0

I have a Windows 10 laptop with two drives: an HDD that I use to store my data, and an SSD where the OS is stored allong with programs I use more frequently/require more performance.

I use Bitlocker to secure my data, and have both drives encrypted. My laptop has a TPM chip. What happens is that one of the drives (data drive) is automatically unlocked when I sign in, but the system asks me for a password on bootup to unlock the OS drive.

Is there any way to have both drives unlock automatically on sign in with the keys stored in the TPM chip? No options for auto-unlock appear under the OS drive in windows.

Thanks



  • Your question doesn't make sense. Aren't both drives already unlocked when you sign in? – David Schwartz Sep 25 '15 at 10:16
  • I have a similar setup and followed this instructions, which worked. technet.microsoft.com/en-us/library/… – KarmaEDV Sep 25 '15 at 10:46
  • No; There is no way to automatically log into your FDE system disk. The reason your other disk can be automatically mounted is because it isn't your system disk, your user profile by the way, is storing that information. What you describe would break your security. Anyone with physical access to your device now, would be unable to access either disk, likewise if t automatically enter the password they would be able to grab everything like it wasn't even encrypted in the first place. – Ramhound Sep 25 '15 at 10:53
  • @KarmaEDV, that applies to "You can configure BitLocker to automatically unlock volumes that do not host an operating system." Not to the OS volume. – Jamie Hanrahan Sep 25 '15 at 11:07
  • @JamieHanrahan Yes, but I too have a multiple BitLocker drives and never have to enter a password. – KarmaEDV Sep 25 '15 at 11:36
0

Yes, you can have your OS drive automatically boot from a bitlocker'd drive without prompting for a passowrd. Mine works that way. But it requires either an activated TPM, or a bitlocker password on a USB key, or both.

Use of just the TPM means that if someone steals your drive, they can't read it - but if they steal your computer, and manage to log in, they can.

Use of just the USB key means you'll have to have the USB key plugged in when you boot.

Optinally you can use TPM + PIN, or TPM + USB. Like "just TPM" both of these lock the drive to the computer, and protect the boot environment from changes, via the TPM. They add either "something you know" (PIN) or "something you have" (USB key) to the need for the TPM.

The recovery key, in case you were wondering, bypasses the need to match the TPM... useful if you change the boot environment (while leaving BL enabled) or need to access the drive from another machine.

See "What is a BitLocker Drive Encryption startup key or PIN?" at microsoft.com , and "How to configure BitLocker with TPM, PIN, and USB StartupKey" at mrhorn.com for the detailed procedures.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.