BitLocker: Operating System Drive¶
BitLocker encrypts the disk so that a stolen laptop, or a drive pulled out and mounted on another machine, is unreadable without the key. The BitLocker profile in the CIS benchmark is about making that encryption hard to bypass and making recovery controlled.
On a competition image¶
VMware images usually have no TPM, so you may not be able to turn encryption on. The policies below can still be set; they take effect when a drive is encrypted. If the README says drives are encrypted or the VM has a virtual TPM, turn it on as well.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Operating System Drives.
The settings¶
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.10.10.2.1 | Allow enhanced PINs for startup | Enabled | The pre-boot PIN can use letters and symbols, not just digits |
| 18.10.10.2.2 | Allow Secure Boot for integrity validation | Enabled | BitLocker trusts Secure Boot to verify the boot chain instead of measuring every component itself, which is more reliable |
| 18.10.10.2.3 | Choose how BitLocker-protected operating system drives can be recovered | Enabled | Turns on control of the sub-settings below |
| 18.10.10.2.4 | Allow data recovery agent | Enabled: False | No certificate-based recovery agent for the OS drive. Recovery goes through the password. |
| 18.10.10.2.5 | Recovery Password | Enabled: Require 48-digit recovery password | A recovery password is always generated, so a forgotten PIN or a hardware change doesn't lose the drive |
| 18.10.10.2.6 | Recovery Key | Enabled: Do not allow 256-bit recovery key | No recovery key file on a USB stick, which is easy to lose or steal. The password is the one recovery path. |
| 18.10.10.2.7 | Omit recovery options from the BitLocker setup wizard | Enabled: True | Users don't pick their own recovery method; policy decides |
| 18.10.10.2.8 | Configure use of hardware-based encryption for operating system drives | Disabled | Self-encrypting drives have had broken implementations. Software encryption is verified. |
Pre-boot PIN (STIG)¶
With only a TPM protector, the drive unlocks automatically at boot, so someone who steals the whole laptop can boot to the login screen and attack from there. The STIG (WN11-00-000031, CAT I) requires a PIN before Windows starts, at least six digits (WN11-00-000032).
| Setting (Operating System Drives) | Set to |
|---|---|
| Require additional authentication at startup | Enabled; Configure TPM startup PIN: Require startup PIN with TPM |
| Configure minimum PIN length for startup | Enabled: 6 |
Then add the protector:
Add-BitLockerKeyProtector -MountPoint C: -TpmAndPinProtector
The last five are all inside the one policy Choose how BitLocker-protected operating system drives can be recovered. Enable it, then set the dropdowns and checkboxes.
Turning BitLocker on¶
If the machine has a TPM (or the VM has a virtual one):
Get-Tpm | Select TpmPresent, TpmReady
Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector
Add-BitLockerKeyProtector -MountPoint C: -RecoveryPasswordProtector
(Get-BitLockerVolume C:).KeyProtector | Where KeyProtectorType -eq RecoveryPassword | Select RecoveryPassword
Save the recovery password somewhere off the machine. On a competition image, a note in your team's working folder is enough.
Verify¶
Get-BitLockerVolume | Select MountPoint, VolumeStatus, ProtectionStatus, EncryptionMethod
reg query "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSRecoveryPassword
reg query "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSRecoveryKey
reg query "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSHardwareEncryption
OSRecoveryPassword 1 (required), OSRecoveryKey 0 (not allowed), OSHardwareEncryption 0.