BitLocker Drive Encryption Yet, again,
this isn't anything new in Windows Server 2022.
It's an at rest volume encryption technology that's been around in
Windows client and Windows Server for many years.
It's offering in Windows Server 2022 128 or 256‑bit
AES encryption of the entire volume.
And the value proposition is if someone were to,
say,
steal a server or just steal the disks out of the server
chassis and attempt to mount them elsewhere,
unless they have the BitLocker key,
they're not going to be able to see any data on the entire volume.
So this gives you fundamental data privacy.
However,
BitLocker also has a number of choices in terms of
how you're doing your protectors.
Startup integrity means that that BitLocker drive is attached
or keyed to the Trusted Platform Module,
or TPM, chip on the server's motherboard.
And this means that the state of that disk during startup is evaluated,
and if too many changes, let's say, were to happen to a motherboard,
where if you did a RAM upgrade and swapped a data
drive out and upgraded a processor,
BitLocker may very well think that the drives are on a
different chassis and would prevent boot.
So it gives you startup integrity in addition to data privacy.
There's a capability of BitLocker called Network Unlock,
and this is useful, for instance, if you,
as an administrator, need to service servers or frankly,
more commonly, client devices that may have the TPM plus PIN,
or personal identification number,
protectors where instead of the machine booting and whereas
if you're just using the TPM protector,
the machine will boot as long as the startup environment is fine,
and as long as the TPM chip is available and everything looks good,
the machine is allowed to boot up to the logon screen.
But if you've got the PIN protector, that would require an administrator,
or if this were a client device, the user to enter that PIN every startup,
and that's not going to work if you're doing remote servicing.
So in an Active Directory domain environment,
Network Unlock allows you to store that PIN in AD and
be able to do remote administration,
including remote boot and reboot without having to worry about
getting hung up at a BitLocker PIN prompt.
BitLocker is available for Windows Server,
Windows client, as well as Azure Windows Server virtual machines.
Now I tentatively mentioned MBAM to you.
I doubt seriously you'll see a reference to it on the exam,
but I also want to deliver as much real‑world value to you as I can.
MBAM stands for Microsoft BitLocker Administration and Monitoring.
It's part of the MDOP toolkit, the Microsoft Desktop Optimization Pack,
and the main value prop that MBAM gives you is what you see on the screenshot.
You basically are able to give your users a self‑service web portal
where they can retrieve the recovery key if it's lost,
if their machine is locked and they have to go into BitLocker drive recovery.
You know, there's a number of reasons that might trigger BitLocker recovery,
and if they don't have the key accessible,
this provides them an alternate way to get the key.
Of course,
they'd have to be on another machine and be able to sign
into your corporate MBAM web instance here.
Now this product, the MDOP and MBAM specifically,
are out of mainstream support already as of this recording in Spring 2022,
and they'll be out of extended support on July 9th of 2024.
So I mention this just because it's relevant to a discussion of BitLocker.
I would not recommend you install MBAM in a production environment,
or if you do, just understand you're basically on your own with it.
I think you're going to find that the native Active Directory
BitLocker key recovery that we'll look at next,
generally speaking, is a better solution, if for no other reason AD BitLocker key recovery is in mainstream support.