On a computer running Windows with a hardware TPM, one can turn on bitlocker while let the computer unlock the drive on startup without asking for password. So if a drive is stolen or being accessed by hacker together with the matching TPM module or motherboard, the thief/hacker then can decrypt all data by design? So the bitlocker+TPM only protect if only the drive itself is stolen/accessed?

  • Only if you configure it that way... – Ramhound Jul 1 '17 at 18:56
  • How to configure to avoid this? – Sam Jul 1 '17 at 18:59
  • Don't configure Bitlocker to retain your password – Ramhound Jul 1 '17 at 19:16

As long as the hardware attached to the mainboard is the same, yes.TPM modules are designed to "seal" a encrypted drive to your current hardware (mainboard, PCI card, ...) and low level software (UEFI/BIOS version and other firmware) and so they ensure the integrity of the system.They are also used to count how many times in a row you entered the PIN wrong and for example after the third time you can't access your keys anymore and they can also store other keys for you which then could also be bound to some condition.They can also perform key generation tasks for you in a more or less secure manner, encrypt a hash for example for creating a signature and many other things.

To make your TPM module more useful you can for example set a PIN and/or password.

Overview: https://technet.microsoft.com/library/cc732774.aspx

Helpful guides: https://www.windowscentral.com/how-use-bitlocker-encryption-windows-10


For more options (like changing the lockout duration):



For nearly every existing option: https://docs.microsoft.com/en-us/windows/device-security/bitlocker/bitlocker-group-policy-settings

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.