Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a few dozen employee thumbdrives that carry sensitive information. We'll be using TrueCrypt to lock down these drives.

Each thumbdrive will typically be in a single employee's possession, and I would like for them to be able to change their own password at will. However, I would also like to make the encryption process as transparent as possible, by having a sort of 'master' keyfile for each drive placed on trusted machines. These trusted machines are secured with BitLocker, so I'm not worried about a third party getting their hands on them.

In essence, I'd like to be able to open the volume using EITHER:

  • A password-protected keyfile that travels with the volume,

OR:

  • A keyfile located in a known directory on a trusted machine, which will not require a password.

Is this doable without purchasing fobs for each employee?

share|improve this question

1 Answer 1

There is a way to create a masterpassword that an admin can use if the user has changed and forgotten their password.

in general you create the volume, set your master password, and extract the volume header to a file that you will keep safe (right?). then you can make a copy of the volume for each users thumg. they will be able to change the password if they like.

when they forget it, you just take their volume, reapply your original header, and login.

see instructions here: http://www.experts123.com/q/we-use-truecrypt-in-a-corporate-enterprise-environment-is-there-a-way-for-an-administrator-to-reset-a-volume-password-or-pre-boot-authentication-password-when-a-user-forgets-it-or-loses-a-keyfile.html

share|improve this answer
    
I've come across that in the documentation, but it doesn't quite do everything I'd like. I want to keep the process as transparent as possible, so that the users aren't prompted to enter their password when plugging their stick into a trusted machine. Modifying the header on the container is a possible solution, but I'd like to avoid modifying the volume every time the stick is used on a trusted box. –  Ed Penwell Feb 12 '13 at 14:16

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.