Solved

Non-TPM computers with Bitlocker - need some orientation

Posted on 2016-08-30
14
51 Views
Last Modified: 2016-09-09
I have some Windows 10 Pro computers that will likely have Bitlocker turned on.  They don't have TPM.
I will be accessing and rebooting these computers remotely.

The computers are in a secure location.
I'm wondering if the required USB drive for booting can be left in the computer?
etc......
0
Comment
Question by:Fred Marshall
  • 6
  • 6
  • 2
14 Comments
 
LVL 92

Expert Comment

by:John Hurst
ID: 41777356
They would have already had to prepare a suitable flash key with which to boot the computer. Yes it would need to be in the drive when you restart.
0
 
LVL 92

Expert Comment

by:John Hurst
ID: 41777357
Here is a decent article that will help explain bitlocker using a flash drive

http://www.howtogeek.com/howto/6229/how-to-use-bitlocker-on-drives-without-tpm/
0
 
LVL 25

Author Comment

by:Fred Marshall
ID: 41777374
So, as I get it, there is a USB boot key and there is also a recovery key which can be saved as a file somewhere?
0
 
LVL 92

Expert Comment

by:John Hurst
ID: 41777379
The startup key on the Flash drive is for Bitlocker and must be there when you restart. That is not also (to the very best of my knowledge) a boot key as well. The system will start itself (not off the key) but need the key to start up.

So if you are remotely servicing Windows 10 computers without TMP, they need to be able to start themselves so that the encryption key can be on the flash drive.
0
 
LVL 25

Author Comment

by:Fred Marshall
ID: 41777406
John,  Yes, I understand.  The "startup key" is what I referred to as a "boot key" as it's needed to boot.

But what about the recovery key that can be saved to a text file?  It sounds like it's a different animal.
0
 
LVL 92

Expert Comment

by:John Hurst
ID: 41777408
The encryption key is not a text file. You cannot do anything with it except have it there at boot time. That is for Bitlocker that you mentioned.

What otherwise would you mean by recovery key?

I am not sure just how you would start up with a boot drive in the USB slot when you need the encryption drive as well.
0
 
LVL 25

Author Comment

by:Fred Marshall
ID: 41777438
John,

The boot drive is the encrypted hard drive.
The boot key OR startup key is on a USB drive.

Regarding the "recovery key" on the page you linked:

Next you’ll need to choose a secure password that will be used to access the drive.
You’re prompted to store the recovery key which is used in the event you lose your password or smartcard.   If you store it as a file make sure that it’s not on the same drive that you’re encrypting.
The screen shot shows clearly that this may be saved on a USB drive, as a .txt file or may be printed.  
I'm trying to understand how it's used: "in case you lost the password"...... ????
0
Give your grad a cloud of their own!

With up to 8TB of storage, give your favorite graduate their own personal cloud to centralize all their photos, videos and music in one safe place. They can save, sync and share all their stuff, and automatic photo backup helps free up space on their smartphone and tablet.

 
LVL 28

Accepted Solution

by:
Michael Pfister earned 250 total points
ID: 41777607
The recovery key can be entered manually in case your stick gets damaged/lost/eaten by the cat.
Don't save it on the stick but place it somewhere where you have access in an emergency.
Anyway you can't do that remotely you have to be on the local console.
0
 
LVL 92

Assisted Solution

by:John Hurst
John Hurst earned 250 total points
ID: 41777826
this may be saved on a USB drive, as a .txt file or may be printed

My apologies. I misinterpreted that (upon reading it again).

So try a test. May you can do this with one USB key. Test first.

From your first question "I'm wondering if the required USB drive for booting can be left in the computer?"

The answer to your question remains: yes.
0
 
LVL 25

Author Comment

by:Fred Marshall
ID: 41778409
mpfister:  But I don't want it to be eaten by the cat!  :-)
I'm guessing that having a spare USB stick is the likely approach as these computers are remote.
I can ask that one be rebooted but that's about all because they are ALSO headless.  So without some trouble, no typing at all.
0
 
LVL 25

Author Comment

by:Fred Marshall
ID: 41790338
thanks
0
 
LVL 25

Author Closing Comment

by:Fred Marshall
ID: 41790341
thanks
0
 
LVL 92

Expert Comment

by:John Hurst
ID: 41790347
You are very welcome Fred, and I was happy to work with you.
0
 
LVL 28

Expert Comment

by:Michael Pfister
ID: 41790829
@Fred: You never know ... maybe it has some "mouse" driver on it... sorry ... couldn't resist ;-)
0

Featured Post

Network it in WD Red

There's an industry-leading WD Red drive for every compatible NAS system to help fulfill your data storage needs. With drives up to 8TB, WD Red offers a wide array of solutions for customers looking to build the biggest, best-performing NAS storage solution.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
File Sharing with Apple and Windows 7 40
By pass website on ASA for Websense 4 52
Problem to search 5 23
CPU at 100% usage, why? 27 26
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
How to record audio from input sources to your PC – connected devices, connected preamp to record vinyl discs, streaming media, that play through your audio card: Vista, Windows 7, Windows 8, Windows 8.1 and Windows 10 – both 32 bit & 64.
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now