2

My computer is a dell xps12 (2013) laptop running on windows 8.1 pro, uefi and secure boot enabled.

I successfully enabled tpm and encrypted system partition with bitlocker. I was a bit surprised it didn't ask me for password or any unlock method by default and really thinks it's a way to complicated to set up (I encrypted system partitions with truecrypt in the past without any problem...)

So what I want to do now is to encrypt the key that I believe is now stored on TPM with a solid password. I suppose I have to "manage bitlocker->Change how drive is unlocked at startup" for this drive, but I have an error message when doing that : "The group policy settings startup options are in conflict and cannot be applied."

I suppose the key of my problem is in "local group policy editor" so here's my configuration there: computer configuration > Administrstive Templates > System > TPM Services :

  • all 8 items : not configured

computer configuration > Administrstive Templates > Windows Components > BL drive encryption

  • all 8 items : not configured

computer configuration > Administrstive Templates > Windows Components > BL drive encryption > Operating systems drives :

  • Allow secure boot for security validation: enabled
  • Require additional authentication at startup: enabled
  • Require additional authentication at startup (windows server): disabled
  • Allow enhanced pin at startup: enabled
  • Configure minimum pin lenght at starup:enabled
  • Configure use of hardware-based encryption for OS: enabled
  • Configure uses of passwords for operating system drives: disabled
  • All others : not configured

I hope my question is clear enough. Thanks by advance.

  • So change those not configured to something – Ramhound Jun 5 '15 at 16:37
  • @Ramhound I dit it with the most basic choices i think, but still got the same error. I really don't understand why it needs so much configuration and why it is user based: I just want to set a password before encrypted disk is mounted. – miky Jun 6 '15 at 18:31
0

Is this in a domain environment (if so you may have other policies being applied and that may cause the conflict)?

For Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives:

  • Require additional authentication at startup: Enabled (you did not specify the other settings under this configuration you chose.)
    • You can only Require ONE additional startup item under this setting, otherwise you will see the error you indicated. Based on your question, I recommend the following settings:
      • Allow BitLocker without a compatible TPM: Unchecked (for maximum security as long as you have a TPM module enabled)
      • Configure TPM startup: Do not allow TPM
      • Configure TPM startup PIN: Require startup PIN with TPM
      • Configure TPM startup key: Do not allow startup key with TPM
      • Configure TPM startup key and PIN: Do not allow startup key and PIN with TPM

I am not sure if the "Configure uses of passwords for operating system drives: disabled" could be the issue but I will play with some machines and update if I find out anything.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.