How to manage BitLocker?

BitLocker is Microsoft’s built-in full volume encryption tool for Windows PC that enforces encryption on OS drives, fixed data drives, and removable drives for data protection. BitLocker encryption helps prevent unauthorized access to data on lost or stolen devices by encrypting the entire Windows operating system volume on the hard disk and verifying the boot process integrity. When used in conjunction with TPM versions 1.2 and above, BitLocker can validate system files and boot activity. The Device encryption feature on Windows devices automatically activates the BitLocker on Windows 10 or later devices. This automatic activation occurs when a user signs in for the first time with a personal Microsoft account or a work/school account. The Device encryption feature itself serves as a mechanism that facilitates this process, ensuring BitLocker is automatically engaged upon login. This enhances data security without requiring the users to manually enable encryption. Hexnode UEM enables you to set up and manage BitLocker policy to help you configure encryption and recovery settings on Windows devices remotely.

Configure BitLocker encryption with Hexnode UEM

1. Log in to your Hexnode UEM portal. Navigate to the Policies tab. Click on New Policy to create a new one.
   (or)
   Click on any policy to edit an existing one. Enter the Policy Name and Description in the provided fields.
2. Navigate to Windows > Select BitLocker under Security.
3. Click on Configure.
4. Configure BitLocker settings.

Recovery Password rotation

Configure Recovery Password rotation

OS Drive Settings

Configure BitLocker OS drive policy

Fixed Drive Settings

Configure BitLocker fixed drive policy

Removable Drive Settings

Configure BitLocker removable drive policy

How to check whether your device has a compatible TPM?

Method 1

1. Press Win+R and open Run > Type tpm.msc > Click OK to open the TPM Management snap-in console.
2. It will show whether your device has a compatible TPM or not.

Method 2

1. Press Win+R and open Run > Type tpm.msc > Click OK to open the Device Manager.
2. Check to see if you have Security devices listed. If yes, expand Security devices to see if you can see a TPM with its version number.

Method 3

Beginning with Windows 10, version 1803, you can check TPM status in Windows Defender Security Center > Device Security > Security processor details.

Apply the BitLocker configuration to target entities using Hexnode UEM

There are two ways by which you can associate restrictions to the devices in bulk.

If you haven’t saved the policy yet,

1. Navigate to Policy Targets.
2. Click on + Add Devices, search and select the required device(s) to which you need to apply the policy. Click OK.
3. Click on Save to apply the policies to the devices.

If you’ve already saved the policy and taken to the page which displays the policy list,

1. Select the required policy.
2. Click on Manage and select Associate Targets.
3. Search and select the devices/ users/ device groups/ user groups/ domains to which you need to apply the policy. Click Associate.

Note:

• Applying the BitLocker policy to a device with Device encryption enabled will result in policy failure. For the successful application of the BitLocker policy, it is mandatory to manually decrypt the BitLocker beforehand. Users can verify whether the Device encryption feature is already enabled on their device by navigating to Settings > Privacy and security > Device encryption before applying the policy.
• Once the BitLocker policy is applied to your Windows PC, fixed data drives and removable data drives become write-protected (if the appropriate options are checked) until the BitLocker encryption is completed from the user end.

Possible group policy conflicts

1. When write access to drives not protected by BitLocker is denied, the use of a USB startup key cannot be required.
   
2. Storing recovery information to Active Directory Domain Services cannot be required when the generation of recovery passwords is not permitted.
3. When the OS drive is to be encrypted, if the device has no compatible TPM, “Allow BitLocker without a compatible TPM” should be checked.
   
4. You cannot create both a recovery key and a recovery password at the same time.
   
5. If one startup authentication method is required, the other method cannot be allowed. If you require the startup key, you must not allow the startup PIN and vice versa.
6. If the deny write access to removable drives not protected by the BitLocker policy setting is enabled, the option to generate a recovery key must be disallowed.
7. Backup of BitLocker recovery information to AD DS must be enabled if both the recovery options are disallowed.