1

My team is about to provide our traveling colleagues with new Windows 8 laptops. Part of our security solution depends on the use of BitLocker. Every laptop will have two partitions configured like this:

  • C: - This partition gets a TPM key protector and a RecoveryPassword key protector
  • D: - This partition gets a RecoveryPassword key protector is set to auto unlock (hence the ExternalKey key protector)

In PowerShell this configuration looks like this:

PS C:\Users\Administrator> Get-BitLockerVolume

   ComputerName: COMO035

VolumeType      Mount CapacityGB VolumeStatus           Encryption KeyProtector              AutoUnlock Protection
                Point                                   Percentage                           Enabled    Status
----------      ----- ---------- ------------           ---------- ------------              ---------- ----------
OperatingSystem C:         50,00 FullyEncrypted         100        {Tpm, RecoveryPassword}              On
Data            D:         68,72 FullyEncrypted         100        {RecoveryPassword, Ext... True       On


PS C:\Users\Administrator> (Get-BitLockerVolume).KeyProtector

KeyProtectorId      : {C50DC6BC-3503-4A5B-AC86-4A7EB8EC00AB}
AutoUnlockProtector :
KeyProtectorType    : Tpm
KeyFileName         :
RecoveryPassword    :
KeyCertificateType  :
Thumbprint          :

KeyProtectorId      : {A2DB1378-A0E9-4372-BAF6-D96C74D0A77A}
AutoUnlockProtector :
KeyProtectorType    : RecoveryPassword
KeyFileName         :
RecoveryPassword    : 210430-544511-535018-062700-250756-593483-345774-219087
KeyCertificateType  :
Thumbprint          :

KeyProtectorId      : {4673AE64-F3B7-4976-92C2-D2584BD39172}
AutoUnlockProtector :
KeyProtectorType    : RecoveryPassword
KeyFileName         :
RecoveryPassword    : 601502-030690-192005-498520-321904-056639-351956-604670
KeyCertificateType  :
Thumbprint          :

KeyProtectorId      : {5F43BEB6-AE1D-406D-83CF-62A607818043}
AutoUnlockProtector : True
KeyProtectorType    : ExternalKey
KeyFileName         : 5F43BEB6-AE1D-406D-83CF-62A607818043.BEK
RecoveryPassword    :
KeyCertificateType  :
Thumbprint          :

During a normal boot this configuration works flawlessly. The TPM detects no tampering with the hardware and Windows boots normally. If I pull out the disk and try to boot it in another identical laptop (with a different TPM) the BitLocker recovery screen shows up. I enter the recovery password after which Windows boots again. So far so good.

As an extra layer of security we created a script that is triggered by the Account Lockout Policy. This script should invalidate the TPM so the only option to unlock BitLocker is the recovery password. The command manage-bde -ForceRecovery promises to do just that. In reality it removes the TPM key protector as shown in the output below and leaves the recovery password option intact. After a reboot I provide the recovery password but BitLocker decides it's not correct and refuses to boot Windows.

PS C:\Users\Administrator> manage-bde.exe -ForceRecovery c:
BitLocker Drive Encryption: Configuration Tool version 6.2.9200
Copyright (C) 2012 Microsoft Corporation. All rights reserved.

    TPM:
      ID: {C50DC6BC-3503-4A5B-AC86-4A7EB8EC00AB}

Key protector with ID "{C50DC6BC-3503-4A5B-AC86-4A7EB8EC00AB}" deleted.
Only a recovery password or recovery key can unlock volume C:.
PS C:\Users\Administrator> (Get-BitLockerVolume).KeyProtector


KeyProtectorId      : {A2DB1378-A0E9-4372-BAF6-D96C74D0A77A}
AutoUnlockProtector :
KeyProtectorType    : RecoveryPassword
KeyFileName         :
RecoveryPassword    : 210430-544511-535018-062700-250756-593483-345774-219087
KeyCertificateType  :
Thumbprint          :

KeyProtectorId      : {4673AE64-F3B7-4976-92C2-D2584BD39172}
AutoUnlockProtector :
KeyProtectorType    : RecoveryPassword
KeyFileName         :
RecoveryPassword    : 601502-030690-192005-498520-321904-056639-351956-604670
KeyCertificateType  :
Thumbprint          :

KeyProtectorId      : {5F43BEB6-AE1D-406D-83CF-62A607818043}
AutoUnlockProtector : True
KeyProtectorType    : ExternalKey
KeyFileName         : 5F43BEB6-AE1D-406D-83CF-62A607818043.BEK
RecoveryPassword    :
KeyCertificateType  :
Thumbprint          :

In the prototype phase of the project I tried this with a VM but used a regular Password protector in stead of the TPM protector. Manually removing all but the password recovery protector worked perfectly.

Does anybody know why BitLocker refuses the recovery password after removing the TPM key protector?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.