Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1009
  • Last Modified:

Loss of Shares on BitLocker Encrypted Data Volume

Hi all.

I have a problem that I can't find an answer for at MS yet.  Possibly because Server 2008 is too new?

We have a server with BitLocker installed.  The OS drive is not encrypted, but we used manage-bde to encrypt our second Data Volume D: (due to government client project requirements).  We're not in production yet, so I have some room to play.  Currently we manually unlock the D: drive using a script that calls manage-bde and feeds it the Encryption key file.

We access programs and files from this server using an SMB Share.  If the server needs to be rebooted, upon reboot, login and unlocking D:, the SMB share disappears.  We have to recreate it manually.  This is not a good situation since we need the share accessible should the server reboot overnight (we have overnight processes that run and would need to access the files on the share).

I haven't gone as far as testing Autounlock because I am reluctant to encrypt the OS volume right now.  But I did put the Unlock script in the Startup Scripts via local Group Policy and while it works, the share still disappears and has to be recreated.

One interesting thing is that when I recreate the share, the original share permissions are automatically filled in.

So the question here is, is it possible to have shares on a BitLocker encrypted drive that remain after a reboot?  Would the Autounlock (with an encrypted OS volume) work different than the Unlock script as a Startup Script such that the Shares are retained?

This is an important issue for us and a very annoying problem.

Thanks.
0
JMakowski
Asked:
JMakowski
1 Solution
 
McKnifeCommented:
The solution should be easy. Shares get created on rebooting. The service called "server" reads out, what shares are to be offered. If those paths (on the encrypted volume) are not existant, those shares are not offered. Solution: Unlock that volume and restart the server service.
But how? If you reboot the server overnight, how do you unlock it first? I think you need a different way of unlocking. Bitlocker by default will unlock the volume automatically if a tpm chip or a USB-token is present. That way, still the user password stands between an attacker/thief and the data - that should be enough.
0
 
JMakowskiAuthor Commented:
Thanks a lot.  If I restart Server after unlocking, voila the share is back automatically.  I can probably script the restart of Server with the manage-bde command.  Then I will work on reading the key file from a domain controller for unlocking.
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now