Solved

Loss of Shares on BitLocker Encrypted Data Volume

Posted on 2008-06-20
2
962 Views
Last Modified: 2013-11-05
Hi all.

I have a problem that I can't find an answer for at MS yet.  Possibly because Server 2008 is too new?

We have a server with BitLocker installed.  The OS drive is not encrypted, but we used manage-bde to encrypt our second Data Volume D: (due to government client project requirements).  We're not in production yet, so I have some room to play.  Currently we manually unlock the D: drive using a script that calls manage-bde and feeds it the Encryption key file.

We access programs and files from this server using an SMB Share.  If the server needs to be rebooted, upon reboot, login and unlocking D:, the SMB share disappears.  We have to recreate it manually.  This is not a good situation since we need the share accessible should the server reboot overnight (we have overnight processes that run and would need to access the files on the share).

I haven't gone as far as testing Autounlock because I am reluctant to encrypt the OS volume right now.  But I did put the Unlock script in the Startup Scripts via local Group Policy and while it works, the share still disappears and has to be recreated.

One interesting thing is that when I recreate the share, the original share permissions are automatically filled in.

So the question here is, is it possible to have shares on a BitLocker encrypted drive that remain after a reboot?  Would the Autounlock (with an encrypted OS volume) work different than the Unlock script as a Startup Script such that the Shares are retained?

This is an important issue for us and a very annoying problem.

Thanks.
0
Comment
Question by:JMakowski
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 55

Accepted Solution

by:
McKnife earned 250 total points
ID: 21837631
The solution should be easy. Shares get created on rebooting. The service called "server" reads out, what shares are to be offered. If those paths (on the encrypted volume) are not existant, those shares are not offered. Solution: Unlock that volume and restart the server service.
But how? If you reboot the server overnight, how do you unlock it first? I think you need a different way of unlocking. Bitlocker by default will unlock the volume automatically if a tpm chip or a USB-token is present. That way, still the user password stands between an attacker/thief and the data - that should be enough.
0
 

Author Closing Comment

by:JMakowski
ID: 31469328
Thanks a lot.  If I restart Server after unlocking, voila the share is back automatically.  I can probably script the restart of Server with the manage-bde command.  Then I will work on reading the key file from a domain controller for unlocking.
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
Suggested Courses

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question