bitlocker-design

Name: bitlocker-design
Author: vinayaklatthe

55installs34forks

How to install bitlocker-design?

vinayaklatthe/microsoft-security-skills/bitlocker-design

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill bitlocker-design

Installs into the current project.

Summary

Guidance for designing BitLocker drive encryption for Windows endpoints managed via Microsoft Intune — encryption policy, silent enablement, recovery key escrow to Entra ID, TPM, pre-boot authentication trade-offs, and BitLocker To Go for removable media. Covers compliance integr

Files · 1

View on GitHub

SKILL.md

1	# BitLocker Design
2
3	BitLocker provides full-volume encryption for Windows devices, protecting data at rest against
4	device loss or theft. In cloud-managed estates it is deployed and monitored through Intune
5	disk encryption endpoint security policies with recovery key escrow to Microsoft Entra ID.
6
7	## When to use
8	Encrypting Windows endpoints and centrally managing recovery keys and compliance. Use this
9	skill to choose pre-boot mode, configure silent enablement, and plan recovery before rollout.
10
11	Do not use this skill for general Intune device baseline (`intune-device-mgmt`),
12	macOS FileVault (use Intune disk encryption policy directly), or Azure VM disk
13	encryption (`azure-key-vault`).
14
15	## Pick the configuration by device type
16
17	\| Device profile \| Pre-boot auth \| Encryption \| Notes \|
18	\|---\|---\|---\|---\|
19	\| Modern corporate laptop (TPM 2.0, Secure Boot) \| TPM-only (no PIN) \| XTS-AES 256 \| Default; silent enable \|
20	\| High-sensitivity admin / Tier 0 (PAW) \| TPM + PIN \| XTS-AES 256 \| Stronger; pairs with PAW \|
21	\| Kiosk / unattended \| TPM-only with Network Unlock \| XTS-AES 256 \| No user to type PIN \|
22	\| Legacy device (no TPM 2.0 / no Secure Boot) \| Replace device \| n/a \| Don't try to enable on bare-metal legacy \|
23	\| Removable media (USB) \| BitLocker To Go (password or smart card) \| XTS-AES 256 \| Separate policy \|
24	\| Fixed data drives \| Auto-unlock with OS drive \| XTS-AES 256 \| Encrypt with OS drive \|
25
26	> Rule of thumb: TPM-only + silent enablement is the right default for 95% of modern
27	> corporate laptops. TPM+PIN doubles the security against physical attack but triples support
28	> calls. Reserve TPM+PIN for Tier 0 / PAW.
29
30	## Approach
31
32	1. Confirm prerequisites — TPM 2.0 (TPM 1.2 in narrow cases), Secure Boot UEFI, supported
33	Windows edition (Pro/Enterprise), Entra-joined or hybrid-joined (required for key escrow).
34	*Verify: `Get-Tpm` shows `TpmReady=True`; `manage-bde -status` shows the drive as
35	encryptable.*
36
37	2. Configure Intune disk encryption policy — Endpoint security → Disk encryption →
38	create a BitLocker profile. Set encryption method (XTS-AES 256), encrypt OS drive +
39	fixed drives, pre-boot mode (TPM-only by default).
40
41	3. Silent enablement — Enable silently enable BitLocker on devices and **escrow
42	recovery keys to Microsoft Entra ID automatically**. User sees no prompt; encryption
43	completes in background. This is the modern default.
44	*Verify: pilot device shows BitLocker = On, key escrowed to Entra (visible on device
45	object), no user interaction recorded.*
46
47	4. Verify recovery key escrow before broad rollout — Pull a pilot device's recovery key
48	from the Entra device blade. If you can't retrieve it, your policy is wrong - fix
49	before scaling. Un-escrowed keys mean unrecoverable devices.
50	Verify: 100% of pilot ring devices have key visible in Entra; help desk can retrieve.
51
52	5. BitLocker To Go for removable drives — Separate policy: require password (8+ chars) or
53	smart card for removable-drive encryption. Block writes to unencrypted removable
54	drives via Defender for Endpoint device control if data sensitivity warrants.
55
56	6. Feed compliance and Conditional Access — Add BitLocker / encryption to the Intune
57	compliance policy. CA grant control "Require compliant device" then gates corporate apps
58	on encryption status.
59	*Verify: an unencrypted device is reported non-compliant within the compliance grace
60	period; blocked by CA.*
61
62	7. Monitor + recovery operations — Encryption report daily; alert on devices stuck at
63	encrypting > 7 days. Document the help-desk recovery flow: user reads recovery key ID
64	from boot screen → help desk looks up in Entra → reads back the key.
65
66	## Guardrails
67	- **Verify recovery key escrow is working before broad rollout - un-escrowed keys risk data
68	loss.** Pilot 50 devices, retrieve every key, then scale.
69	- **Pilot pre-boot authentication choices; they affect user experience and automation /
70	imaging.** TPM+PIN can break Wake-on-LAN, remote management, and unattended reboots.
71	- **Removable-drive encryption

People who liked this also viewed

6 picks

Type

bitlocker-design

55installs34forks

View on GitHub

How to install bitlocker-design?

vinayaklatthe/microsoft-security-skills/bitlocker-design

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill bitlocker-design

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# BitLocker Design
2
3	BitLocker provides full-volume encryption for Windows devices, protecting data at rest against
4	device loss or theft. In cloud-managed estates it is deployed and monitored through Intune
5	disk encryption endpoint security policies with recovery key escrow to Microsoft Entra ID.
6
7	## When to use
8	Encrypting Windows endpoints and centrally managing recovery keys and compliance. Use this
9	skill to choose pre-boot mode, configure silent enablement, and plan recovery before rollout.
10
11	Do not use this skill for general Intune device baseline (`intune-device-mgmt`),
12	macOS FileVault (use Intune disk encryption policy directly), or Azure VM disk
13	encryption (`azure-key-vault`).
14
15	## Pick the configuration by device type
16
17	\| Device profile \| Pre-boot auth \| Encryption \| Notes \|
18	\|---\|---\|---\|---\|
19	\| Modern corporate laptop (TPM 2.0, Secure Boot) \| TPM-only (no PIN) \| XTS-AES 256 \| Default; silent enable \|
20	\| High-sensitivity admin / Tier 0 (PAW) \| TPM + PIN \| XTS-AES 256 \| Stronger; pairs with PAW \|
21	\| Kiosk / unattended \| TPM-only with Network Unlock \| XTS-AES 256 \| No user to type PIN \|
22	\| Legacy device (no TPM 2.0 / no Secure Boot) \| Replace device \| n/a \| Don't try to enable on bare-metal legacy \|
23	\| Removable media (USB) \| BitLocker To Go (password or smart card) \| XTS-AES 256 \| Separate policy \|
24	\| Fixed data drives \| Auto-unlock with OS drive \| XTS-AES 256 \| Encrypt with OS drive \|
25
26	> Rule of thumb: TPM-only + silent enablement is the right default for 95% of modern
27	> corporate laptops. TPM+PIN doubles the security against physical attack but triples support
28	> calls. Reserve TPM+PIN for Tier 0 / PAW.
29
30	## Approach
31
32	1. Confirm prerequisites — TPM 2.0 (TPM 1.2 in narrow cases), Secure Boot UEFI, supported
33	Windows edition (Pro/Enterprise), Entra-joined or hybrid-joined (required for key escrow).
34	*Verify: `Get-Tpm` shows `TpmReady=True`; `manage-bde -status` shows the drive as
35	encryptable.*
36
37	2. Configure Intune disk encryption policy — Endpoint security → Disk encryption →
38	create a BitLocker profile. Set encryption method (XTS-AES 256), encrypt OS drive +
39	fixed drives, pre-boot mode (TPM-only by default).
40
41	3. Silent enablement — Enable silently enable BitLocker on devices and **escrow
42	recovery keys to Microsoft Entra ID automatically**. User sees no prompt; encryption
43	completes in background. This is the modern default.
44	*Verify: pilot device shows BitLocker = On, key escrowed to Entra (visible on device
45	object), no user interaction recorded.*
46
47	4. Verify recovery key escrow before broad rollout — Pull a pilot device's recovery key
48	from the Entra device blade. If you can't retrieve it, your policy is wrong - fix
49	before scaling. Un-escrowed keys mean unrecoverable devices.
50	Verify: 100% of pilot ring devices have key visible in Entra; help desk can retrieve.
51
52	5. BitLocker To Go for removable drives — Separate policy: require password (8+ chars) or
53	smart card for removable-drive encryption. Block writes to unencrypted removable
54	drives via Defender for Endpoint device control if data sensitivity warrants.
55
56	6. Feed compliance and Conditional Access — Add BitLocker / encryption to the Intune
57	compliance policy. CA grant control "Require compliant device" then gates corporate apps
58	on encryption status.
59	*Verify: an unencrypted device is reported non-compliant within the compliance grace
60	period; blocked by CA.*
61
62	7. Monitor + recovery operations — Encryption report daily; alert on devices stuck at
63	encrypting > 7 days. Document the help-desk recovery flow: user reads recovery key ID
64	from boot screen → help desk looks up in Entra → reads back the key.
65
66	## Guardrails
67	- **Verify recovery key escrow is working before broad rollout - un-escrowed keys risk data
68	loss.** Pilot 50 devices, retrieve every key, then scale.
69	- **Pilot pre-boot authentication choices; they affect user experience and automation /
70	imaging.** TPM+PIN can break Wake-on-LAN, remote management, and unattended reboots.
71	- **Removable-drive encryption

People who liked this also viewed

6 picks

Type