0

I am trying to bind Bitlocker operations (specifically booting Windows) with some form of network presence. In other words, I want to set-up some form of 2FA (via the network) to allow booting Windows.

I speculate that providing the startup key via a named pipe is possible. Assuming this, I need to know 2 things:

  1. Is it possible to have some software started from the system drive, i.e. before Bitlocker starts Windows from the Operating System drive. This software would query some network service to somehow get the startup key.
  2. Is the network operates when the Bitlocker is doing its thing? In other words, is the network available during the System Drive phase.

Has anyone try this?

Improve this question
6
  • 2. connect by ethernet cable ... check the link lights on the ethernet jack ... if not lit, then no
    – jsotola
    Nov 9 at 4:26
  • Well, found out that Microsoft has a tool to remotely recover encrypted disks, so networking in the mini-kernel, or pre-boot kernel is definitely possible.
    – Claude
    Nov 9 at 18:47
  • BitLocker does not support what you want to do, you can store the key in the TPM or use a PIN or Password protector. Storing the BitLocker key in a network location instead of the TPM seems like a horrible insecure idea.
    – Ramhound
    Nov 13 at 16:15
  • Bitlocker offers the protector "network unlock" together with TPM. So what you want is possible, if you are able to setup a network unlock server. learn.microsoft.com/en-us/windows/security/…
    – Bernd Schwanenmeister
    Nov 14 at 9:39
  • @superuser.com/users/83283/ramhound - I would not store the key in a network location. It would stay local to the machine, but encrypted (may be even double encrypted if using the TPM). What would the network provide is the decryption key; you are correct, directly storing the Bitlocker key on a server would be a terrible idea!! Bitlocker has the ability to read the key from a USB drive; that would be basis.
    – Claude
    Nov 14 at 17:27

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .