step 2: Configure BitLocker GPO Settings
Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption
Operating System Drives:
- Require additional authentication at startup: Enabled
- Allow BitLocker without compatible TPM: Disabled (enforce TPM)
- Configure TPM startup: Allow TPM
- Configure TPM startup PIN: Allow startup PIN with TPM
- Configure TPM startup key: Allow startup key with TPM
- Choose how BitLocker-protected OS drives can be recovered: Enabled
- Allow data recovery agent: True
- Configure storage of recovery information to AD DS: Enabled
- Save recovery info to AD DS for OS drives: Store recovery passwords and key packages
- Do not enable BitLocker until recovery information is stored: Enabled
- Choose drive encryption method and cipher strength:
- OS drives: XTS-AES 256-bit (Windows 10 1511+)
- Fixed drives: XTS-AES 256-bit
- Removable drives: AES-CBC 256-bit (for cross-platform compatibility)
Fixed Data Drives:
- Choose how BitLocker-protected fixed drives can be recovered: Enabled
- Store recovery passwords in AD DS: Enabled
Removable Data Drives:
- Control use of BitLocker on removable drives: Enabled
- Configure use of passwords for removable drives: Require complexity
