- \n
- There are potentially many variations in Windows devices and BIOS policies. It\u2019s best practice to test and verify impactful and fundamental security features. We recommend that admins deploy the BitLocker policy in a controlled fashion, prior to widespread deployment.<\/li>\n\n\n\n
- Some devices ship or have configured in their BIOS the ability to Require Physical Presence when modifying the TrustedPlatformModule (TPM). For these devices, a prompt that requires confirmation is shown when an attempt is made to modify and clear the TPM. This confirmation is required for the policy to utilize the TPM in BitLocker. If a user dismisses the confirmation, BitLocker could be enabled and be out of sync with the TPM. This should be tested and managed accordingly.<\/li>\n\n\n\n
- Before you remove a device with the BitLocker policy, see Removing Windows Devices with the BitLocker Policy<\/a>.<\/li>\n\n\n\n
- JumpCloud supports international languages in BitLocker encryption. The following languages have been verified by JumpCloud:\n
- \n
- English<\/li>\n\n\n\n
- German <\/li>\n\n\n\n
- French<\/li>\n\n\n\n
- Spanish <\/li>\n\n\n\n
- Chinese <\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Encryption Considerations<\/strong>:<\/p>\n\n\n\n
- \n
- The BitLocker policy leverages AES-256 for its encryption method.<\/li>\n\n\n\n
- Due to the security vulnerabilities associated with hardware encryption, the BitLocker policy uses software encryption. For more information, see Microsoft’s BitLocker Encryption Guidance documentation<\/a>. <\/li>\n\n\n\n
- On the Device Details page, the disk encryption status that displays under both the Details and System Insights drop-downs may take up to 2 hours to populate, and both fields may not populate at the same time. <\/li>\n<\/ul>\n\n\n\n
Prerequisites<\/strong>:<\/p>\n\n\n\n
- \n
- Target devices must be running on Windows 10 Pro\/Enterprise or Windows 11 Pro\/Enterprise. The policy will fail if enabled on Windows 10 Home or Windows 11 Home Editions.<\/li>\n\n\n\n
- Trusted Platform Module (TPM) Requirements:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
- \n
- Device must have a TPM 2.0 chip present to enable BitLocker.<\/li>\n<\/ul>\n\n\n\n
- \n
- TPM must not have multiple numerical passwords currently stored.<\/li>\n\n\n\n
- TPM must be active.<\/li>\n\n\n\n
- TPM must allow ownership.<\/li>\n\n\n\n
- TPM must not currently be owned.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- External drives, CDs, or DVDs can not be mounted, or else BitLocker can struggle to determine which volume it needs to encrypt when the policy is run.<\/li>\n<\/ul>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nThe Windows Allow BitLocker without a compatible TPM<\/strong> option isn’t supported by JumpCloud.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Admin Experience<\/h2>\n\n\n\n
IT Admins can create a policy to force BitLocker encryption on managed devices and easily view Recovery Keys. <\/p>\n\n\n\n
To create a BitLocker policy:<\/strong><\/p>\n\n\n\n
- \n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to DEVICE MANAGEMENT <\/strong>> <\/strong>Policies<\/strong>.<\/li>\n\n\n\n
- Under the All<\/strong> tab, click ( + <\/strong>).<\/li>\n\n\n\n
- Select the Windows<\/strong> tab.<\/li>\n\n\n\n
- Select the BitLocker Full Disk Encryption<\/strong> policy, then click policy<\/strong>.<\/li>\n\n\n\n
- (Optional) Select Encrypt All Non-Removable Drives<\/strong> to encrypt all fixed drives on the devices the policy will be enforced on. <\/li>\n\n\n\n
- Apply the policy to a group of devices in the Device Groups<\/strong> list, or to an individual device in the Devices<\/strong> list.<\/li>\n\n\n\n
- Click save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
After an Admin saves the policy, JumpCloud enables BitLocker on the devices where this policy is applied.<\/p>\n\n\n\n
- \n
- When the device’s volume is completely encrypted, you can view a Recovery Key that can be used to unlock all encrypted drives on that device.<\/li>\n\n\n\n
- The drive isn’t fully encrypted until the policy result shows that it was applied successfully in the Admin Portal.<\/li>\n\n\n\n
- Removing this policy doesn’t disable BitLocker or remove key protectors.<\/li>\n<\/ul>\n\n\n\n
The Admin must wait for the following actions to happen before viewing Recovery Key:<\/p>\n\n\n\n
- \n
- A user sees a prompt requesting that they restart their device to enable BitLocker.<\/li>\n\n\n\n
- In the Admin Portal, go to DEVICE MANAGEMENT<\/strong> > Policy Management.<\/strong><\/li>\n\n\n\n
- Verify that the Policy Status is updated to BitLocker Not Protected – Encryption has been enabled. Device drive encryption will begin on the next boot.<\/strong><\/li>\n\n\n\n
- The user restarts their device.<\/li>\n\n\n\n
- BitLocker begins encrypting the user’s volume.<\/li>\n<\/ol>\n\n\n\n
After the drive is completely encrypted, Admins can view the Recovery Key:<\/p>\n\n\n\n
- \n
- In the Admin Portal, go to DEVICE MANAGEMENT<\/strong> > Policy Management<\/strong>.<\/li>\n\n\n\n
- Select the BitLocker Full Disk Encryption policy, and then select the Devices <\/strong>tab to display a list of encrypted devices.<\/li>\n\n\n\n
- From the list, locate your desired device and click view key<\/strong> to display the device’s Recovery Key. Users who are not administrators on the device can’t disable BitLocker.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Note:<\/strong> \nThe view key<\/strong> button will not appear until the device is completely encrypted.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
Checking Status of BitLocker Encryption<\/h3>\n\n\n\n
If you have System Insights enabled, you can view the status of your devices\u2019 encryption in the Admin Portal.<\/p>\n\n\n\n
To view the encryption status of the drives on a device<\/strong>:<\/p>\n\n\n\n
- \n
- In the Admin Portal, go to DEVICE MANAGEMENT > Devices<\/strong>.<\/li>\n\n\n\n
- Select the Devices <\/strong>tab.<\/li>\n\n\n\n
- Select the device, then select the Insights<\/strong> tab.<\/li>\n\n\n\n
- View the status of the disk encryption under System and Hardware<\/strong>. The Encryption Status field displays one of these statuses:\n
- \n
- Decrypted<\/li>\n\n\n\n
- Encrypted<\/li>\n\n\n\n
- Encrypted (Suspended)<\/li>\n\n\n\n
- Encrypting\u2026(XX%)<\/li>\n\n\n\n
- Decrypting\u2026(XX%)<\/li>\n\n\n\n
- Encryption Paused (XX%)<\/li>\n\n\n\n
- Decryption Paused (XX%)
![\"\"](\"https:\/\/jumpcloud.com\/wp-content\/uploads\/2024\/03\/windows_device_bitlocker_encryption_status.jpg\")
<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\nUser Experience<\/h2>\n\n\n\n
After a BitLocker policy is applied, users see the following behavior on their devices:<\/p>\n\n\n\n
- \n
- A notification appears requesting that the user restart their device to enable BitLocker.
![\"\"](\"https:\/\/jumpcloud.com\/\/wp-content\/uploads\/2023\/02\/bitlocker_win_encryption_notification.png\")
![\"\"](\"https:\/\/s3.amazonaws.com\/jumpcloud-kb\/Knowledge+Base+Photos\/FDE\/FDE+Capture1.PNG\")
![\"\"](\"https:\/\/s3-us-west-2.amazonaws.com\/jimsfde\/Capture1.PNG\")
<\/li>\n<\/ol>\n\n\n\n- \n
- After the user starts the device, BitLocker continues to encrypt the drive silently in the background until encryption is complete.<\/li>\n<\/ol>\n\n\n\n
Expected Behavior<\/h2>\n\n\n\n
- \n
- If JumpCloud detects that BitLocker is already enabled and only has one numerical password stored, we capture and store the Numerical Password (Recovery Key) in JumpCloud.<\/li>\n\n\n\n
- For custom BitLocker policies (for example, those not requiring TPM, utilizing TPM 1.2, utilizing PIN, etc.) the administrator has the ability to apply and set based on their requirements locally on the device. As long as the Protection Status is set to Protection On<\/strong>, and only one numerical key protector is present, JumpCloud will capture and escrow this key accordingly. This allows Admins to not rely on the policy to set BitLocker, but still utilize JumpCloud for storage of the keys. It’s important to only apply the policy after the device is in this state, and protection is on, otherwise the policy will apply as previously stated. <\/li>\n\n\n\n
- If you select Encrypt All Non-Removable Drives<\/strong> when creating the policy, you will receive a single Recovery Key for all drives. <\/li>\n<\/ul>\n\n\n\n
Encryption Standard Outcomes<\/h2>\n\n\n\n
\n\n\n\n
\n \n Encryption Status of Fixed Internal Drives <\/th>\n \n Outcome <\/th>\n <\/tr>\n \n \n Not encrypted when the JumpCloud BitLocker policy was applied. <\/td>\n \n Drives will be encrypted to AES-256 standard. <\/td>\n <\/tr>\n \n \n Previously encrypted to AES-128 standard. <\/td>\n \n Drives will retain the AES-128 encryption standard and their encryption key(s) will be escrowed in JumpCloud. The drives will not be decrypted and re-encrypted to AES-256. <\/td>\n <\/tr>\n <\/table>\n<\/div><\/div>\n\n\n\n Removing Windows Devices with the BitLocker Policy<\/h2>\n\n\n\n
<\/p><\/div>Note:<\/strong> \nWhen you delete devices where you applied the Windows BitLocker policy, Recovery Keys for that device are also deleted and no longer accessible from the Admin Portal.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nRemoving a BitLocker policy doesn’t disable BitLocker or remove key protectors on the device.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
If a device is deleted from JumpCloud and it has a BitLocker policy:<\/p>\n\n\n\n
- \n
- The device volume remains encrypted.<\/li>\n\n\n\n
- You could potentially get locked out of the device with no way to recover it. <\/li>\n<\/ul>\n\n\n\n
You can avoid getting locked out of a Windows BitLocker device by:<\/p>\n\n\n\n
- \n
- Copying the Recovery Key before you remove it from JumpCloud.<\/li>\n\n\n\n
- Storing the copied key in a safe, accessible location.<\/li>\n<\/ul>\n\n\n\n
You can copy keys from the JumpCloud Admin Portal and from the Windows command prompt. <\/p>\n\n\n\n
To copy a Recovery Key from the JumpCloud Admin Portal<\/strong>:<\/p>\n\n\n\n
- \n
- In the Admin Portal, go to DEVICE MANAGEMENT <\/strong>> Devices<\/strong>.<\/li>\n\n\n\n
- Select the Devices<\/strong> tab, then select a Windows device with the BitLocker policy.<\/li>\n\n\n\n
- In the rightmost column, click the Actions<\/strong> menu.<\/li>\n\n\n\n
- From the dropdown, select\u00a0Recovery Key<\/strong>. The\u00a0Recovery Key<\/strong>\u00a0modal displays the device\u2019s recovery key.<\/li>\n<\/ol>\n\n\n\n
To copy a Recovery Key from the Windows command prompt<\/strong>:<\/p>\n\n\n\n
- \n
- On the Windows device, open a command prompt, running it as an administrator.<\/li>\n\n\n\n
- Run the following command: manage-bde -protectors -get <drive letter><\/kbd>.<\/li>\n<\/ol>\n\n\n\n
To remove a BitLocker recovery key stored in JumpCloud from a device that has its disk fully decrypted:<\/strong><\/p>\n\n\n\n
- \n
- Remove the device from your JumpCloud org.<\/li>\n\n\n\n
- Install the JumpCloud agent manually. See Installing the Windows Agent Manually<\/a>.<\/li>\n<\/ol>\n\n\n\n
- Select the Devices<\/strong> tab, then select a Windows device with the BitLocker policy.<\/li>\n\n\n\n
- In the Admin Portal, go to DEVICE MANAGEMENT <\/strong>> Devices<\/strong>.<\/li>\n\n\n\n
- If you select Encrypt All Non-Removable Drives<\/strong> when creating the policy, you will receive a single Recovery Key for all drives. <\/li>\n<\/ul>\n\n\n\n
- After the user starts the device, BitLocker continues to encrypt the drive silently in the background until encryption is complete.<\/li>\n<\/ol>\n\n\n\n
- A notification appears requesting that the user restart their device to enable BitLocker.
- Select the Devices <\/strong>tab.<\/li>\n\n\n\n
- Select the BitLocker Full Disk Encryption policy, and then select the Devices <\/strong>tab to display a list of encrypted devices.<\/li>\n\n\n\n
- Verify that the Policy Status is updated to BitLocker Not Protected – Encryption has been enabled. Device drive encryption will begin on the next boot.<\/strong><\/li>\n\n\n\n
- Go to DEVICE MANAGEMENT <\/strong>> <\/strong>Policies<\/strong>.<\/li>\n\n\n\n
- Log in to the JumpCloud Admin Portal<\/a>.<\/li>\n\n\n\n
- Device must have a TPM 2.0 chip present to enable BitLocker.<\/li>\n<\/ul>\n\n\n\n
- On the Device Details page, the disk encryption status that displays under both the Details and System Insights drop-downs may take up to 2 hours to populate, and both fields may not populate at the same time. <\/li>\n<\/ul>\n\n\n\n
- JumpCloud supports international languages in BitLocker encryption. The following languages have been verified by JumpCloud:\n