BitLocker: Fixed and Removable Drives¶
Fixed data drives are second internal disks (D:). Removable drives are USB sticks and external disks. The policies for both mirror the OS drive with one big difference: removable drives that aren't encrypted become read-only, which stops data walking out on a USB stick.
Where¶
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption → Fixed Data Drives and Removable Data Drives.
Fixed data drives¶
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.10.10.1.1 | Allow access to BitLocker-protected fixed data drives from earlier versions of Windows | Disabled | Older Windows versions used weaker BitLocker To Go; don't let them read these drives |
| 18.10.10.1.2 | Choose how BitLocker-protected fixed drives can be recovered | Enabled | Turns on the sub-settings |
| 18.10.10.1.3 | Allow data recovery agent | Enabled: True | An organization-wide certificate can recover data drives |
| 18.10.10.1.4 | Recovery Password | Enabled: Allow 48-digit recovery password (or Require) | |
| 18.10.10.1.5 | Recovery Key | Enabled: Allow 256-bit recovery key (or Require) | |
| 18.10.10.1.6 | Omit recovery options from the BitLocker setup wizard | Enabled: True | Policy decides recovery, not the user |
| 18.10.10.1.7 | Configure use of hardware-based encryption for fixed data drives | Disabled | Software encryption only |
| 18.10.10.1.8 | Configure use of passwords for fixed data drives | Disabled | No password-only unlock; use smart card or automatic unlock |
| 18.10.10.1.9 | Configure use of smart cards on fixed data drives | Enabled | |
| 18.10.10.1.10 | Require use of smart cards on fixed data drives | Enabled: True | Smart card is the unlock method |
Removable data drives¶
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.10.10.3.1 | Allow access to BitLocker-protected removable data drives from earlier versions of Windows | Disabled | Same as fixed |
| 18.10.10.3.2 | Choose how BitLocker-protected removable drives can be recovered | Enabled | |
| 18.10.10.3.3 | Allow data recovery agent | Enabled: True | |
| 18.10.10.3.4 | Recovery Password | Enabled: Do not allow 48-digit recovery password | A removable drive's recovery password would travel with the drive; the recovery agent is the path instead |
| 18.10.10.3.5 | Recovery Key | Enabled: Do not allow 256-bit recovery key | Same |
| 18.10.10.3.6 | Omit recovery options from the BitLocker setup wizard | Enabled: True | |
| 18.10.10.3.7 | Configure use of hardware-based encryption for removable data drives | Disabled | |
| 18.10.10.3.8 | Configure use of passwords for removable data drives | Disabled | |
| 18.10.10.3.9 | Configure use of smart cards on removable data drives | Enabled | |
| 18.10.10.3.10 | Require use of smart cards on removable data drives | Enabled: True | |
| 18.10.10.3.11 | Deny write access to removable drives not protected by BitLocker | Enabled | An unencrypted USB stick is read-only. Nothing can be copied onto it. This is the setting that stops data theft by USB. |
| 18.10.10.3.12 | Do not allow write access to devices configured in another organization | Enabled: False | Drives encrypted by another organization can still be written to (the default; tightening this requires an identification field) |
Test the USB rule¶
After applying 18.10.10.3.11 and gpupdate /force, plug in an unencrypted USB drive and try to copy a file to it. Windows refuses with a message about BitLocker protection. That's the setting working.
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v RDVDenyWriteAccess
reg query "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v FDVHardwareEncryption
reg query "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v RDVRecoveryPassword
RDVDenyWriteAccess 1, FDVHardwareEncryption 0, RDVRecoveryPassword 0.