Solved

Loss of Shares on BitLocker Encrypted Data Volume

Posted on 2008-06-20
2
943 Views
Last Modified: 2013-11-05
Hi all.

I have a problem that I can't find an answer for at MS yet.  Possibly because Server 2008 is too new?

We have a server with BitLocker installed.  The OS drive is not encrypted, but we used manage-bde to encrypt our second Data Volume D: (due to government client project requirements).  We're not in production yet, so I have some room to play.  Currently we manually unlock the D: drive using a script that calls manage-bde and feeds it the Encryption key file.

We access programs and files from this server using an SMB Share.  If the server needs to be rebooted, upon reboot, login and unlocking D:, the SMB share disappears.  We have to recreate it manually.  This is not a good situation since we need the share accessible should the server reboot overnight (we have overnight processes that run and would need to access the files on the share).

I haven't gone as far as testing Autounlock because I am reluctant to encrypt the OS volume right now.  But I did put the Unlock script in the Startup Scripts via local Group Policy and while it works, the share still disappears and has to be recreated.

One interesting thing is that when I recreate the share, the original share permissions are automatically filled in.

So the question here is, is it possible to have shares on a BitLocker encrypted drive that remain after a reboot?  Would the Autounlock (with an encrypted OS volume) work different than the Unlock script as a Startup Script such that the Shares are retained?

This is an important issue for us and a very annoying problem.

Thanks.
0
Comment
Question by:JMakowski
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 54

Accepted Solution

by:
McKnife earned 250 total points
ID: 21837631
The solution should be easy. Shares get created on rebooting. The service called "server" reads out, what shares are to be offered. If those paths (on the encrypted volume) are not existant, those shares are not offered. Solution: Unlock that volume and restart the server service.
But how? If you reboot the server overnight, how do you unlock it first? I think you need a different way of unlocking. Bitlocker by default will unlock the volume automatically if a tpm chip or a USB-token is present. That way, still the user password stands between an attacker/thief and the data - that should be enough.
0
 

Author Closing Comment

by:JMakowski
ID: 31469328
Thanks a lot.  If I restart Server after unlocking, voila the share is back automatically.  I can probably script the restart of Server with the manage-bde command.  Then I will work on reading the key file from a domain controller for unlocking.
0

Featured Post

Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I was asked if I could set up a fax machine so that incoming faxes were delivered to people's Exchange inboxes and so that they could send faxes from their desktops without needing to print the document first.  I knew it was possible but I had no id…
Scenario:  You do full backups to a internal hard drive in either product (SBS or Server 2008).  All goes well for a very long time.  One day, backups begin to fail with a message that the disk is full.  Your disk contains many, many more backups th…
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question