4 ms·
> But then again it does require people to have a unique bitlocker PW, and if they ever forget it, everything on the machine is gone for good. (Which I've actua
by koyote 5y ago
> But then again it does require people to have a unique bitlocker PW, and if they ever forget it, everything on the machine is gone for good. (Which I've actually been bitten by, oops!)
I am not sure if it was the same system, but at a company I worked for we also had a boot password for bitlocker. People would sometimes forget it or bitlocker would somehow corrupt itself. IT was usually able to fix it though. I believe they were able to print out some kind of longer master password that could be used to unlock the machine.
- aksss 5y agoThat would probably be the recovery password, which is a long string of gobblydigook. In corporate environment, the recovery password is backed up to the user's Azure AD account and logged by the configuration manager (like InTune, probably 3rd party ones too).
- EvanAnderson 5y agoCommonly machines will be configured (via Group Policy) to store their Bitlocker recovery keys in Active Directory (where they are readable by only privileged users). (It would be nice if MSFT would do with Bitlocker recovery keys what they do with EFS recovery keys, and encrypt them with a public key. At that point popping Active Directory wouldn't be enough to get Bitlocker recovery keys-- you'd need a private key that, hopefully, was stored offline or in an HSM.)