Device encryption in Windows - BitLocker recovery screen

Looking for:

- Bitlocker software for windows 10 

Click here to DOWNLOAD

     

Bitlocker software for windows 10.Overview of BitLocker Device Encryption in Windows

 

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. Network Unlock was introduced in Windows 8 and Windows Server as a BitLocker protector option for operating system volumes. Network unlock enables easier management for BitLocker-enabled desktops and servers in a domain environment by providing automatic unlock of operating system volumes at system reboot when connected to a wired corporate network.

This can make it difficult to enterprises to roll out software patches to unattended desktops and remotely administered servers. Rather than needing to read the StartupKey from USB media, however, the Network Unlock feature needs the key to be composed from a key stored in the TPM and an encrypted network key that is sent to the server, decrypted and returned to the client in a secure session.

Network Unlock must meet mandatory hardware and software requirements before the feature can automatically unlock domain-joined systems. These requirements include:. The network stack must be enabled to use the Network Unlock feature. Equipment manufacturers deliver their products in various states and with different BIOS menus; therefore, you need to confirm that the network stack has been enabled in the BIOS before starting the computer.

On computers that run Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP. This adapter must be used for Network Unlock. For network unlock to work reliably on computers running Windows 8 and later versions, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP and must be used for Network Unlock.

This is especially worth noting when you have multiple adapters, and you wish to configure one without DHCP, such as for a lights-out management protocol.

This configuration is necessary because network unlock stops enumerating adapters when it reaches one with a DHCP port failure for any reason. Thus, if the first enumerated adapter does not support DHCP, is not plugged into the network, or fails to report availability of the DHCP port for any reason, then Network Unlock fails.

This feature is a core requirement. The network key is stored on the system drive along with an AES session key and encrypted with the bit RSA public key of the Unlock server certificate. The network key is decrypted with the help of a provider on a supported version of Windows Server running WDS, and returned encrypted with its corresponding session key.

The unlock sequence starts on the client side when the Windows boot manager detects the existence of network unlock protector. The Network Unlock provider on the supported WDS server recognizes the vendor-specific request, decrypts it with the RSA private key, and returns the network key encrypted with the session key via its own vendor-specific DHCP reply.

On the server side, the WDS server role has an optional plugin component, like a PXE provider, which is what handles the incoming network unlock requests. You can also configure the provider with subnet restrictions, which would require that the IP address provided by the client in the network unlock request belong to a permitted subnet to release the network key to the client.

In instances where the Network Unlock provider is unavailable, BitLocker fails over to the next available protector to unlock the drive. This certificate must be managed and deployed through the Group Policy editor directly on a domain controller with at least a Domain Functional Level of Windows Server This certificate is the public key that encrypts the intermediate network key which is one of the two secrets required to unlock the drive; the other secret is stored in the TPM.

Manage and deploy this certificate through the Group Policy editor directly on a domain controller that has a domain functional level of at least Windows Server This certificate is the public key that encrypts the intermediate network key. The intermediate network key is one of the two secrets that are required to unlock the drive; the other secret is stored in the TPM. The following steps allow an administrator to configure network unlock in a domain where the Domain Functional Level is at least Windows Server You can configure using the WDS management tool, wdsmgmt.

To confirm that the service is running in Services Management Console, open the console using services. A properly configured Active Directory Services Certification Authority can use this certificate template to create and issue Network Unlock certificates. Locate the User template, right-click the template name and select Duplicate Template.

On the Compatibility tab, change the Certification Authority and Certificate recipient fields to Windows Server and Windows 8, respectively. Ensure that the Show resulting changes dialog box is selected.

Select the General tab of the template. The Template display name and Template name should clearly identify that the template will be used for Network Unlock. Clear the check box for the Publish certificate in Active Directory option.

Select the Request Handling tab. Select Encryption from the Purpose drop-down menu. Ensure that the Allow private key to be exported option is selected. Select the Cryptography tab. Set the Minimum key size to Any Microsoft cryptographic provider that supports RSA can be used for this template, but for simplicity and forward compatibility, we recommend using Microsoft Software Key Storage Provider. Select the Requests must use one of the following providers option and clear all options except for the cryptography provider you selected, such as Microsoft Software Key Storage Provider.

Select the Subject Name tab. Select Supply in the request. Click OK if the certificate templates pop-up dialog appears.

Select the Issuance Requirements tab. Select both CA certificate manager approval and Valid existing certificate options. Select the Extensions tab. Select Application Policies and choose Edit…. On the Add Application Policy dialog box, select New. In the New Application Policy dialog box, enter the following information in the space provided and then click OK to create the BitLocker Network Unlock application policy:.

Select the Allow key exchange only with key encryption key encipherment option. Select the Make this extension critical option. Select the Security tab. Confirm that the Domain Admins group has been granted Enroll permission. To add the Network Unlock template to the certificate authority, open the certificate authority snap-in certsrv. Select the previously created BitLocker Network Unlock certificate.

After you add the Network Unlock template to the certificate authority, you can use this certificate to configure BitLocker Network Unlock. Network Unlock can use imported certificates from an existing public key infrastructure PKI. Or it can use a self-signed certificate. Choose the certificate template that was created for Network Unlock on the domain controller.

Then select Enroll. When you're prompted for more information, select Subject Name and provide a friendly name value. Your friendly name should include information for the domain or organizational unit for the certificate. Open an elevated command prompt and use the certreq tool to create a new certificate. Use the following command, specifying the full path to the file that you created previously. Also specify the file name. Verify that certificate was properly created by the previous command by confirming that the.

Create a. Follow through the wizard to create the. Now that you've created the certificate and key, deploy them to the infrastructure to properly unlock systems. To deploy the certificates:. With certificate and key deployed to the WDS server for Network Unlock, the final step is to use group policy settings to deploy the public key certificate to computers that you want to be able to unlock using the Network Unlock key. The following steps describe how to enable the group policy setting that is a requirement for configuring network unlock.

Create a new Group Policy Object or modify an existing object to enable the Allow network unlock at startup setting. Only one network unlock certificate can be available at a time. If you need a new certificate, delete the current certificate before you deploy a new one. By default, all clients with the correct network unlock certificate and valid Network Unlock protectors that have wired access to a network unlock-enabled WDS server via DHCP are unlocked by the server.

A subnet policy configuration file on the WDS server can be created to limit which are the subnet s the network unlock clients can use to unlock. The configuration file, called bde-network-unlock. If the subnet configuration policy becomes corrupted, the provider fails and stops responding to requests. The named subnets may then be used to specify restrictions in certificate subsections.

Subnets are defined as simple name—value pairs, in the common INI format, where each subnet has its own line, with the name on the left of the equal-sign, and the subnet identified on the right of the equal-sign as a Classless Inter-Domain Routing CIDR address or range.

Following the [SUBNETS] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define the subnets clients that can be unlocked from that certificate. When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint, the subnet configuration fails because the thumbprint will not be recognized as valid.

Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnets are listed in a certificate section, then only those subnets are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every network unlock certificate on the server, and an explicit allowed list set for each certificate section.

Subnet lists are created by putting the name of a subnet from the [SUBNETS] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet s specified as in the list.

For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. However, to stop clients from creating network unlock protectors, the Allow Network Unlock at startup group policy setting should be disabled.

When this policy setting is updated to disabled on client computers, any Network Unlock key protector on the computer is deleted.