implementing-disk-encryption-with-bitlocker

name	implementing-disk-encryption-with-bitlocker
description	Implements full disk encryption using Microsoft BitLocker on Windows endpoints to protect data at rest from unauthorized access in case of device loss or theft. Use when deploying encryption for compliance requirements, securing mobile workstations, or implementing data protection controls across the enterprise. Activates for requests involving BitLocker encryption, disk encryption, TPM configuration, or data-at-rest protection.
domain	cybersecurity
subdomain	endpoint-security
tags	["endpoint","encryption","BitLocker","TPM","data-protection","windows-security"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]

Implementing Disk Encryption with BitLocker

When to Use

Use this skill when:

• Encrypting Windows endpoints to protect data at rest for compliance (PCI DSS, HIPAA, GDPR)
• Deploying BitLocker across enterprise fleet via Intune, SCCM, or GPO
• Configuring TPM-based encryption with PIN or USB startup key for enhanced security
• Managing BitLocker recovery keys in Active Directory or Azure AD

Do not use this skill for Linux disk encryption (use LUKS/dm-crypt) or macOS (use FileVault).

Common Misconfigurations & Verification

• TPM-only (no PIN): Enable-BitLocker -TpmProtector unlocks transparently and is exposed to cold-boot and DMA/"evil maid" attacks. Confirm laptops use TpmAndPin — (Get-BitLockerVolume C:).KeyProtector should list TpmPin, not just Tpm and RecoveryPassword.
• DMA / open ports: Thunderbolt/FireWire/M.2 DMA can read keys from RAM. Verify Kernel DMA Protection (msinfo32 → "Kernel DMA Protection: On") or the "Disable new DMA devices when this computer is locked" policy is set.
• Used Space Only on repurposed drives: leaves prior deleted data unencrypted in free space. Check manage-bde -status C: for Conversion Status: Used Space Only Encrypted on reused disks.
• Recovery key not escrowed: if a key was never backed up to AD/Azure AD, TPM failure means permanent data loss. Confirm escrow exists before relying on it.
• Verification: manage-bde -status C: must show Protection Status: Protection On, Percentage Encrypted: 100.0%, Encryption Method: XTS-AES 256. Protection On only appears after protectors are active — a drive can be 100% encrypted with protection suspended (manage-bde -protectors -get C: to confirm), which leaves the key in the clear.

Prerequisites

• Windows 10/11 Pro, Enterprise, or Education edition
• TPM 2.0 chip (recommended; TPM 1.2 supported with limitations)
• UEFI firmware with Secure Boot enabled (recommended)
• Separate system partition (200 MB minimum, created automatically by Windows installer)
• Active Directory or Azure AD for recovery key escrow

Workflow

Step 1: Verify TPM and System Requirements