2

I have a Windows 10 laptop with two drives: an HDD that I use to store my data, and an SSD where the OS is stored allong with programs I use more frequently/require more performance.

I use Bitlocker to secure my data, and have both drives encrypted. My laptop has a TPM chip. What happens is that one of the drives (data drive) is automatically unlocked when I sign in, but the system asks me for a password on bootup to unlock the OS drive.

Is there any way to have both drives unlock automatically on sign in with the keys stored in the TPM chip? No options for auto-unlock appear under the OS drive in windows.

Thanks



7
  • Your question doesn't make sense. Aren't both drives already unlocked when you sign in? Sep 25, 2015 at 10:16
  • I have a similar setup and followed this instructions, which worked. technet.microsoft.com/en-us/library/…
    – KarmaEDV
    Sep 25, 2015 at 10:46
  • No; There is no way to automatically log into your FDE system disk. The reason your other disk can be automatically mounted is because it isn't your system disk, your user profile by the way, is storing that information. What you describe would break your security. Anyone with physical access to your device now, would be unable to access either disk, likewise if t automatically enter the password they would be able to grab everything like it wasn't even encrypted in the first place.
    – Ramhound
    Sep 25, 2015 at 10:53
  • @KarmaEDV, that applies to "You can configure BitLocker to automatically unlock volumes that do not host an operating system." Not to the OS volume. Sep 25, 2015 at 11:07
  • 1
    Having it unlock automatically wouldn't necessarily break any sort of security. As I said, the laptop has a TPM chip. What I wanted was the following workflow: TPM chip -> unlocks OS drive -> user profile on OS drive -> unlocks data drive. This way the OS drive is useless without the PC, the data drive useless without the (un)encrypted OS drive and, by extension, the PC. What worries me are people accessing files on the drives if they are removed from the laptop. Sign in password security is not an issue. Dec 20, 2016 at 16:19

1 Answer 1

0

Yes, you can have your OS drive automatically boot from a bitlocker'd drive without prompting for a passowrd. Mine works that way. But it requires either an activated TPM, or a bitlocker password on a USB key, or both.

Use of just the TPM means that if someone steals your drive, they can't read it - but if they steal your computer, and manage to log in, they can.

Use of just the USB key means you'll have to have the USB key plugged in when you boot.

Optinally you can use TPM + PIN, or TPM + USB. Like "just TPM" both of these lock the drive to the computer, and protect the boot environment from changes, via the TPM. They add either "something you know" (PIN) or "something you have" (USB key) to the need for the TPM.

The recovery key, in case you were wondering, bypasses the need to match the TPM... useful if you change the boot environment (while leaving BL enabled) or need to access the drive from another machine.

See "What is a BitLocker Drive Encryption startup key or PIN?" at microsoft.com , and "How to configure BitLocker with TPM, PIN, and USB StartupKey" at mrhorn.com for the detailed procedures.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .