Creation of BitLocker Policy

Overview

What a BitLocker policy controls

One policy module covers encryption scope, authentication, algorithms, and recovery keys.

The BitLocker Management module

BitLocker Management module lets you build tailored encryption policies for the devices on your network. A policy can apply full drive, OS drive, or used-space encryption depending on what a given device needs.

It supports both devices with a TPM and devices without one, gives granular control over the encryption algorithm, and offers separate options for Windows 10 and later versus Windows 8.1 and earlier.

Setup

Creating the policy

Name the policy and choose whether it encrypts or decrypts.

Perform encryption or decryption

1. Go to the BitLocker Management module in the Endpoint Central console → Policy Creation → Create Policy.
2. Enter a name for the policy, and an optional description.
3. Toggle Drive Encryption: on applies encryption when the policy deploys, off applies decryption.

Authentication

Choosing how devices authenticate

TPM-equipped and non-TPM devices use different authentication paths.

Authentication for machines with TPM

• TPM only — the drive unlocks via TPM authentication with no user input required.
• TPM and PIN — TPM authentication is followed by a PIN (digits only, 6—20 characters) entered at boot.
• TPM and Enhanced PIN — TPM authentication is followed by an Enhanced PIN (6—20 alphanumeric and special characters) entered at boot.

Authentication for machines without TPM

Devices without a TPM authenticate with a passphrase only, entered by the user at boot.

Scope

Choosing what gets encrypted

Combine one of three encryption scopes with the authentication settings above.

Complete encryption of drives

To encrypt every drive and all space on them, enable Drive Encryption only, and leave Encrypt OS drive only and Encrypt used space only disabled.

Encryption of the OS drive only

Enable Encrypt OS drive only to encrypt just the operating system drive, leaving all other data drives decrypted.

Encryption of used space only

Enable Encrypt used space only to encrypt just the used space on a drive, leaving free space decrypted.

Algorithms

Choosing an encryption algorithm

The available algorithms depend on the Windows version, and Microsoft's default is the safe choice for most devices.

Algorithms for Windows 10 and above

Windows 10 and later devices can use AES_128, AES_256, XTS_AES_128, or XTS_AES_256.

Algorithms for Windows 8.1 and below

Windows 8.1 and earlier devices can use AES_128 or AES_256. As with Windows 10 and later, Microsoft's default gives the best performance, and stronger options exist for compliance but can slow the device.

Passwords

Password prompt settings

Control whether users can defer setting a BitLocker password.

Allow users to skip the password request

This setting lets an admin define a window of time during which a user can click Cancel to skip the password prompt.

Once that window passes, the Cancel button is disabled and the user must create a BitLocker password, keeping every system encrypted and compliant.

Enforce immediately

This setting requires the user to set a password right away — the Create Password window can't be canceled or closed until they do.

Recovery

Advanced settings for recovery keys

Control where recovery keys are stored and how often they rotate.

Recovery key storage and rotation

• Update recovery key to domain controller — keeps a consolidated list of recovery keys in Active Directory; if disabled, keys live only on the product server.
• Allow periodic rotation of the recovery key — replaces old recovery keys with new ones automatically after a set number of days.

To reset recovery keys that have already been used, modify the deployed policy, enable rotation, and set the rotation period — for example, seven days generates new recovery keys every seven days starting from when the modification takes effect.

Saving the policy

Once the settings are configured, save the policy as a draft or publish it directly. Published and drafted policies both appear in the policy list under the Policy Creation tab.

The created policy can be deployed through Policy Deployment for the endpoints to be encrypted.