17

On a Windows 8.1 Pro PC without TPM, how can I use Bitlocker with both a startup USB drive and password?

I don't have the option to use both of them, is this possible via command line?

Screenshot

Currently, using Bitlocker with TPM and a startup USB and password is possible, so it should be possible with a startup USB drive and password but no TPM.

Improve this question
0

2 Answers 2

Reset to default
23

This guide explains it quite well, although consider following the steps below rather than downloading and running .reg files from the internet.

One can turn on Bitlocker without TPM but has to modify the registry in order to allow this, as this isn't what Microsoft originally planned as the drive won't be bound to the computer any longer. For company's convenience this option was added but hidden.

Steps:

  1. Open the group policy editor (gpedit.msc) as admin.
  2. Go into the "directoy" (left sub-window) "Computer Configuration/Administrative Templates/ Windows Components/ BitLocker Drive Encryption/ Operating System Drives"
  3. Open the "Require additional authentification at startup" entry (right sub-window)
  4. Set the radio box to "enabled" and check "Allow Bitlocker without a compatible TPM"
  5. Optional: Change the cipher strength (128 or 256 bit, difference: 128 is secure for ~50 years and 256 for ~200 years) using the "folder" directly above ("BitLocker Drive Encryption") and the "Choose drive encryption method and cipher strength" entry. Check the enabled and choose your cipher in the dropdown menu.
  6. Encrypt your drive as you normally would.

It seems like USB + PIN is not an option any longer in Windows 8 :(

Improve this answer
5
  • not sure but this guide might be the solution.
    – SEJPM
    May 9, 2015 at 11:00
  • I don't own Windows 8 Pro so I can't say anything for sure, but it may be possible to use the guide mentioned in the other comment to configure Windows to use PIN+PW.
    – SEJPM
    May 9, 2015 at 11:04
  • Thanks! What is more secure the USB or a 20 character password?
    – SuperHeroY
    May 9, 2015 at 18:59
  • @SuperHeroY, the funny thing is, I think this question deserve its own dedicated question for a fully qualified answer (using all possible considerations). But ad-hoc I'd say the password is the better option, as you can't lose it like an USB-Stick - provided that the password is random. If the password is weak, you'd be better off with an USB-stick.
    – SEJPM
    May 9, 2015 at 19:03
  • 2
    It's absurd to me that you can't have a BitLocker encrypted USB drive with keys to unlock the entire system. I figured surely that was a thing today and went for it encrypting the USB stick. I backed up all of the keys beforehand just in case... Sure enough when I tried to reboot BitLocker said no keys were found. FFFFUUUUUUUUUUUUUU. Leave it to Microsoft... Obviously a TPM would be idea, but it shouldn't be required. But an unencrypted mobile key is an accident waiting to happen.
    – bambams
    Jul 7, 2016 at 0:04
0

As far as I know, BitLocker supports five configurations: TPM only, TPM+PIN, TPM + Startup Key, TPM + PIN + Startup Key, Startup Key only. ( Startup Key method eeds a USB flash drive containing the startup key.)

Also in this link is a question like your question: Windows 7 BitLocker using startup PIN and USB flash drive, but without a TPM...how?

Someone says that this command can do it, but you must check it, I am not sure

manage-bde -on C: -recovery password -PINandStartupkey PIN PathToExternalDirectory -EncryptionMethod aes256_diffuser

Also read this link

Improve this answer
1
  • The USB + PIN mode without a TPM was removed after Vista, iirc, because it was considered to not actually offer any additional security due to the implementation.
    – Polynomial
    May 9, 2015 at 10:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .