What bitlocker configuration do you use and why

user1010 · Jul 21, 2024

What bitlocker configuration do you use and why?

Ghot · Jul 21, 2024

I disabled the Bitlocker Service.

FreeBooter · Jul 21, 2024

You will be delighted to know that Windows 10 and Windows 11 lets you enhance your files security with the help of BitLocker Encryption Method and Cipher Strength. It becomes important for you to protect your crucial data from going it into the inappropriate hands. But to offer more safety to your drives, you can modify encryption mode and cipher strength accordingly.

Windows 10 (version 1511) introduces a new disk encryption mode (XTS-AES). This mode provides additional integrity support, but is not compatible with older versions of Windows.

You could also select to use disk encryption Compatible mode (AES-CBC) that is compatible with older versions of Windows. If you're encrypting a removable drive that you're going to use on an older version of Windows, you should use AES-CBC.

Both BitLocker Drive Encryption modes above support using 128-bit or 256-bit cipher strength.

Windows 10 uses XTS-AES 128 bit by default for operating system drives as well as fixed data drives, and uses AES-CBC 128 bit by default for removable data drives.

BitLocker Drive Encryption is only available in Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education editions.

Set Default BitLocker Drive Encryption Method and Cipher Strength

1. Press the Windows + R keys to open the Run dialog, type gpedit.msc, and press the Enter key to open Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below.

Code:

Computer Configuration/Administrative Templates/Windows Components/BitLocker Drive Encryption

3. Shift to the right pane of BitLocker Drive Encryption and you can see a few policies. Here, locate and double-click the setting namely “Choose drive encryption method and cipher strength (Windows 10 (Version 1511) and later)“.

4. Click Enabled dot on the top left of the next window. This also enables the encryption method for OS, removable data drives, and fixed data drives as shown in the given screenshot. So, click each drop-down and select the mode as per preference.

5. Finally, click Apply and OK buttons to implement the encryption changes you made above.

Hopefully, with any of the above two procedures in Windows 10, you can pretty much easily modify BitLocker Encryption Method and Cipher Strength.

echo2446 · Jul 21, 2024

Defaults for fixed drives.
Compatible mode for the external drives, so that they will work with Windows 10.
Preboot PIN because there might be exploits to get around the Windows lock screen.
Recovery keys not saved to the MS cloud, but saved encrypted locally in multiple places. This is just in case MS account somehow gets breached, etc. Encrypted locally just in case the computer gets breached.
Password protections for all non-system drives, because they may be less cumbersome than the recovery keys.
TPM protection for all drives, for ease of access.

hsehestedt · Jul 21, 2024

echo2446 said:
Compatible mode for the external drives, so that they will work with Windows 10.

You do not need compatible mode for Win 10. It supports the enhanced mode directly.

cereberus · Jul 21, 2024

BruceR · Jul 21, 2024

Preboot authentication with a start-up PIN, as thousands of laptops get stolen every day (and TPM-only is not as secure).

BruceR · Jul 21, 2024

FreeBooter said:
BitLocker Drive Encryption is only available in Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education editions.

Not 11 then?

garlin · Jul 21, 2024

If you're on Home and have the right combination of Modern Standby, TPM 2.0, and a Microsoft Account – you can get Device Encryption. Which is really BitLocker under a different guise, but without any user settings other than On & Off.

user1010 · Jul 22, 2024

echo2446 said:
Defaults for fixed drives.

Compatible mode for the external drives, so that they will work with Windows 10.

Preboot PIN because there might be exploits to get around the Windows lock screen.

Recovery keys not saved to the MS cloud, but saved encrypted locally in multiple places. This is just in case MS account somehow gets breached, etc. Encrypted locally just in case the computer gets breached.

Password protections for all non-system drives, because they may be less cumbersome than the recovery keys.

TPM protection for all drives, for ease of access.

The same thing for saving Recovery keys in google drive? Like usb memory sticks?

Anyone know how much the performance will be affected?

echo2446 · Jul 22, 2024

user1010 said:
The same thing for saving Recovery keys in google drive? Like usb memory sticks?

Anyone know how much the performance will be affected?

Microsoft automatically saves the recovery keys to MS cloud for a reason, i.e. some consumers don't understand the tech and don't backup the keys anywhere, resulting in almost a certain loss of encrypted content in the future without the automatic save.

So, cloud backup is better than no backup, and it probably works splendidly for many people.

On the other hand, if you are already using 3-2-1 backup strategies, unencrypted automatic cloud backups are not needed, and will prevent people with access to your accounts (such as authorities) from having the unencrypted keys. Keep it encrypted (but you need to keep the password to decrypt it, maybe in a password manager, or keep the key in the password manager itself). Even, keep it offline.

The performance loss I heard was in a single percentage, which bore true with my own testings on SSD and HDD drives, but I have also heard that some people have experienced worse, at least some of the time.

user1010 · Jul 22, 2024

echo2446 said:
Microsoft automatically saves the recovery keys to MS cloud for a reason, i.e. some consumers don't understand the tech and don't backup the keys anywhere, resulting in almost a certain loss of encrypted content in the future without the automatic save.

So, cloud backup is better than no backup, and it probably works splendidly for many people.

On the other hand, if you are already using 3-2-1 backup strategies, unencrypted automatic cloud backups are not needed, and will prevent people with access to your accounts (such as authorities) from having the unencrypted keys. Keep it encrypted (but you need to keep the password to decrypt it, maybe in a password manager, or keep the key in the password manager itself). Even, keep it offline.

The performance loss I heard was in a single percentage, which bore true with my own testings on SSD and HDD drives, but I have also heard that some people have experienced worse, at least some of the time.

LastPass maybe, or Keepass.

Rather save in the google drive if I lost the password somehow. For what reason should authorities use the keys and are you meaning in US now?

Bree · Jul 22, 2024

FreeBooter said:
BitLocker Drive Encryption is only available in Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education editions.

I guess that was originally written before Windows 11 came out, it's the same for 11, Bitlocker is available in Pro, Enterprise and Education editions

garlin said:
If you're on Home and have the right combination of Modern Standby, TPM 2.0, and a Microsoft Account – you can get Device Encryption. Which is really BitLocker under a different guise, but without any user settings other than On & Off.

A clean install of 11 (including Home) on a compliant device will have Device Encryption turned on and set as 'unlocked'. For Pro it will then suggest you turn on BitLocker.

Personally I feel this is all an unnecessary complication for my devices that are never going to go outside my home, so the first thing I do is remove device encryption with manage-bde C: -off

user1010 · Jul 22, 2024

Bree said:
Personally I feel this is all an unnecessary complication for my devices that are never going to go outside my home, so the first thing I do is remove device encryption with manage-bde C: -off

Why?

Bree · Jul 22, 2024

user1010 said:
Why?

What protection does Device Encryption (as opposed to bitlocker) provide? Very little, really.

It's completely transparent to the Windows user, being 'open' means they never need (or even see) a key to boot into the installed Windows. The only protection is that it makes the drive unreadable if removed from the PC, or when booted from a USB with another OS (such as WinRE, Linux, Reflect rescue, etc.). As the last is something I'll often do then I prefer my drives unencrypted.

user1010 · Jul 22, 2024

Bree said:
The only protection is that it makes the drive unreadable if removed from the PC, or when booted from a USB with another OS (such as WinRE, Linux, Reflect rescue, etc.).

Seems enough.

echo2446 · Jul 22, 2024

user1010 said:
LastPass maybe, or Keepass.

Rather save in the google drive if I lost the password somehow. For what reason should authorities use the keys and are you meaning in US now?

Yeah, in the US, they can subpoena your keys from Microsoft. In other countries, it may be more challenging, but some might resort to pressuring you until you comply.

user1010 · Jul 22, 2024

echo2446 said:
Yeah, in the US, they can subpoena your keys from Microsoft. In other countries, it may be more challenging, but some might resort to pressuring you until you comply.

Hehe ok. I guess that is a problem when you do something you shouldn't.

FreeBooter · Jul 22, 2024

Bree said:
I guess that was originally written before Windows 11 came out, it's the same for 11, Bitlocker is available in Pro, Enterprise and Education editions

A clean install of 11 (including Home) on a compliant device will have Device Encryption turned on and set as 'unlocked'. For Pro it will then suggest you turn on BitLocker.

Personally I feel this is all an unnecessary complication for my devices that are never going to go outside my home, so the first thing I do is remove device encryption with manage-bde C: -off

Yes @Bree old archived tutorial i had.

user1010 · Jul 22, 2024

@FreeBooter it seems that it's only possible to encrypt my C drive. My other disk/volumes isn't available if I go to Manage BitLocker. F: is a usb-drive and is encrypted since earlier.

What bitlocker configuration do you use and why

Active member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computers

Active member

My Computer

Well-known member

My Computers

Active member

My Computer

Well-known member

My Computer

Active member

My Computer

Well-known member

My Computer

Active member

Attachments

My Computer

Similar threads