implementing-disk-encryption-with-bitlocker

# Implementing Disk Encryption with BitLocker ## When to Use Use this skill when: - Encrypting Windows endpoints to protect data at rest for compliance (PCI DSS, HIPAA, GDPR) - Deploying BitLocker across enterprise fleet via Intune, SCCM, or GPO - Configuring TPM-based encryption with PIN or USB startup key for enhanced security - Managing BitLocker recovery keys in Active Directory or Azure AD **Do not use** this skill for Linux disk encryption (use LUKS/dm-crypt) or macOS (use FileVault). ## Prerequisites - Windows 10/11 Pro, Enterprise, or Education edition - TPM 2.0 chip (recommended; TPM 1.2 supported with limitations) - UEFI firmware with Secure Boot enabled (recommended) - Separate system partition (200 MB minimum, created automatically by Windows installer) - Active Directory or Azure AD for recovery key escrow ## Workflow ### Step 1: Verify TPM and System Requirements ```powershell # Check TPM status Get-Tpm # ManufacturerId, ManufacturerVersion, TpmPresent, TpmReady, TpmEnabled # Check TPM version (2.0 required for best compatibility) (Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm).SpecVersion # Check UEFI/Secure Boot Confirm-SecureBootUEFI # Returns True if Secure Boot is enabled # Check BitLocker readiness $vol = Get-BitLockerVolume -MountPoint "C:" $vol.VolumeStatus # Should be "FullyDecrypted" $vol.ProtectionStatus # Should be "Off" ``` ### Step 2: Configure BitLocker GPO Settings ``` Computer Configuration → Adminis...