0

My personal data is in D:\, which is BitLocker-ed with a password. On Windows 7 boot, a few programs in Startup should access to D:\, such as the wonderful Everything indexing software. How to have a prompt for the password to BitLocker-unlock D:\ before the programs in Startup shortcuts start?

Sidenote: my Windows Desktop is configured to be on the data partition: D:\Desktop\ (private documents are sometimes stored on Desktop so I really want it to be on BitLocker-ed D:\ ), so on each Windows startup, the desktop cannot be displayed: D:\Desktop is not accessible. Access is denied and no Desktop can be displayed until I manually unlock D:\.

I've solved this problem by:

  • configuring to "auto-unlock" D:\ , but for this it was mandatory to do this:

  • encrypting C:\ too (but that does not contain much personal data, I mostly use portable software installed in D:\ ). If C:\ is not encrypted, you cannot configure the auto-unlock of D:\ (The operating system drive must be protected by BitLocker to automatically unlock a fixed data drive)

But then having C:\ encrypted has several drawbacks:

  • anytime I change something in BIOS, I have to re-enter manually the Bitlocker recovery key (I wanted to put a password instead of a long recovery key with manage-bde -add -password but this was not possible on the OS partition, since TPM was already enabled).

  • I have to use the laptop's BIOS password system to lock the PC and prevent access by someone unauthorized

  • each time you modifiy things related to boot (e.g. UEFI), it gets more complicated and you need to enter the recovery key again and again

I'd like to simplify all this instead and have:

  • C:\ uncrypted
  • no password in laptop's BIOS
  • D:\ BitLocker encrypted with a password
  • Have a single password prompt on startup of Windows, before the programs in "Startup" start

How to do that?

3
  • If you want to protect the files on your Desktop wouldn’t EFS be easier then automatically mounting your encrypted volume? You might want to use a password when a configuration change is detected but you won’t be able to. You cannot change the behavior BitLocker in that way. What you want isn’t possible with BitLocker. Your not required to use a firmware password. Your choosing to do that. BitLocker is unaware of your firmware password.
    – Ramhound
    Jun 22, 2020 at 12:05
  • @Ramhound If I remove firmware password and I can configure auto-unlock, there is no password anymore on the computer. TL;DR I'll like to set a pre-boot PIN password that would unlock D: (I tried with gpedit.msc "require...", and manage-bde TPMandPIN but it only works for OS disk, not D:)
    – Basj
    Jun 22, 2020 at 12:20
  • That’s why I am suggesting BitLocker isn’t the solution based on your requirements. You should be using EFS on the files you want to protect. If anything you should be using both. You won’t get away from being asked for the BitLocker recovery key.
    – Ramhound
    Jun 22, 2020 at 12:22

2 Answers 2

2

BitLocker is too restrictive and problematic.

I would recommend using instead a third-party product such as VeraCrypt.

You may encrypt the entire disk D, or just a part of the disk in the format of a file, or even encrypt and use what looks like the unallocated space at the end of the physical disk.

You can schedule a VeraCrypt mount command for the disk on logon to force entering the password, or just do that from a shortcut on the desktop when access to D is required.

Using VeraCrypt would give you much better control and less restrictions.

2
  • Thanks @harrymc. Is there a way to auto unlock VeraCrypt-encrypted D:\ at the very start of the Windows logon? i.e. before the Desktop is loaded / displayed, before the Startup programs or registry's HKLM\...\CurrentVersion\Run programs are launched?
    – Basj
    Jun 22, 2020 at 13:32
  • You are perhaps looking for "pre-boot authentication". See Hidden Operating System or How to Encrypt Your Windows System Drive With VeraCrypt.
    – harrymc
    Jun 22, 2020 at 13:39
0

How to have a prompt for the password to BitLocker-unlock D:\ before the programs in Startup shortcuts start?

In order to accomplish this you will be unable to move your Desktop to another disk that is encrypted with BitLocker. The best way to accomplish this would be to store your personal files on a separate volume that is encrypted and have your Desktop and the user profile profile exist on the system partition which of course would be encrypted. The difference between this proposed configuration, and the configuration you describe, is that your secondary volume would not be automatically mounted.

You can use Encrypted File System (EFS) in order to protect the files stored within your profile. You can then simply mount the volume you wish to protected with BitLocker manually when you wish to access it.

I'd like to simplify all this instead and have:

  1. C:\ unencrypted
  2. no password in laptop's BIOS
  3. D:\ BitLocker encrypted with a password
  4. Have a single password prompt on startup of Windows, before the programs in "Startup" start

How to do that?

In order to accomplish what you describe you cannot move the your user profile to another drive. The use of a firmware password is not required to implement BitLocker. As for protecting your system, a strong user password and the use of EFS, will accomplish the same thing. Worth pointing out that Windows is unaware of the firmware password. You will be unable to avoid the use of the BitLocker recovery key when a firmware configuration change is detected. The single password you wish to have is the user's password. Only you can decided if the benefit of automatically mounting a BitLocker is worth it.

If I remove firmware password and I can configure auto-unlock, there is no password anymore on the computer.

You can still assign a password to the Windows user profile in question and implement EFS, which means if anyone changes your password, they will be unable to access and/or read to your files without the original certificate used in the encryption process.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .