3 ms·
There's potentially a huge issue here for people using BitLocker with on-prem AD, because they'll need the BitLocker recovery keys for each endpoint to go in an
by entuno 2y ago
There's potentially a huge issue here for people using BitLocker with on-prem AD, because they'll need the BitLocker recovery keys for each endpoint to go in an fix it.
And if all those recovery keys are stored in AD (as they usually are), and the Domain Controllers all had Crowdstrike on them...
- mschuster91 2y agoAssuming that they also have a regular Bitlocker password, there's hope with a bit manual effort. https://news.ycombinator.com/item?id=41003893 https://news.ycombinator.com/item?id=41003893
- entuno 2y agoMost of the large deployments I've seen don't use pre-boot PINs, because of the difficulty of managing them with users - they just use TPM and occasionally network unlock. So might save a few people, but I suspect not many.
- mschuster91 2y agoYeah but TPM-only Bitlocker shouldn't be affected anyway by this issue, these machines should start up just fine. Whoever only has AD-based Bitlocker encryption is straight up fucked. Man, and that on a Friday.
- tjoff 2y agoThat's the easy part? just do the domain controller first?
- hulitu 2y agoThis is the best definition of "Single point of failure" i have ever seen.
- depr 2y agoBitlocker keys are apparently not necessary: https://x.com/AttilaBubby/status/1814216589559861673 https://x.com/AttilaBubby/status/1814216589559861673
- tamimio 2y agoIt might work on some machines, but doubt to work on the rest. Worth the try.
- mejs 2y agoI got around BitLocker and booted into safe mode by setting automatic boot to safe mode via bcdedit https://blog.vladovince.com/mitigating-the-crowdstrike-outage-without-bitlocker-keys-how-to-get-into-windows-recovery-mode-via-secureboot-toggling/ https://blog.vladovince.com/mitigating-the-crowdstrike-outag...