{"id":2369,"date":"2014-06-25T09:21:09","date_gmt":"2014-06-25T14:21:09","guid":{"rendered":"http:\/\/www.poweradmin.com\/blog\/?p=2369"},"modified":"2015-04-24T16:08:01","modified_gmt":"2015-04-24T21:08:01","slug":"bitlocker-and-windows-server-2008","status":"publish","type":"post","link":"https:\/\/www.poweradmin.com\/blog\/bitlocker-and-windows-server-2008\/","title":{"rendered":"BitLocker and Windows Server 2008"},"content":{"rendered":"

\"BitlockerWhen planning a BitLocker deployment<\/a> in your Windows Infrastructure, you\u2019ll need to take into consideration many factors that can\/will influence your network. This technology was first released with Windows Vista and introduced two important security features: encryption of hard drives and integrity check <\/em>for data. This means that if a device was stolen, no data could be recovered from it since everything is encrypted. With BitLocker, not only is the OS encrypted, but also data, page file, applications and application configuration. There are several methods with which you can access encrypted information from a volume protected with BitLocker. One solution is to use a pre-configured key that grants access to the data. One big problem of using such keys is the fact that if those are lost, the entire system becomes untouchable and all data is lost.<\/span><\/p>\n

BitLocker is a feature included in different Windows Server 2008 editions<\/em><\/a> and you can add it using the Server Manager console. Note that one important requirement of BitLocker is the TPM (Trusted Platform Module)<\/em> chip and a BIOS <\/em><\/span>that supports it. These two components are needed when performing data integrity checks. With TPM, BitLocker verifies the startup information (Boot Sector, Windows Loader, BIOS, MBR and Boot Manager) of the Operating System and if some altered data is discovered, the volumes become locked and data cannot be accessed. This means that you will need to unlock the System using a BitLocker key. One problem for System Administrators is when there is any maintenance on<\/span> the BIOS level, because BitLocker locks the drives with every reboot. So you may end up recovering the System because the drive becomes unavailable.<\/span><\/p>\n

To configure BitLocker you will need to partition your hard drive correctly. You must first create an extra partition that is around 2 GB that\u2019s marked as active and will be used by BitLocker. Once you\u2019ve created this partition you can add more primary partitions but make sure there is plenty of space for the OS. To create a partition and mark it as active you will need to boot from the installation media in Recovery mode<\/em>. If you\u2019re using a<\/span> virtual machine in VMware, you will need to disable Easy Install and then boot in the installation media. At the installation page, select Repair your computer<\/em> and click Next<\/em> until you reach the System Recovery Options <\/em>and open a Command Prompt:<\/em><\/span><\/p>\n

<\/em>\"System<\/span><\/p>\n

For this operation we will use Diskpart<\/em> which is a partitioning tool provided by the OS. We will need to create at least two partitions, one for BitLocker and the other one for the OS, by typing the following commands:<\/span><\/p>\n

Diskpart <\/em><\/span><\/a><\/p>\n

List Disk<\/em><\/span><\/p>\n

Select Disk 0<\/em><\/span><\/p>\n

Clean<\/em><\/span><\/p>\n

With these commands we have listed the available disks and we\u2019ve selected the one that will be partitioned. Because my VM has only one disk, I\u2019ve selected it by using its Disk ID (0). The clean<\/em> command has been executed to empty the whole disk:<\/span><\/p>\n

\"Diskpart<\/span><\/p>\n

Now it\u2019s time to create the two partitions by executing the following commands:<\/span><\/p>\n

Create partition primary size =38000 <\/em>\u2013 the C partition in which the OS will be installed<\/span><\/p>\n

Assign letter C<\/em><\/span><\/p>\n

Create partition primary size 2000 <\/em>\u2013 The BitLocker partition<\/span><\/p>\n

Assign letter R<\/em><\/span><\/p>\n

Active <\/em>\u2013 we\u2019ve marked this partition as active<\/span><\/p>\n

\"Mark<\/span><\/p>\n

You can now execute list partition <\/em>command to verify if the partitions were created successfully. We\u2019ve created the partitions and it\u2019s time to format them as assigned a file system. Type exit<\/em> to return to CMD and execute the following commands:<\/span><\/p>\n

Format C: \/q \/fs:NTFS<\/em><\/span><\/p>\n

Format R: \/q \/fs:NTFS<\/em><\/span><\/p>\n

\/q <\/em>\u2013 performs a quick format \/fs<\/em> \u2013 used for selecting the file system, in this case NTFS<\/span><\/p>\n

\"CMD<\/p>\n

\u00a0<\/p>\n

Now close Command Prompt<\/em> and exit the Recovery console<\/em> then click Install Now<\/em>. Note that you will need to select the secondary partition (C) as the installation drive for the OS. Be patient because the install operation takes a long period of time:<\/span><\/p>\n

\u00a0<\/p>\n

\"Secondary<\/span><\/p>\n

\u00a0<\/p>\n

Navigate to local group policy to view the available BitLocker policies. My VM does not support TPM chip, so I will have to enable a policy that will bypass this missing component. Note that not all devices have a TPM chip included so if this is your case, you\u2019ll need to configure the Server to be unlocked using a startup password.<\/span><\/p>\n

Once you\u2019ve opened the console, navigate to Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption and view the available group policies:<\/span><\/p>\n

\u00a0<\/p>\n

\"Bitlocker<\/p>\n

\u00a0<\/p>\n

In group policy, navigate to Operating System Drives<\/em> and double click on Require additional authentication at startup (Windows Server 2008 and Windows Vista) <\/em>policy and Enable<\/em> it:<\/span><\/p>\n

\u00a0<\/p>\n

\"Require<\/p>\n

\u00a0<\/p>\n

I will not allow the startup key with TPM because I do not have such chip but, I will require startup PIN with TPM.<\/span><\/p>\n

Click on the Next Setting<\/em> button and enable enhanced PIN for startup<\/em>. This policy will allow complex unlock passwords that can use uppercase letters, lowercase letters, numbers, symbols and spaces.<\/span><\/p>\n

\u00a0<\/p>\n

\"Enable<\/p>\n

\u00a0<\/p>\n

In the next policy we will set a minimum password length of 8 characters:<\/span><\/p>\n

\u00a0<\/p>\n

\"Set<\/span><\/p>\n

After you\u2019ve enabled all these policies you\u2019ll need to execute gpupdate \/force<\/em> from Command Prompt to update the server with the latest policies:<\/span><\/p>\n

\u00a0<\/p>\n

\"Execute<\/span><\/p>\n

\u00a0<\/p>\n

Open Server Manager Console<\/em>, navigate to the Features section and add click on Add Features<\/em>. From the features list select BitLocker Drive Encryption<\/em> and wait for the installation to finish. When the installation is completed, the server will require a reboot.<\/span><\/p>\n

\"Select<\/span><\/p>\n

\u00a0<\/p>\n

We will enable BitLocker Drive Encryption<\/em> on our C partition. Open Control Panel<\/em> and navigate to \\System and Security\\BitLocker Drive Encryption<\/em> and click on Turn on BitLocker:<\/em><\/span><\/p>\n


\n\"Turn
\n<\/em><\/span><\/p>\n

Note that the whole BitLocker operation will take a long period of time (from one to several hours) so you can do other things in the meantime. Follow the BitLocker Wizard and prepare a USB drive on which you\u2019ll save the BitLocker Recovery Key. Once the encryption is completed, a reboot will be necessary. With all these things configured, you\u2019ll now have a Windows Server 2008 protected with BitLocker.<\/span><\/p>\n

After reading this article I hope you will be able to configure BitLocker on your Windows Server without encountering too many problems. For any misunderstandings, don\u2019t hesitate to post a comment in our dedicated section and I will respond as soon as possible. Wish you all the best and stay tuned for the following articles.<\/span><\/p>\n

\u00a0<\/p>\n

\"Tweet<\/a><\/p>\n

\"Share<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

When planning a BitLocker deployment in your Windows Infrastructure, you\u2019ll need to take into consideration many factors that can\/will influence your network. This technology was first released with Windows Vista and introduced two important security features: encryption of hard drives and integrity check for data. This means that if a device was stolen, no data […]<\/p>\n","protected":false},"author":4,"featured_media":2393,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,5,13,9,8],"tags":[],"class_list":["post-2369","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general-it","category-how-to","category-pc-security","category-technical","category-windows"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts\/2369","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/comments?post=2369"}],"version-history":[{"count":5,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts\/2369\/revisions"}],"predecessor-version":[{"id":3485,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/posts\/2369\/revisions\/3485"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/media\/2393"}],"wp:attachment":[{"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/media?parent=2369"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/categories?post=2369"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.poweradmin.com\/blog\/wp-json\/wp\/v2\/tags?post=2369"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}