In this demonstration, we'll look at BitLocker,
deployment, configuration, setup, Active Directory,
key escrow,
and then we'll test the process of putting a server in recovery
mode and retrieving the key from Active Directory.
So we're looking at the desktop of my domain controller,
a Windows Server 2022 machine.
And to set the stage here,
we'll want to do our work in not Active Directory Users and Computers,
but let me instead go to Run gpmc.msc to bring up the
Group Policy Management console, and we'll edit the Default Domain Policy,
and let me show you where the appropriate BitLocker
Drive Encryption policies are.
Let's go under Policies, Administrative Templates,
Windows Components, BitLocker Drive Encryption.
And I've set a couple of policies here I want to show you.
First of all, at the root level here under BitLocker Drive Encryption,
we have the policy.
Let me stretch this out for you,
Store BitLocker recovery information in Active Directory Domain Services.
So I've enabled the policy, and I'm going to require BitLocker backup to AD DS,
and your choices are to backup just the recovery password or
the recovery password with the key package.
I'm just going to do recovery password backup here.
And so the benefit here, the use case,
is that your support staff then will have a way to help your users
unlock their drives if they're in recovery mode and they don't
happen to have the password themselves, all right?
Let's cancel out of there because I've already set this policy.
And then we have separate folders for Fixed Data Drives,
Operating System Drives, and Removable Drives.
Let's go to Operating System Drives.
And I'd mentioned the Network Unlock,
that's just something you can enable or not,
and this will allow when your server is on your domain LAN,
you can do remote management by rebooting and transparently unlocking
the system even if it's set with a PIN protector.
We've got require additional authentication.
This is a common choice,
used to be more common in years back before the TPM became a
pretty standard component on system motherboards.
But I actually, in my lab, don't have TPM available,
so I'm specifying to allow BitLocker without a compatible TPM.
And I'm setting all of these policies down here not to work with TPM.
Anything else here?
Yes, choose how BitLocker‑protected operating system drives can be recovered.
I'm going to allow not only the data recovery agent,
which is a way to delegate the ability for people to
recover BitLocker recovery systems, but beyond that,
I'm going to configure user storage of BitLocker recovery
information and save BitLocker recovery information to AD
DS for operating system drives.
And I'm again just going to store the recovery passwords.
So I've put all of those policies into effect, so they are currently in use.
And next,
let me show you the workflow for deploying or setting up BitLocker on a Windows
Server system just to make sure you understand the workflow.
Here we are on my MEM1 server.
I'm going to open up Start and look for BitLocker.
Let's go to the BitLocker Control Panel.
If it doesn't open,
which it appears to not be available yet on this
system. Let me try one more thing.
Let me go to old‑fashioned Control Panel here.
Yes,
I forgot that I took it for granted or started to take it for granted
that in Server BitLocker is not installed by default,
so I could do this with PowerShell.
But I won't,
I'll actually set this up the old‑fashioned way by
going through Add Roles and Features.
This is good practice for us anyway, actually.
So let me step in past the roles and go to features,
and I'm going to do BitLocker Drive Encryption set up here,
and then click Next.
Restart if necessary, then install.
As I was saying a moment ago,
the taking for granted meant that this BitLocker is
natively available in Windows client, but not on Server.
Okay, so coming back from the reboot on the server.
Now that I've installed BitLocker, it is,
in fact, available in the good old‑fashioned Control Panel.
And as we can see, BitLocker Drive Encryption can affect both your system,
your OS drive, any other fixed data drives,
and then we have BitLocker To Go for our USB flash drives and removable disks.
I'm going to turn on BitLocker.
There we go,
this is a good real‑world example where starting
BitLocker has run into an issue here,
so this could very well be maybe this server hasn't yet
ingested the Group Policy that allows for no TPM.
I'll have to investigate that.
And through the magic of video editing, I'm now able to proceed to the next step.
And what the problem turned out to be, I was clicking
too fast on domain controller one.
Let me quickly show you.
So if we come back to that Group Policy way down
under BitLocker Drive Encryption, Operating System Drive,
we require additional auth at startup.
I should have had configure TPM startup PIN set to
allow instead of do not allow, that was the conflict in question.
I assumed that this had to do with TPM. No,
it's just the personal identification number.
Since we're not using TPM, we're going to have to use the PIN protector.
Okay, so we're asked first,
how are we going to unlock the drive at startup? Are we
going to do a USB dongle or a password?
I'm going to do a password, so let me type that password in and confirm it.
This will be the PIN.
And then we can back up our recovery key to a number of different locations,
print, save to file.
Now,
I found that BitLocker can be a bit strange if you
don't have another data drive,
it won't let you save the recovery key to the C drive,
which makes sense.
So let me choose Print, Print to PDF. ?=And again,
I might run into some problems here unless I choose another location.
So why don't I go to DC1, shares, and I'll call this mem1‑bitlocker‑key,
that PDF.
Okay, good, so let's click Next.
How much of the drive do we want to encrypt?
Encrypt used space only, faster encrypt entire drive,
slower for drives that are already in use.
Well, this is a new server.
Are we going to use stronger encryption 256 or 128?
I'm going to choose new.
Are we going to run the system check first?
That's always a good idea.
And then it will restart the computer before encrypting,
that'll run down in the notification area or the
system tray after the machine restarts.
So there we go, encryption will begin after computer restart.
Click here.
So let's restart, and I'll see you on the other side.
All right, I'm back from the reboot,
and let me show you the screen I saw when I rebooted the machine.
So when you're using the PIN protector,
the downside there is that you have to interactively
use a password to unlock the drive.
The downside, though, as I'd mentioned before,
if you're not using Network Unlock,
you could run into problems with servers and data
centers that you're remotely servicing,
and you cannot interactively get to the keyboard and terminal like that,
you know, but that's what we've got today with this Pin protector.
And if I come down in the system tray,
I can see that BitLocker Drive Encryption is in progress here,
and it looks like it's almost completed.
That's good to see.
And then if we click Manage BitLocker, that brings us back to the Control Panel,
where we can make another backup of our recovery key,
can change or remove the PIN, we can turn off BitLocker Drive Encryption.
Now there's also a manage‑bde command that we can use.
Let me bring out a elevated PowerShell console here.
And again, typically,
let me change the font and size to make it a bit easier to read.
Manage‑bde is the non‑PowerShell,
the decidedly non‑PowerShell BitLocker Drive
Encryption Tool. And as you can see,
it has a number of parameters where you can work with the service.
But what we're going to do is a ForceRecovery,
and that's nice because that's a fire drill exercise that gives you an
opportunity to see what the unlock process is if BitLocker is in a state
where it thinks that maybe the drive has been stolen or the drive has
been put in another computer chassis, in other words,
the normal state of operations has been interrupted.
Another thing we can take a look at here if I clear the screen
is let's do a get command using PowerShell.
And I'm going to do where the verb is get and where the noun includes bitlocker.
I'll do a fuzzy match, so it looks like there's Get‑BitLockerVolume.
Actually, let's try something else,
Get‑Command from the module BitLocker to see all of
the commands that are in there.
So here we can get BitLocker information,
we can do enable and disable,
so this would be for programmatic use where you want to manage BitLocker on,
say,
a whole bunch of servers and issue a script once
instead of having to do all this clicky,
clicky stuff that we're doing manually, ain't nobody got time for that.
So let's force recovery, and let me show you how that works.
Manage‑bde ‑forcerecovery, whoops, I didn't get the syntax quite right.
I have to add which volume it is that we're going to force recovery on.
I'm going to do C. Okay, so let's do a restart‑computer ‑force to go into recovery mode.