Changes

Bitlocker BitLocker Drive Encryption is a security feature feature first introduced in the Ultimate and Enterprise editions Windows Vista and subsequently incorporated into all editions of Windows Server 2008.

Bitlocker BitLocker performs a number of functions depending on the hardware support of the system on which Windows Server 2008 is running. At the most basic level, Bitlocker BitLocker encrypts entire disk volumes so that the operating system files and user data contained on a disk drive cannot be accessed if the computer and/or drive are lost or stolen. In addition a key is written to a USB flash drive during the Bitlocker BitLocker configuration process. This flash drive must be inserted into a USB port on the computer at system startup in order to gain access to the system.

When used in conjunction with a computer system which has a Trusted Platform Module (TPM) together with a Trusted Computing Group (TCG) compatible BIOS, Bitlocker BitLocker also provides additional features including verifying the integrity of the boot files prior to system startup. In addition, TPM support also provides the option to specify a PIN that must be entered on system start up in addition to the flash drive containing the key.

This chapter of [[Windows Server 2008 Essentials]] provides a detailed overview of the steps necessary to configure Bitlocker BitLocker Drive Encryption.

== Bitlocker BitLocker Prerequisites ==

Unfortunately Bitlocker BitLocker Drive Encryption is not supported on all systems. In fact, the following are mandatory prerequisites for using BitlockerBitLocker:

While not required to use BitlockerBitLocker, in order to take advantage of the full range of Bitlocker BitLocker protection features the following optional requirements are also necessary:

== Enabling Bitlocker BitLocker Drive Encryption ==

The first step in configuring Bitlocker BitLocker Drive Encryption involves enabling this particular feature within Windows Server 2008. This is achieved using the Server Manager. To access the Server Manager either open the ''Start'' menu and select server manager or click on the Server manager icon in the task bar. In the tree hierarchy located in the left hand panel of the Server Manager select the ''Features'' option. Once selected the Server Manager will display the status of current feature configurations and provide options to add and remove features. The following figure illustrates the Server Manager in ''Features'' mode with no features currently installed:

To add the Bitlocker BitLocker feature, begin by clicking on the ''Add New Features'' option to invoke the ''New Features Wizard'' as shown below.

Select the ''Bitlocker BitLocker Drive Encryption'' option and click on the ''Next'' button. On the resulting ''Confirmation'' screen verify that that you wish to enable Bitlocker BitLocker support by clicking on the ''Install'' button. The wizard will subsequently work through the installation process. The amount of time required to complete this task will vary depending on system speed. Overall progress can be tracked via the progress bar displayed on the ''Process'' screen.

== Creating Partitions for Bitlocker BitLocker Drive Encryption ==

The system volume must be at least 1.5Gb in size and must be created before proceeding with the BitLocker Drive Encryption process. This volume can be created either by using unallocated space on a drive, taking space from an existing volume, or the boot files can be ''merged'' into an another existing volume (other than the operating system volume). In order to ease the process of creating the system volume Microsoft provides a tool called the ''Bitlocker BitLocker Driver Preparation Tool''. This tool may be downloaded from the [http://www.microsoft.com/downloads/details.aspx?FamilyID=320b9aa9-47e8-44f9-b8d0-4d7d6a75add0&displaylang=en Microsoft website].

Next, the setup process will request that you save a recovery key. This will be required to unlock the system if Bitlocker BitLocker detects a problem with the integrity of the system (typically if the data on the disk has been tampered with while the system was shutdown):