Comprehensive BitLocker Deployment

This project aims to deploy BitLocker encryption to over 400 endpoints, enhancing data security and ensuring compliance with industry standards. The deployment will cover various devices, ensuring that all data is encrypted and protected against unauthorized access. The scope of the project includes planning, execution, and monitoring to ensure a seamless transition and minimal disruption to operations.

To successfully deploy BitLocker, verify that all endpoints have TPM 1.2 or higher, and that BIOS/UEFI settings support TPM.

Preparation Outline

• Prioritize Deployment
• TPM Activation
• Commands for CMD
• Encryption Policy
• Storing Recovery Keys

Before deploying BitLocker, it is crucial to ensure that all hardware meets the necessary specifications, including TPM (Trusted Platform Module) availability. Additionally, the operating systems must be compatible with BitLocker, and all devices should have the latest updates installed. 

These commands were the ones I most used in Command Prompt and Powershell. 

When choosing an encyption policy you will have to take into account the age of the devices and your companies risk appetite.

For my company, we choose to do XTS_AES_256 with Used Spaced Only.

• XTS_AES_256 was chosen to give the most secure encryption type available to us.
• We did used space only for quickest of deployment and this would still protect all data.

There are multiple ways to store BitLocker recovery keys including Active Directory, Entra ID and MDM solutions. We chose to store them in multiple areas with the main solutions being our MDM solution, ManageEngine.  

During the deployment I had to use multiple tools. These included:

• CMD & Powershell
  • Check status of TPM and ManageEngine Remotely
• ManageEngine BitLocker Deployment
  • Deploy Bitlocker Policy
• Teams
  • Communicate with team members.
• LogMeIn
  • Remote Command Line

I tackled deployment challenges with exceptional teamwork and problem-solving skills, addressing TPM activation, BitLocker failures, and legacy boot conversions to UEFI with expertise to ensure a successful deployment meeting data security objectives confidently. One challenge that stood out was after a policy deployment we had on computer that whenever the user logged in Windows would freeze. After looking at log files, I found events for bad blocks on the secondary drive. BitLocker would hit this bad block trying to encrypt it and end up locking up Windows. I turned off encryption on this drive so I could move data to a new hard drive. The new drive was then encrypted with the OS drive.