@Starlight5
I just put in my bitlocker pin. Put it once and then again to confirm. What i noticed was it didn't seem to show any spaces such as say you type a few numbers or letters when you want to check it so to speak.
After i did this,
It shows
Key protectors added
tpm and pin
ID: A very long mix of letters and numbers.
PCR Validation Profile:
number, number, number
Key Protector with ID Very long lix of letters and numbers was deleted
Do I need to write down the id and pcr validation profile or copy it or this is nothing?
-
@Starlight5
When i type in manage-bde -status it shows this
Volume E: New Volume
Data Volume
Size: 29.282gb
Bitlocker version: None
Conversion Status: Fully Decrypted
Percentage Encrypted: 0%
Encryption Method: None
Protection Status: Protection Off
Lock Status: Unlocked
Identification Field: None
Automatic Unlock: Disabled
Key Protectors: None Found
Volume C:
OS Volume
Size: 232GB
Bitlocker version: 2.0
Conversion Status: Fully Encrypted
Percentage Encrypted: 100%
Encryption Method: XTS-AES 128
Protection Status: Protection On
Lock Status: Unlocked
Identification Field: Unknown
Key Protectors:
Numerical Password:
TPM and PIN
So that mean everything here looks good right? There seems to be nothing showing next to numerical password and the tpm and pin right?
So right now close this command prompt.
Click restart computer... then it will have that message enter your bitlocker pin. Then i enter it... then it goes straight to win10 screen, type win10 password... and thats all correct?
Im going to not close the Select Administrator: Command Prompt until I make sure of all this. -
Can anyone here confirm what I did hear is correct when setting up the bitlocker pin?
Do i need to copy the
Key protectors added
tpm and pin
ID: A very long mix of letters and numbers.
PCR Validation Profile:
number, number, number
Key Protector with ID Very long lix of letters and numbers was deleted
The power in my apartment and my area just went out so we don't have electricity at the moment. And i don't want to close the command prompt screen yet until im sure. Can someone here confirm this? -
Starlight5 Yes, I'm a cat. What else is there to say, really?
@Drew1 you have recovery key, so don't bother.
-
@Starlight5
I only have it the recovery key saved to 2 usb sticks. So that is fine right?
Also everything else you see i posted on the screen is correct right?
Also so right now... shut it down. Then turn it on... then enter my bitlocker pin ... then windows pw right? Just want confirmation of this.
Thanks. And my electrictity is still not back yet. So on battery at the moment. -
@Starlight5
I shut down computer. Then waited a bit and turned it on. It then ask me for my bitlocker pin on the screen... i typed it in and then it goes to win10 screen and now log into with win10 password.
Im curious but if someone were to try to enter the bitlocker pin... they don't have a clue if its just numbers or letters or mix of both right?
Also its very easy to disable this bitlocker pin or change it to another one? I like this bitlocker message asking for the pin. Seems much more secure than it going straight to win10 password screen. -
Starlight5 Yes, I'm a cat. What else is there to say, really?
-
@Starlight5
Thanks a lot.
One other thing i want to add to this. Is it pretty easy to encrypt my hard drive and usb sticks? I have a few of these. I assume you encrypt all these as well right? Thus if i do this, i would use bitlocker to encrypt it but that would require a pin similar to this? Im wondering what happens when you connect the external hard drive to your laptop. It ask for the pin? Now what about if i try to connect the external hard drive or usb to say another computer i have...? Does it allow it or not?
Thus the other worry is well if a hacker has access to my external hard drive and usb sticks, well they could stick it to a laptop... put a virus on it... then say i connect it to my laptop as is... well the malware/keylogger/virus would be there automatically? Or only if i were to open that program in the external hard drive or usb stick? Obviously this would be a much more advanced thing. The other thing though is well if a thief cannot turn on my laptop... well if they have the external hard drive and usb sticks... well they can't stick it in my encrypted laptop right? Thus they either have to have their own with them or put my usb and external hard drive in their computer to do anything to it?
Could they view my files if i they connect my external hard drive and usb stick to their own laptop? This is assuming those documents are encrypted with axcrypt? Now what if i have some programs there that are not encrypted. Let say i put itunes and a few other programs in my external and usb stick. Could they put a virus in my usb stick or external hard drive... put it back to where it was in my apartment... then i plug it in... then im screwed? Or only if i open those programs? -
Starlight5 Yes, I'm a cat. What else is there to say, really?
Guide on protecting Windows from BadUSB:
https://davidzou.com/articles/windows/defend-against-badusb -
@Starlight5
So I basically stick a usb stick or usb hdd into my laptop... then go to my computer and then right click it and click turn on bitlocker? Then input a password and thats all? Okay so say i have a few usb flash drives and a few usb hdd that i want to do this. I assume you are using the same password for all of them right? I can't imagine someone using a separate pw for each one as that would be chaos right? Also would you say its safe to type that password in a program like keepass or is that not safe to do it?
So everytime you want to plug the external hard drive into your laptop or any other computer ... you have to enter the password? So it would say something like enter the bitlocker password similar to like how when you start up laptop, it ask you for the bitlocker pin? You 100% agree that you should encrypt every single usb flash drive or hdd right?
They can put malware that attacks immediately on you connecting the device. You can protect yourself from such malware if you want, by special Windows settings. So even after hacker messed with your external storage devices, and you unknowingly plugged one of them into your laptop, the attack won't likely be successful.
What do you mean by special windows settings? You mean if they did something to it on their computer... then put the usb and hdd back to where it was... then you connect it to your laptop? How would special windows settings protect that?
But if you were to encrypt the usb flash drive and hdd with a password, they cannot do anything to it correct? So they could have access to your laptop and usb flash and usb hdd... but they cant put anything on it correct?
If you don't protect your system against BadUSB, and plug in a malicious device, you're screwed and you may not even know it. Hacker may not even bother keeping your info on the drive, especially if the drive is encrypted - just put a malware on it, and while you're figuring out what happened to your usb drive, confused where your files went, malware already does its dirty deeds.
Guide on protecting Windows from BadUSB:
Wait. But this all can be protected as long as your current usb flash drive usb hdd are password protected right? Thus do not plug any usb device into my laptop if its not encrypted? And don't let anyone plug a usb stick in my laptop? But if they plug in their own malicious device... that would work or not assuming my computer is turned off?
Wait but the way my computer is setup now with bitlocker pin and windows10 password, they cannot stick in a malicious device and do anything to it... UNLESS im on my desktop screen right? Thus if they don't know my bitlocker pin? What if they know my bitlocker pin but not my windows 10 password? They still cannot do this attack right because my hard drive is encrypted? -
Starlight5 Yes, I'm a cat. What else is there to say, really?
If your computer is off, they won't be able to do anything under normal circumstances. Skilled hacker may try to rig your firmware or extract secrets from TPM.
If you're into plugging USB devices that don't belong to you, or exchanging information via USB drives, use the steps from guide I linked to protect from BadUSB (most dangerous USB attack) and a good antivirus in case there is some less complicated malware there. If you generally don't do either, then keep your current settings and don't plug unknown devices, or your own devices you believe could have been compromised.
Last edited: Apr 22, 2019 -
@Starlight5
Well i will first use it on a usb drive that has very little gb on it first. Well i can't use bitlocker autolock since i have the bitlocker with tpm pin right? Or could i do this with the usb drive?
You can check auto-unlock option to make it unlock automatically when connected to particular computer. Do you do this? So based on what i described about what i want... do you recommend this or not? But im stilling to be encrypting it no matter what right? Well what i store on it would be say a password program and say my bitlocker recovery key and few other documents. Thus if you stick my usb stick into another computer, you see lot of documents but they are encrypted with axcrypt. Then you would see documents like bitlocker recovery key and its encrypted. And of course the keepass program. And in order to get into that, you need my keepass password.
Well if i don't encrypt it my usb flash drive or external drive... can someone plug my usbs into their laptop. Then put malware/keylogger on it. Then leave my usb flash drive ans hdd as it is. Then when i connect it to my laptop after i log into the desktop... arent i screwed then? Thus this is similar to like someone taking their own malicious usb and plugging it into my laptop?
No i do not allow other put usb sticks in my laptop. I do not do that. I don't even connect my usbs to other ppls computers or a public computer. Because i dont want to get a malware/keylogger... then plug it int my laptop. Do you agree with this?
Wait how could someone put malicious software on the usb flash drive or hdd with sacrificing data? Do you mean them wiping it fully clean so to speak? Because every device can be fully wiped clean? Then all they have to do is put malware/keylogger on it and i have no clue... then i plug it into my laptop and see all my files are gone and something else is there? Is that what you mean by that? Then how do you protect yourself from something like this? Everytime you want to plug your usb flash drive or hdd into your main laptop, first connect it to another computer to see if your current files are still there? If so, its fine. If not... then someone did something with it? Again i dont have these type of threats now but i want to eliminate as much threats as possible. Thus anyone that connects a usb flash drive or hdd into their laptop even if their usb are encrypted... if someone did something to it while you were not there and put malicious software on it... then you connect it to your laptop like you normally do... then you see your files are not there.. you are screwed.. is that correct? So only precaution would be plugging it into another safe machine first before you put it in your main laptop?
What if they know your bitlocker pin but not your windows 10 password? -
Starlight5 Yes, I'm a cat. What else is there to say, really?
https://davidzou.com/articles/windows/defend-against-badusb
Basically what the guide does is forces Windows to ask permission when you attach new device that is a keyboard/mouse/other HID or network adapter. These types of devices can immediately attack you over USB, without you even doing anything e.g. opening malicious file. But to work, they require a driver loaded for them. So, when you plug a malicious USB drive, you get a notification about device(s) requesting driver installation, and need to manually install them via Device Manager to work. If you see that USB drive wants any driver other than USB storage, it is definitely malicious, so you just remove it instead of installing drivers and letting it do its dirty deeds. I personally believe it is easier and more straightforward than using another computer, but opinions may vary.
Drew1 likes this. -
@Starlight5
I just want to confirm this. So if i autolock all my usb flash drive and hdd... everytime i plug it into my laptop... I do not have to type in my password correct as my laptop automatically recognizes my device? Encryption is what i want to do. Unlocking means anytime I want to connect it to my laptop... it DOES NOT ASK ME FOR MY PASSWORD? So based on what i described to you, you would agree autolock for me is good idea right? Since i make sure if my computer is turned on when im not there, im on the win10 screen that is locked?
So for me, its safe to do autolock my usb flash drive and hdd because unless my computer is turned on... im safe from all of this right? Am i still safe from this if im on my win10 password screen or i lock my screen when im using my computer? Both are the same thing whether im already in my computer and lock it or not put in my win10 password right? Just want to confirm this part.
Okay so my situation, the only thing i have to worry about assuming i encrypt my usb flash drive and hdd is if someone has access to my usb flash drive and hdd... decide to just wipe them out completely and its like brand new. Then install malware/keylogger/virus on it. Then i plug it inside my usb port in my laptop and by the time i do that... its too late right? Thus i don't even need to open any file from the usb? Well if they were to do this, the moment i plug in my usb into my laptop, the only thing i would notice is.... what happened to all my files right? Also would it be possible for there to be absolutely no files shown when i open the usb flash drive when i check the drive? Or does it have to have some type of file there at least showing for there to be a virus? Because for example if i were to connect my usb to my laptop and open the flash drive and notice... hey all my files are gone. My thought would be the usb malfunctioned and basically everything got deleted.
When you say they can access your data if they know your bitlocker pin and not windows 10 password, you are talking about my laptop data in windows or the usb flash drive and hdd? Or both?Starlight5 likes this. -
Starlight5 Yes, I'm a cat. What else is there to say, really?
-
I get error
Starting bitlocker
Group policy settings for bitlocker setup options are in conflict and cannot be applied. Contact system administrator for more information. -
Starlight5 Yes, I'm a cat. What else is there to say, really?
@Drew1 you should try to be more informative than that. Under which circumstances does the error occur?
-
@Starlight5
I put a usb flash drive into my computer. I right click it and click enable bitlocker.
I get this message... -
Does this have to do with the
Local group policy editor? Because there is some conflict?
The require additional audtentication at startup?
I had it changed to enabled and the Configure TPM startup PIN to Require startup PIN with TPM. So i might have to change this to allow startup pin with TPM? Because this conflicts with it?
Or it has do with the same thing but instead of clicking the operating system drives, i click on removable data drives or fixed data drives? Im guessing its removable data drives? And something to do with the 1st line of control use of bitlocker on removable drives or enforced drive encryption type on removable data drives? -
Starlight5 Yes, I'm a cat. What else is there to say, really?
@Drew1 yes, it has to do with your settings. Make a good screenshot of them, post it here.
-
I'm assuming this has to do with removable data drives and i have to fix something with this right?
Also on the 2nd picture in the
Configure TPM startup pin
I changed it to Require startup pin with TPM as this was in the instruction in order to setup bitlocker pin at boot. Someone told me i could actually have chosen the option Allow Startup Pin with TPM instead. They said that works either. That is true? What's the difference? If you put required as i did, well you need to put it. But if you I change it to allow startup pin... it would or would not ask me startup bitlocker pin when starting windows? Also this has nothing to do with encryption of flash drive or external hdd right since this has to do with startup? -
Starlight5 Yes, I'm a cat. What else is there to say, really?
-
@Starlight5
I did not make any changes to any of this. Because im not sure what to change yet...
You want to me to change the setting
Control use of bitlocker on removable drives and enable it?
If so... both these below are checked
Allow users to apply bitlocker protection to removable data drives
Allow users to suspend and decrypt bitlocker protection on removable data drives
So enable it and make sure these 2 stay checked right? Then try encrypting the flash drives? -
Starlight5 Yes, I'm a cat. What else is there to say, really?
@Drew1 I have default settings for removable devices, the same as yours, and no problems encrypting external drives. You should ask the person who recommended you using Bitlocker PIN.
-
@Starlight5
Okay i will and see their response to this. -
Hey.
That person told me to change require startup to allow startup.
Should i do that/ The other thing is... why would startup have anything to do with this? Wouldn't it be the external drive data that probably should be changed instead? -
Starlight5 Yes, I'm a cat. What else is there to say, really?
@Drew1 I believe you should follow the advice on changing said setting. I don't know why OS drive Bitlocker settings affect external drives, but that seems to be the issue here. Let us know if your problem is resolved after changing the setting.
-
@Starlight5
There is no risk changing it to that setting and then restarting the computer where i should get the bitlocker pin ask and windows 10 password ask right? -
Starlight5 Yes, I'm a cat. What else is there to say, really?
@Drew1 don't worry, just do it.
-
hey starlight5, i have been using bitlocker ever since you helped me with it and its great. Everytime i turn on computer, i have to enter my pin and then once i do that... i get the windows password screen where i enter that... then im on my laptop.
Im curious but have you ever installed a new ssd in an old laptop or say bought a new laptop and want everything transferred from your old laptop to the new laptop? I want to get a new ssd because my 250gb is running out of space... well it still has space but after a while, i think it would run out. So i want to get 500gb or 1tb for futureproof.
I was told i could download macrieum reflect and then copy the exact image of it to an external hard drive liek those 1tb ones... and also put something on a small usb flash stick. Have you ever done this before? The one major issue it seem before i try this is i read you cannot have bitlocker on... thus encrypted... otherwise the copying process will have issues. Did you ever did this? So i just turn it off for now... then once i copy everything... then i turn it back on?
I was told turn bitlocker off. copy everything. Then when i get the bigger m.2 ssd... i would then remove both my hard drives... the 2.5 inch 250gb ssd and the 32gb m.2 ssd... then put the 500gb/1tb m.2 ssd in place of the 32gb m.2 ssd. And the reason i would remove the 2.5 inch ssd is i want to buy a bigger battery for my xps 15 9550, a 84wh or 97wh one. My current battery is 56wh and battery is very poor now.
They said when i installed the new m.2 ssd and battery in my laptop, turn it on and install as normal. That is correct? They say once you do that... then start your laptop again and boot it from the external hard drive/usb? Then once you do this, when you turn laptop on... it will look exactly like it does now. Can you tell me if this is correct? Then once this is done... i can then turn bitlocker on? The thing is i will still have windows 10 pro right like i do right now?
Curious if you know this as i don't want to install a new ssd... then install everything new etc..Starlight5 likes this. -
Starlight5 Yes, I'm a cat. What else is there to say, really?
@Drew1
When I upgraded storage I didn't bother decrypting the drives at all. What I did was:
1. Backup bitlocker encryption key for OS drive to external drive(s)
2. Replace the OS drive
3. Clean install Windows
4. Install software
5. Connect old drive via USB enclosure, copy data from itDrew1 likes this. -
Hi there. When i turn bitlocker off... does it do it pretty quick? So once i do this, then i turn laptop off. Then turn on... laptop would go to my windows password screen only right? Would you say i should disable windows password screen as well for this? So when i enable bitlocker again on my computer, i need to put a new bitlocker pin right? I can't just have it use the bitlocker pin i currently have now? I want to test it out now by turning bitlocker off. Then turning it back on and i would use the same pin that i been using now.
Im surprised you never cloned a hard drive for windows ever.
I have 1tb external hard drive. I even have another 250gb samsung ssd that is empty that i formatted a while back. I have a hard drive enclosure as well so i could put that samsung ssd into it etc. I also have a 64gb usb stick as well. So i need 2 of these things? Thus use the 1tb external hard drive and the 64gb usb stick? Or i only need 1?
I never went to Bios ever. Did not want to touch anything related to bios. But i have to go there to check it?
When you say backup encryption key to external drive, you mean just that long key and that is it?
Okay so you replace os drive with a new one. When you say clean install windows... what do you mean by that? Because after you put in new hard drive... don't you just power it on and follow instructions and install windows? Im confused with what you mean clean install windows.
Okay so you connect the old drive via usb enclosure and copy data from it. But when you did this, you mean you copied your files and videos/pictures right? Like example if i wanted to backup my important files/documents/pictures on my ssd now, i would just copy and drag them to external hard drive. That is what you meant by it right? But you never did any image saving etc? Im surprised because i read lot of ppl do this so if anything happens to your computer, or if you get new computer and want your new laptop or different laptop or laptop with new ssd to look exactly like how it did on your old laptop, you do the image backup... Is there a reason you never did this? So you then installed all your programs from scratch? Example say you have programs like itunes, winamp, openoffice and lot of programs you have on your desktop icons... so you downloaded all of them again? But did your external hard drive had any of these programs?
People said to make image backup with macrium free. And after you install windows like you normally do on your computer, then copy the image to the computer afterwards. They said well if that doesn't work... well at least you get to use your new ssd as is. But the thing that confuses me is i have windows 10 pro. So wouldn't that mean i couldn't use windows 10 pro if me copying it from my external hard drive or usb to the new ssd won't work mean i can't use windows 10 pro? But if it does work... my computer will suddenly be like right now windows 10 pro? Because i don't want to buy it since i already have a copy of it right now.
I will reply back later tomorrow night as I am busy all day tomorrow. Thanks. -
Starlight5 Yes, I'm a cat. What else is there to say, really?
If you have software-encrypted Bitlocker, it will take its sweet time to decrypt contents of your drive.
If I had fleets of similarly specced machines in corporate environment, of course I would use images. But all machines I service require different software subset, and typically have different hardware - so there is zero reason to use and maintain OS images.
2. Fresh installation of Windows is healthier than old one that underwent a number of feature updates and may have registry conflicts etc.
3. Doing this, I re-evaluate which programs do I really need, and which I no longer want on my device.
Last edited: Sep 23, 2019Drew1, Spartan@HIDevolution and 6730b like this. -
....and +++ for unearthly patience :O)Starlight5 likes this. -
Hey i understand starting fresh is best. But because i have so many programs there, that is why i want to use it.
Someone told me if i see a windows 10 pro edition in my settings, its legit... so they are wrong? The person who installed windows 10 pro on my computer, years ago, i have no idea if he used real or not real version. I did remember i paid him over 100 dollars to set it up because my 2 hard drives... the 32gb m.2 ssd was the main thing everything was saved to and i needed the 2.5 inch 250gb ssd to be the one it used. -
Starlight5 Yes, I'm a cat. What else is there to say, really?
-
Hey man. The computer place where i go to always seem to not be there anymore. That guy was my computer guy but he isn't there anymore.
I found a place where they told me they will take a look at my laptop. I asked them would they be able to do everything in front of me as oppose to me leaving it there and picking it up later.. and they said its possible.
So right now im going to turn bitlocker off. Download macrieum free and do the copy process. Then im going to order the dell bigger battery and the 500gb or 1tb ssd.
So when i go to the repair shop, bring all these things. But after he put in the new battery and new ssd... i most likely will not upgrade the ram... when he starts up the computer, do i make sure he boots it from the usb or does he start it up like normal. And then do that? I ask this because well if he was to boot it from my usb, i probably have to pay more for that right since he is sort of installing it for me? But he still has to power on my laptop to make sure my laptop works with the battery and the new ssd right?
Such as the cloning thing... to do the transfer... i can easily do this very quick after he put the new m.2 ssd and battery in it right?
Thanks. -
Okay I want to know. Would this be fine as well.
Do the cloning and everything into an external hard drive and usb stick.
Bring the laptop and new m.2 ssd and battery there. Have them take out my m.2 ssd and the 2.5 inch 250gb ssd. Then put in the new m.2 1tb/500gb ssd. Take out the old 56wh smaller battery and put in the bigger 84wh or 97wh in.
Then when they turn on my laptop, it will show like windows installation right? So they would have to do the windows 10 installation on the spot? Or could the turn it off and then i turn it on at home and doing everything at home. Because i would not need them to install windows 10 for me as well i can do it on my own. Or i have to make sure i do the cloning transfer right on the spot the computer turns on and you boot from the usb or external?
The thing is i want my computer to turn on and look exactly how it is right now... with more space of course and the new battery.
Obviously you all say do all the cloning etc before you get the items online. But when i do get the items, i want to know exactly what i tell the computer repair shop.
Also, to those who done this, does anyone know the success rate? Some ppl mention cloning doesn't always work and always prefer a fresh new windows. But if your computer has issues and doesn't work, well your image backup would then make it look exactly how you want it right?
Also wouldn't that mean i basically will have them install windows 10 for me as normal when they set it up or i set it up? Then when i get back home, i then connect the external hard drive and/or usb and the boot it from there... then i restart computer... and suddenly my laptop now shows exactly how it is right now? I want to make sure of this because i need to know exactly what to ask/tell the computer guy i want to do since the macrieum reflect thing i will be doing that.
BitLocker questions
Discussion in 'Windows OS and Software' started by Drew1, Feb 16, 2018.