4 ms·

And how are users supposed to recover their data when your system fails, and they have no idea what the key is?

acqq 9y ago
For Bitlocker it was necessary to print the key after it was generated and keep it somewhere because even some software updates and reboots could get you a screen where you had to type many many numbers and letters -- you could not use some password of yours there. Which wasn't pleasant. That meant that if you wanted to travel you had to have the printed key with you, or at such reboots at least phone somebody to who you have given that key. Which isn't a problem in an organization, were that somebody are the admins, who were those who made the keys before they gave you the notebook. I don't know how it works currently, if MS invented something more convenient recently.
- zaarn 9y ago
  You can recover using your Live Account, which contains a copy of the key. But you still have to type it in. I do this regularly as a recent W10 upgrade broke the SoftTPM in my Ryzen CPU (no longer recognised at boot), so I type it in everytime I boot windows (so once or three times a month). It's very resilient since it has a built-in Error Detection Code for each 6 digit pair entered, if you make a typo, it likely will immediately complain and prevents entering any more of the code.
  - marcoperaza 9y ago
    You should use the manage-bde cli tool, or the bitlocker GUI, to remove the TPM protector and replace it with a passphrase. You’ll need to set one of the group policy options to enable using a passphrase.
    - zaarn 9y ago
      Yeah but I don't want that. I want to use the TPM, Windows just broke it. For the few times in the month where I need Windows, it's not worth the effort.
      - marcoperaza 9y ago
        Have you tried running tpm.msc and resetting it? Maybe also try resetting it in the bios/firmware? Those seem to usually do the trick for solving TPM issues.
        zaarn 9y ago
        The issue was actually caused by changing the CPU, the TPM was then reset by the BIOS after the first powerup. I could try it again though. From my previous experience, Windows will happily insert the decryption key into the TPM once you enter the recovery code.
        marcoperaza 9y ago
        It usually will but I think there’s something about TPM ownership that sometimes requires manual reset through tpm.msc and/or firmware options.
mjg59 9y ago
The default behaviour is that the secret is uploaded to Microsoft and tied to your Live credentials. You just log into the recovery site and are given an unlock code.

acqq 9y ago

For Bitlocker it was necessary to print the key after it was generated and keep it somewhere because even some software updates and reboots could get you a screen where you had to type many many numbers and letters -- you could not use some password of yours there. Which wasn't pleasant. That meant that if you wanted to travel you had to have the printed key with you, or at such reboots at least phone somebody to who you have given that key. Which isn't a problem in an organization, were that somebody are the admins, who were those who made the keys before they gave you the notebook. I don't know how it works currently, if MS invented something more convenient recently.

zaarn 9y ago
You can recover using your Live Account, which contains a copy of the key. But you still have to type it in. I do this regularly as a recent W10 upgrade broke the SoftTPM in my Ryzen CPU (no longer recognised at boot), so I type it in everytime I boot windows (so once or three times a month). It's very resilient since it has a built-in Error Detection Code for each 6 digit pair entered, if you make a typo, it likely will immediately complain and prevents entering any more of the code.
- marcoperaza 9y ago
  You should use the manage-bde cli tool, or the bitlocker GUI, to remove the TPM protector and replace it with a passphrase. You’ll need to set one of the group policy options to enable using a passphrase.
  - zaarn 9y ago
    Yeah but I don't want that. I want to use the TPM, Windows just broke it. For the few times in the month where I need Windows, it's not worth the effort.
    - marcoperaza 9y ago
      Have you tried running tpm.msc and resetting it? Maybe also try resetting it in the bios/firmware? Those seem to usually do the trick for solving TPM issues.
      - zaarn 9y ago
        The issue was actually caused by changing the CPU, the TPM was then reset by the BIOS after the first powerup. I could try it again though. From my previous experience, Windows will happily insert the decryption key into the TPM once you enter the recovery code.
        marcoperaza 9y ago
        It usually will but I think there’s something about TPM ownership that sometimes requires manual reset through tpm.msc and/or firmware options.

mjg59 9y ago

The default behaviour is that the secret is uploaded to Microsoft and tied to your Live credentials. You just log into the recovery site and are given an unlock code.