Solved

Loss of Shares on BitLocker Encrypted Data Volume

Posted on 2008-06-20
2
911 Views
Last Modified: 2013-11-05
Hi all.

I have a problem that I can't find an answer for at MS yet.  Possibly because Server 2008 is too new?

We have a server with BitLocker installed.  The OS drive is not encrypted, but we used manage-bde to encrypt our second Data Volume D: (due to government client project requirements).  We're not in production yet, so I have some room to play.  Currently we manually unlock the D: drive using a script that calls manage-bde and feeds it the Encryption key file.

We access programs and files from this server using an SMB Share.  If the server needs to be rebooted, upon reboot, login and unlocking D:, the SMB share disappears.  We have to recreate it manually.  This is not a good situation since we need the share accessible should the server reboot overnight (we have overnight processes that run and would need to access the files on the share).

I haven't gone as far as testing Autounlock because I am reluctant to encrypt the OS volume right now.  But I did put the Unlock script in the Startup Scripts via local Group Policy and while it works, the share still disappears and has to be recreated.

One interesting thing is that when I recreate the share, the original share permissions are automatically filled in.

So the question here is, is it possible to have shares on a BitLocker encrypted drive that remain after a reboot?  Would the Autounlock (with an encrypted OS volume) work different than the Unlock script as a Startup Script such that the Shares are retained?

This is an important issue for us and a very annoying problem.

Thanks.
0
Comment
Question by:JMakowski
2 Comments
 
LVL 53

Accepted Solution

by:
McKnife earned 250 total points
ID: 21837631
The solution should be easy. Shares get created on rebooting. The service called "server" reads out, what shares are to be offered. If those paths (on the encrypted volume) are not existant, those shares are not offered. Solution: Unlock that volume and restart the server service.
But how? If you reboot the server overnight, how do you unlock it first? I think you need a different way of unlocking. Bitlocker by default will unlock the volume automatically if a tpm chip or a USB-token is present. That way, still the user password stands between an attacker/thief and the data - that should be enough.
0
 

Author Closing Comment

by:JMakowski
ID: 31469328
Thanks a lot.  If I restart Server after unlocking, voila the share is back automatically.  I can probably script the restart of Server with the manage-bde command.  Then I will work on reading the key file from a domain controller for unlocking.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Normally after a failure of Domain Controller, when promoting new DC the DC is renamed, we will discuss the options in Dcpromo to re-create the DC with the same name. Scenario: You are a small IT shop with two Domain Controllers (Domain Contr…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now