Changes

When used in conjunction with a computer system which has a Trusted Platform Module (TPM) together with a Trusted Computing Group (TCG) compatible BIOS, BitLocker also provides additional features including verifying the integrity of the boot files prior to system startup. In addition, TPM support also provides the option to specify a PIN that must be entered on system start up startup in addition to the flash drive containing the key.

* A minimum of 1.5Gb 5GB of available disk space (either unallocated or available for reallocation from an existing partition).

The first step in configuring BitLocker Drive Encryption involves enabling this particular feature within Windows Server 2008. This is achieved using the Server Manager. To access the Server Manager either open the ''Start'' menu and select server manager or click on the Server manager Manager icon in the task bar. In the tree hierarchy located in the left hand panel of the Server Manager select the ''Features'' option. Once selected the Server Manager will display the status of current feature configurations and provide options to add and remove features. The following figure illustrates the Server Manager in ''Features'' mode with no features currently installed:

Select the ''BitLocker Drive Encryption'' option and click on the ''Next'' button. On the resulting ''Confirmation'' screen verify that that you wish to enable BitLocker support by clicking on the ''Install'' button. The wizard will subsequently work through the installation process. The amount of time required to complete this task will vary depending on system speed. Overall progress can be tracked via the progress bar displayed on the ''Process'' screen.

Upon Completion of the installation process it will be necesary necessary to reboot the system to implement the change. The restart can be triggered by clicking the ''You must restart this server to finish the installation'' link shown on the wizard's ''Results'' page. Alternatively, close the wizard and select the restart from from the ''Start'' menu when it is convenient to do so.

After the restart has completed the ''Add Features Wizard'' will restart and complete the final phases of the feature installation process. Once completed , click on the ''Close'' button to exit from the wizard.

The system volume must be at least 1.5Gb 5GB in size and must be created before proceeding with the BitLocker Drive Encryption process. This volume can be created either by using unallocated space on a drive, taking space from an existing volume, or the boot files can be ''merged'' into an another existing volume (other than the operating system volume). In order to ease the process of creating the system volume Microsoft provides a tool called the ''BitLocker Driver Preparation Tool''. This tool may be downloaded from the [http://www.microsoft.com/downloads/details.aspx?FamilyID=320b9aa9-47e8-44f9-b8d0-4d7d6a75add0&displaylang=en Microsoft website].

1.5Gb 5GB of any unallocated space on the disk drive can be assigned to the system volume with a drive letter 'S:' using the following command:

Alternatively, free space from an existing volume can assigned to the system volume. This is referred to as performing a ''split''. In practice the volume is shrunk and a new volume created with the freed space. In order to perform a split successfully the volume from which the space is to be removed must have 10% of free space still available after the 1.5Gb 5GB split has been performed. The following command splits 1.5Gb 5GB from the C: volume and assigns it to a new system volume with drive letter 'S:'.

If the Control Panel is in ''Classic View'' mode simply double click on the ''BitLocker Drive Encryption'' icon. Alternatively, if the Control Panel is in ''Control Panel Home'' mode , select ''Security'' followed by '' BitLocker Drive Encryption''. Once selected, a screen similar to the following should appear:

With all the appropriate features and settings configured it is now time to perform the encryption. Open the BitLocker control panel as outlined above and click on the ''Turn on BitLocker'' link beneath the drive to be encrypted. The resulting dialog will warn you that BitLocker Encryption decreases performance and provide the option to cancel the operation. To proceed , select ''Continue with BitLocker Drive Encryption''.

Do not save the recovery password on the same USB device as the startup key, but instead insert a different device. It is also recommended that multiple copies of the password be kept so it is also adviced advised that the password be printed out and kept safely on file. Once the recovery password has been saved click ''Next'' to proceed. On the final screen, make sure the ''Run BitLocker system check'' toggle is set and click ''Continue'' to begin the encryption process. The system will restart and begin the encryption process, indicated by a dialog with a progress bar.

To regenerate previously generated startup keys and recovery passwords, enter the BitLocker Drive Encryption control panel (''Start -> Control Panel -> Security -> BitLocker Drive Encryption'') and click on ''Manage BitLocker Keys''. The resulting screen will provide options to ''Duplicate the recovery password'' and ''Duplicate the startup key''. The recovery key may be written to a USB drive or to a folder. The startup key must be saved to a USB memory device.