Solved

Loss of Shares on BitLocker Encrypted Data Volume

Posted on 2008-06-20
2
919 Views
Last Modified: 2013-11-05
Hi all.

I have a problem that I can't find an answer for at MS yet.  Possibly because Server 2008 is too new?

We have a server with BitLocker installed.  The OS drive is not encrypted, but we used manage-bde to encrypt our second Data Volume D: (due to government client project requirements).  We're not in production yet, so I have some room to play.  Currently we manually unlock the D: drive using a script that calls manage-bde and feeds it the Encryption key file.

We access programs and files from this server using an SMB Share.  If the server needs to be rebooted, upon reboot, login and unlocking D:, the SMB share disappears.  We have to recreate it manually.  This is not a good situation since we need the share accessible should the server reboot overnight (we have overnight processes that run and would need to access the files on the share).

I haven't gone as far as testing Autounlock because I am reluctant to encrypt the OS volume right now.  But I did put the Unlock script in the Startup Scripts via local Group Policy and while it works, the share still disappears and has to be recreated.

One interesting thing is that when I recreate the share, the original share permissions are automatically filled in.

So the question here is, is it possible to have shares on a BitLocker encrypted drive that remain after a reboot?  Would the Autounlock (with an encrypted OS volume) work different than the Unlock script as a Startup Script such that the Shares are retained?

This is an important issue for us and a very annoying problem.

Thanks.
0
Comment
Question by:JMakowski
2 Comments
 
LVL 54

Accepted Solution

by:
McKnife earned 250 total points
ID: 21837631
The solution should be easy. Shares get created on rebooting. The service called "server" reads out, what shares are to be offered. If those paths (on the encrypted volume) are not existant, those shares are not offered. Solution: Unlock that volume and restart the server service.
But how? If you reboot the server overnight, how do you unlock it first? I think you need a different way of unlocking. Bitlocker by default will unlock the volume automatically if a tpm chip or a USB-token is present. That way, still the user password stands between an attacker/thief and the data - that should be enough.
0
 

Author Closing Comment

by:JMakowski
ID: 31469328
Thanks a lot.  If I restart Server after unlocking, voila the share is back automatically.  I can probably script the restart of Server with the manage-bde command.  Then I will work on reading the key file from a domain controller for unlocking.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Redirected folders in a windows domain can be quite useful for a number of reasons, one of them being that with redirected application data, you can give users more seamless experience when logging into different workstations.  For example, if a use…
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question