4

How to prevent auto unlocking drives from my laptop when my windows password changed? Hack or change my account password to much more easy than decrypt disk, but why windows doesn't provide such functionality from the box? I looking for any scripts to auto unlock from powershell also.

I'm not going to "just disable unblock". It's very useful thing. I have too many things which starts from encrypted volume. I want to prevent access to my volume only just getting my account. If my system administrator account could be hacked, all sensitive data would be lost.

Steps to reproduce:

  1. Login into your account
  2. Set up bitlocker, auto-unlock
  3. Restart PC and login into account
  4. Drive unlocked
  5. Logout from account (I switched off whole PC)
  6. Ask sysadmin to change your password to new one
  7. Login into your account with new password

Expected result: bitlocker drive locked

Actual result: drive unlocked

  • 1
    Not exactly sure what you're asking, because someone with your password doesn't have to change it to access the encrypted files? – Mario Sep 25 '16 at 6:17
  • I have encrypted volume and have enabled autounlock. For instance, my account was hacked and anybody can get access to my encrypted volume. But in case when you should know password from account to unlock volume it becomes same level of difficulty to unlock. Did you get my point? – Georgy Grigoryev Sep 25 '16 at 9:34
  • Not really sure. You mean someone gains access to your account without them knowing your account password? How would they be able to login to begin with? – Mario Sep 25 '16 at 10:01
  • reset through email, or secret question, or sysadmin request password change. Is it not enough? – Georgy Grigoryev Sep 25 '16 at 10:03
  • Ah, okay. So in these cases the attacker can set a new password. That's the password change you're talking about? But wouldn't the attacker then be able to use that new password to remount your drive? Or would that be a different one? – Mario Sep 25 '16 at 10:06
1

Disabling BitLocker Auto-Unlocking Features

You could just disable the BitLocker auto-unlocking functionality altogether to give you what you are asking—to prevent auto-unlocking of BitLocker encrypted removable media or other drives where this is something you've configured.

Elevated Command Prompt or Batch Script

Replace G: with the applicable drive letter.

manage-bde -autounlock -disable G:

Powershell Specific Volume

Replace E: with the applicable drive letter but you can use the Disable-BitLockerAutoUnlock cmdlet to remove keys for specific volumes that use automatic unlocking.

Disable-BitLockerAutoUnlock -MountPoint "E:"

Powershell All Volumes

You can use the Clear-BitLockerAutoUnlock cmdlet to remove keys for all the volumes configured to use automatic unlocking instead of just specified volumes. This command clears all automatic unlocking keys stored on the current computer.

Clear-BitLockerAutoUnlock

Further Resources

  • Disable-BitLockerAutoUnlock

  • Clear-BitLockerAutoUnlock

  • Running Manage-bde.exe

  • Technet: Manage-bde

  • From an Elevated Command Prompt
    manage-bde /?
    
    BitLocker Drive Encryption: Configuration Tool version 10.0.14393 Copyright (C) 2013 Microsoft Corporation. All rights reserved.
    
    manage-bde[.exe] -parameter [arguments]
    
    Description:
        Configures BitLocker Drive Encryption on disk volumes.
    
    Parameter List:
        -status     Provides information about BitLocker-capable volumes.
        -on         Encrypts the volume and turns BitLocker protection on.
        -off        Decrypts the volume and turns BitLocker protection off.
        -pause      Pauses encryption, decryption, or free space wipe.
        -resume     Resumes encryption, decryption, or free space wipe.
        -lock       Prevents access to BitLocker-encrypted data.
        -unlock     Allows access to BitLocker-encrypted data.
        -autounlock Manages automatic unlocking of data volumes.
        -protectors Manages protection methods for the encryption key.
        -SetIdentifier or -si
                    Configures the identification field for a volume.
        -ForceRecovery or -fr
                    Forces a BitLocker-protected OS to recover on restarts.
        -changepassword
                    Modifies password for a data volume.
        -changepin  Modifies PIN for a volume.
        -changekey  Modifies startup key for a volume.
        -KeyPackage or -kp
                    Generates a key package for a volume.
        -upgrade    Upgrades the BitLocker version.
        -WipeFreeSpace or -w
                    Wipes the free space on the volume.
        -ComputerName or -cn
                    Runs on another computer. Examples: "ComputerX", "127.0.0.1"
        -? or /?    Displays brief help. Example: "-ParameterSet -?"
        -Help or -h Displays complete help. Example: "-ParameterSet -h"
    
    Examples:
        manage-bde -status
        manage-bde -on C: -RecoveryPassword -RecoveryKey F:\
        manage-bde -unlock E: -RecoveryKey F:\84E151C1...7A62067A512.bek
    
1

Windows protects most sensitive data (saved passwords, NTFS encrypted files, private keys for certificates, etc.) by encrypting them with a key that is derived from your password. When you change your password, it uses the old password to decrypt the data, and then re-encrypts the data using your new password. However, if an Administrator (or somebody who edits your hard drive, or something like that) forcibly resets your password, Windows doesn't have the original password needed to produce the key to decrypt the data. That data (encrypted files, etc.) is gone, forever.

I don't actually know for sure that BitLocker automatic-unlock keys are protected the same way as these other kinds of data, but I'd be very surprised if they aren't. Therefore, if the threat that you're worried about is somebody forcibly resetting your account's password, you're probably fine.

As a side note, if you're worried about threats like that, you ought to be using BitLocker on the boot hard disk (and any other internal disks) as well. That will not only protect the rest of your data, it will prevent an attacker from resetting your password using an offline attack.

  • No, not the same way. I checked: changed password and restart laptop - the same. I was surprised too! It's the most stupid thing in bitlocker – Georgy Grigoryev Sep 25 '16 at 13:39
  • Ooohh!! I got what you said! :) I'll ask my sys.admin to reset my password. – Georgy Grigoryev Sep 25 '16 at 14:20
  • Just checked: windows still unlocks you drive after changing password without your old one – Georgy Grigoryev Oct 4 '16 at 7:00
0

If password protection is not for you, then get a Smart Card reader and card

  • I can't get a Smart Card, because password is our company's policy. Nobody will get a smart card just because it's not for me – Georgy Grigoryev Sep 25 '16 at 9:39
0

BitLocker (To Go) auto-unlock doesn't offer protection from a malicious administrator who can force-reset your Windows account password to gain entry, because the auto-unlock key is not tied to your Windows credentials. However, if your BitLocker-protected drive is formatted with NTFS, then you can additionally use the Encrypting File System (EFS) feature to encrypt the files and their containing folder. (EFS has been included since Windows 2000.)

This method works -- provided that there are no EFS Data Recovery Agents set up on the computer -- because the EFS private key is protected by the user's current Windows password. So if that user changes their password, the EFS private key is decrypted and re-encrypted under the new password -- but if an administrator forcibly resets the password the EFS private key can no longer be decrypted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.