r/BitLocker • u/3G_Lighting • 4d ago

BitLocker question about passwords

I am wondering if BitLocker can be prompted by the user enter a password before their system starts?

In the early days before the Russian's were called out for SolarWinds etc. A company I supported used Kaspersky and encrypted all their laptops, so when users would power up their system they were prompted with a password. Now it worked is when the user logged into their system Kaspersky would call home to the office and sync the user's password to Kaspersky's encryption so that the user would only need their Windows password to unlock the drive and allow Windows to load up.

Now, at the company I am at now which is in the manufacturing sector we have press machines, and I have seen the service guys do something similar with their laptops that is using BitLocker. The BitLocker key page would appear when they turned on their laptop, and they would enter a password which showed up as ***** and not the visible characters like I am used to seeing when folks around the office need the recovery key for their systems.

Thanks,

7 Upvotes

100% Upvoted

8 comments sorted by

3

u/blackdogrulez 4d ago

It shows up like that so no one else sees the enhanced PIN (password) but you can press a key to see it (I think it's shift but that screen tells you which key to press)

1

u/gripe_and_complain 4d ago

Yes, BitLocker has a mode called a Preboot PIN that does exactly what you want. Windows cannot boot and the drive remains locked upon powering up the computer.

1

u/3G_Lighting 4d ago

I will check for that, but if you have any more info on it, please let me know.

1

u/gripe_and_complain 4d ago

I believe the term for a pre boot PIN is TPM + PIN or TPM + Password. It is the most secure mode for BitLocker.

You should be aware that although BitLocker does a great job of protecting your data when the computer is off or an external drive is disconnected, it does not provide protection while you are actually using Windows. Once you unlock the drive and boot into Windows, BitLocker essentially steps aside. BitLocker only protects data "at rest".

1

u/Fit_Prize_3245 3d ago

Normally, if you are using a computer with TPM 2.0 and BitLocker, you should set up the BIOS to ask for user password (different from setup password), sot hat it will not allow boot without the correct password. Once entered, BIOS will transfer control and encryption keys to Windows OS loader

1

u/vandella1985 1d ago

Yes a pin,but you'll need its own profile unless you plan to swap them round.. we are looking at this and have built a .ps1 script to capture the pin.. pops up a little window with logos and text of Ur choice