BitLocker Drive Encryption - Windows 7 Drive - Turn On or Off with no TPM

BitLocker Drive Encryption - Windows 7 Drive - Turn On or Off with no TPM

How to Turn On or Off BitLocker without a TPM for Windows 7 Drive​

   Information

This will show you how to turn BitLocker Drive Encryption on or off for your Windows 7 or other operating system drive or partition when your computer does not have a Trusted Platform Module (TPM). When BitLocker Drive Encryption is turned on, you will be required to plug in the USB flash drive that contains the startup key before starting the computer to unlock the Windows 7 or other operating system drive or partition at startup.

   Note

When you add new files to the Windows 7 or other operating system drive or partition that is encrypted with BitLocker, BitLocker encrypts them automatically. Files remain encrypted only while they are stored in the encrypted drive. Files that are copied to another drive, partition, or computer are decrypted.

   Warning

REQUIREMENTS:

• BitLocker is only available in the Windows 7 Ultimate and Enterprise editions.
• A USB flash drive. BitLocker will store its key on the flash drive to use to unlock the Windows 7 drive at startup.
• Have at least two partitions. One partition must include the drive Windows 7 is installed on and must be at least 400 MB. This is the drive that BitLocker will encrypt. The other partition is the active partition, which must remain unencrypted so that the computer can be started. If you have the 100 MB System Reserved partition that Windows 7 creates during installation on a blank drive or partition, then BitLocker will store the key on it instead. If your computer does not have two partitions, BitLocker will create them for you. Both partitions must be formatted with the NTFS file system.
• A BIOS that supports USB devices during computer startup.

PREPARATION:

To Allow BitLocker without a TPM

   Note

You have the option to use the Local Group Policy Editor or a .reg file download to allow BitLocker to be able to encrypt the Windows 7 or other operating system drive or partition without a TPM and with a USB flash drive instead.

METHOD ONE:
Using Local Group Policy Editor
1. Open the Local Group Policy Editor.

2. In the left pane, click on to expand Computer Configuration, Administrative Templates, Windows Components, BitLocker Drive Encryption, and Operating System Drives. (See screenshot below)

3. In the right pane, right click on Require additional authentification at startup and click on Edit. (See screenshot above)

4. To Allow BitLocker without TPM
A) Select (dot) Enabled. (See screenshot below step 6)

B) Under the Options section, check the Allow Bitlocker without a compatible TPM box. (See screenshot below step 6)

C) Go to step 6.
5. To Undo Allow BitLocker without TPM
NOTE: This is optional. Unless you now have a TPM that you would like to use instead, it will not hurt anything to leave this set as in step 4 above.
A) You will need to do OPTION TWO below first to turn off BitLocker.

B) Select (dot) either Not Configured or Disabled. (See screenshot below step 6)
6. Click on OK. (See screenshot below)

7. Close the Local Group Policy Editor window.

8. Open the Start menu, and type gpupdate.exe /force into the search line and press Enter. (See screenshot below)

9. You will see this command prompt pop-up briefly, then go away when completey successfully. (See screenshot below)

10. If you did step 4, then go to OPTION ONE to turn on BitLocker. If you did step 5, then you are done.


METHOD TWO:
Using a REG File Download
1. To Allow BitLocker without TPM
A) Click on the Download button below to download the file below.
Enable_No_TPM.zip

Download


B) Go to step 3.
2. To Undo Allow BitLocker without TPM
NOTE: This is optional. Unless you now have a TPM that you would like to use instead, it will not hurt anything to leave this set as in step 1 above.
A) You will need to do OPTION TWO below first to turn off BitLocker.

B) Click on the Download button below to download the file below.
Default_Require_TPM.zip

Download


3. Save the .zip file to your desktop.

4. Open the downloaded .zip file and extract the .reg file to the desktop.

5. Right click on extracted the .reg file and click on Merge.

6. Click on Run, Yes, Yes, and OK when prompted to approve the merge.

7. Restart the computer to apply.

8. When done, you can delete the downloaded .reg and .zip files if you like.

9. If you did step 1, then go to OPTION ONE to turn on BitLocker. If you did step 2, then you are done.

OPTION ONE

Turn On BitLocker to Encrypt Windows 7 Drive

1. Decide if you want 128-bit or 256-bit encryption.
NOTE: By default, Windows 7 will use AES encryption with 128-bit encryption keys and Diffuser unless changed already by you previously.

2. Plug in the USB flash drive that you want to use to have the startup and recovery key saved to.
NOTE: You will still be able to use the USB flash drive as normal. Just do not remove the BitLocker startup key file (step 7) that is used to unlock your Windows 7 at startup.

3. Open the Start menu and click on the Computer button, then right click on the Windows 7 or other operating system drive or partition letter and click on Turn on BitLocker. (See screenshot below)


A) Go to step 5.
OR

4. Open the Control Panel (icons view), and click on the BitLocker Drive Encryption icon.
A) Click on Turn On BitLocker for the Windows 7 or other operating system drive or partition letter. (See screenshot below)

5. Select the Require a Startup key at every startup option. (See screenshot below)
NOTE: The Use BitLocker without additional key and Require PIN at every startup options are not available unless you have a TPM.

6. Select the USB flash drive from step 2, and click on the Save button. (See screenshot below)

7. Select the Save the recovery key to a USB flash drive option. (See screenshot below)
NOTE: It is highly recommended that you do the other two options as well and save this key file somewhere safe. You will need the recovery key number to gain access to the encrypted Windows 7 or other operating system drive if you should lose or damage the USB flash drive with the startup key, or if BitLocker locks the drive.


A) Select the USB flash drive from step 2, and click on the Save button. (See screenshot below)

B) When finished, click on the Next button. (See screenshot below step 7)
8. Check the Run BitLocker system check box, then click on the Continue button. (See screenshot below)

9. Click on the Restart Now button. (See screenshot below)
WARNING: This will restart your computer immediately. Close and save anything that you are working on first.

10. When the computer restarts, BitLocker will start encrypting the Windows 7 drive. Click on the BitLocker icon in the taskbar notification area (far right) to see the encryption status. (See screenshot below)
NOTE: This may take a while to finish.

11. When BitLocker is finished, click on the Close button. (See screenshot below)

12. You will now have a Manage BitLocker option in the Control Panel and Computer for the encrypted drive. (See screenshots below)




13. If you click on Manage BitLocker, these will be the options that you will have below. (See screenshot below)

   Warning

It is highly recommended that you do one or both options below. You will need the recovery key number to gain access to the encrypted Windows 7 or other operating system drive if you should lose or damage the USB flash drive with the startup key, or if BitLocker locks the drive.

14. You're done. The Windows 7 or other operating system drive or partition is now encrypted with BitLocker Drive Encryption. You will now be required to plug in the USB flash drive that contains the startup key in order to unlock and startup Windows 7 or the other operating system.

OPTION TWO

Turn Off BitLocker to Decrypt Windows 7 Drive

NOTE: If you do not care about losing all data on the drive/partition, then formating or using the clean command will allso turn off BitLocker for the drive/partition.
1. Open the Control Panel (icons view), and click on the BitLocker Drive Encryption icon.

2. Click on Turn Off BitLocker for the Windows 7 or other operating system drive or partition letter that you want to turn off BitLocker with. (See screenshot below)

3. Click on the Decrypt Drive button. (See screenshot below)

4. BitLocker will now start decrypting the drive. Click on the BitLocker icon in the taskbar notification area (far right) to see the encryption status. (See screenshot below)
NOTE: This may take a while to finish.

5. When finished, click on the Close button. (See screenshot below)

6. The Control Panel and Computer will now have the Turn On BitLocker option again.




7. If you would like to restore the default Group Policy setting to have BitLocker use a TPM instead of a USB flash drive, then do METHOD ONE (step 5) or METHOD TWO (step 2) in the PREPARATION section at the top of the tutorial.

8. You're done. The Windows 7 drive or other operating system drive or partition is now decrypted.
That's it,
Shawn

Related Tutorials

---

• How to Turn Windows 7 BitLocker To Go On or Off for Removable Drives
• How to Change Windows 7 BitLocker Drive Encryption Method and Cipher Strength
• How to Suspend or Resume BitLocker Protection on Windows 7 Drive
• How to Turn Windows 7 BitLocker On or Off for Internal Data Hard Drives
• How to Create a Windows 7 BitLocker Drive Encryption Shortcut
• How to Lock an Unlocked BitLocker Drive
• How to Unlock a Windows 7 Computer Locked by BitLocker Drive Encryption
• How to Create a USB Startup Key to Lock or Unlock Windows
• How to Check BitLocker Status of Drive in Windows 7 and Windows 8

 

[ysbysb]

hi Shaan,
this is suresh. thanks for your solution, but actual problem is:

Situation:
1. my laptop is non TPM.
2. in this system Windows 7 ultimate is installed in C drive.
3. My D drive is encrypted with bitlocker without tpm (start->Controlpanel->Secturity options->Bitlock locker-> turnon Bitlocker.)
4. in my offlice flash drive restricted.
5. Bitlocker password is in my mind
6. bitlocker recover key is saved in txt file in my desktop or print.

Questions:

please give the solutions the below :

1. bitlocker enable without TPM ----- procedure step by step
2. in the bitlocker encryption process where the password stores in c'drive. (exact path)
3. the above bitlocker enabled system is in Active directory. any chance to save bitlocker recovery key directly in active directory.


4. Bit locker needs to store the password required for decrypting the data drive. Where does it store the password? If it stores in C drive, is it encrypted? If not, then it does not solve confidentiality or integrity that comes with any encryption system.
5. Where do you store the recovery password? Why do you need to store the recovery password when Microsoft stores it in our own recovery database?
6. Did you test doing this on machine connected to Microsoft domain? Microsoft uses a certificate which is passed on by AD for encrypting the hard drive. Doe that happen in the model you suggestsed.

please give the solution to the above.

 

[Brink]

Suresh,

Questions answered inline below:

1. bitlocker enable without TPM ----- procedure step by step

For your C: drive - see the tutorial on the first page of this thread.

For your D: drive - see http://www.sevenforums.com/tutorial...ption-internal-data-hard-drives-turn-off.html

2. in the bitlocker encryption process where the password stores in c'drive. (exact path)
4. Bit locker needs to store the password required for decrypting the data drive. Where does it store the password? If it stores in C drive, is it encrypted? If not, then it does not solve confidentiality or integrity that comes with any encryption system.
5. Where do you store the recovery password? Why do you need to store the recovery password when Microsoft stores it in our own recovery database?

This would be encrypted and unaccessible and unreadable.

3. the above bitlocker enabled system is in Active directory. any chance to save bitlocker recovery key directly in active directory.

Saving the Recovery Key on the drive that you have encrypted with BitLocker would defeat the purpose of it not being able to access the drive without it. Plus, you would need the Recovery Key saved to another location in case you needed it.

6. Did you test doing this on machine connected to Microsoft domain? Microsoft uses a certificate which is passed on by AD for encrypting the hard drive. Doe that happen in the model you suggestsed.

please give the solution to the above.

I have not tried this on a domain, and would not know how that would work.

 

[ysbysb]

thanks shaan.
thanks for your help

 

[ysbysb]

hi shaan,one more doubt,
in windows 7 in diskmangement my c drive is 40 gb and one more system drive is there. actually i know litte bit about that, briefly explain about that. and also in bit locker enabling process the password is stored in system c drive? or this 100mb miracle drive?

 

[Brink]

You're most welcome Suresh,

The password itself would be stored encrypted and unaccessible on the C: drive.

 

[khan]

This fabulous tutorial is commendable Brink. Thanks for the great work.

I have a question. I bought a laptop Acer Aspire 5738G with Windows 7 Home Premium x64 pre-installed on it. It had BitLocker too and the drive encrypted by BitLocker was other than C: Drive on which Windows was installed. Its size was around 2 GB.

It came already installed and I didn't know of it but liked it very much and stored files on it safely and used a password to open the encrypted drive. The password was set by me.

Now the problem is that I have formatted my C: Drive and installed Windows 7 Ultimate x64. BitLocker is there but is not turned on. I want to encrypt the same drive as was before but I can't find it anywhere. Do I have to create a new partition? MY NOTEBOOK IS NON-TPM.
Hope you get my question. Please help me out.
Regards

 

[Brink]

Hello Khan, and welcome to Seven Forums.

Could you post a screenshot of Disk Management (diskmgmt.msc) showing your complete drive layout? This will help determine if you will need to create a new partition or not to use BitLocker on.

 

[khan]

Hello Khan, and welcome to Seven Forums.

Could you post a screenshot of Disk Management (diskmgmt.msc) showing your complete drive layout? This will help determine if you will need to create a new partition or not to use BitLocker on.

Sir here it goes... But I want to have a small partition for encrypting important files and folders which was available before and not now. why can't I find it now??

 

[Brink]

Khan,

Is one of the drive letters listed in Disk Management the drive you wanted to encrypt with BitLocker? If so, and it does not show up in BitLocker (see link), then did you turn off BitLocker for that drive before you reinstalled Windows 7? If not, then you may need to format the partition before being able to use BitLocker on it again.

 

[khan]

Khan,

Is one of the drive letters listed in Disk Management the drive you wanted to encrypt with BitLocker? If so, and it does not show up in BitLocker (see link), then did you turn off BitLocker for that drive before you reinstalled Windows 7? If not, then you may need to format the partition before being able to use BitLocker on it again.

Sir,
The drive that was encrypted is not listed here. It was in addition to all these drives. Size was around 2 GB. I just moved my encrypted files to another drive before formatting DRIVE C. I didn't turn off or format the ENCRYPTED Drive, I did nothing to it. and now it's not there. Is it possible that the drive was a virtual attached drive or something like that ??

 

[Brink]

It must have been since it is not listed in Disk Management.

I suppose that you could either shrink the F: Drive to create a new parition to use, or attach and use another virtual drive.

 

[khan]

It must have been since it is not listed in Disk Management.

I suppose that you could either shrink the F: Drive to create a new parition to use, or attach and use another virtual drive.

Thank You so much Sir for your help. I needed a green light to create a new partition. Thank you once again.

After creating partition, I think it would be normal if I apply the your tutorial on the new partition??

 

[Brink]

You're welcome Khan.

Well, since it will be considered an internal drive instead of the Windows 7 C: drive, then you would want to use the tutorial below instead of the one on the first page.

http://www.sevenforums.com/tutorial...ption-internal-data-hard-drives-turn-off.html

 

[khan]

You're welcome Khan.

Well, since it will be considered an internal drive instead of the Windows 7 C: drive, then you would want to use the tutorial below instead of the one on the first page.

http://www.sevenforums.com/tutorial...ption-internal-data-hard-drives-turn-off.html

Once again Thanks a lot sir. You Rock. SevenForums rock.

+rep.

 

[Brink]

You're most welcome Khan.

 

[kmfraley]

On WES 7, turn on of off with no TPM

I have followed the instructions for turning on BitLocker with no TPM. It looks like the startup key is being written properly to my USB flash drive, but after restarting in order to run BitLoocker encyption, I'm getting this notice ... BitLocker could not be enabled. The BitLocker startup key or recovery password cannot be found on the USB device. Verify that you have the correct USB device, that the USB device is plugged into the computer on an active USB port, restart the computer, and then try again. If the problem persists, contact the computer manufacturer for BIOS upgrade instructions. C: was not encrypted. See attachment.

The USB flash drive is plugged in. It has what appears to be a startup key (.BEK file) in the root folder. It also has a text file in the root folder which contains the recovery key.

Any ideas?

 

[Brink]

Hello Kmfraley,

You might double check to see if you have your BIOS set to be able to read USB devices at boot.

Hope this helps,
Shawn

 

[dugthe1andonly]

enable a PIN with no TPM

I'm trying to enable a PIN on a Windows 7 Enterprise x32 machine with no TPM. I'm able to encrypt the OS drive with BitLocker using a startup key stored on an SD card, but I'm not having much luck enabling a PIN that the user must enter at every startup.

according to MS link here:
http://windows.microsoft.com/en-US/...BitLocker-Drive-Encryption-startup-key-or-PINIf your computer was not manufactured with TPM version 1.2 or higher, you can create a BitLocker startup key using a USB flash drive to store the encryption keys and decryption keys. [...]
In addition to the option of creating a startup key, you have the option of creating a startup personal identification number (PIN). You can create either the startup key or the startup PIN, but not both.

You can only create a startup key or PIN when you turn on BitLocker for the first time.

Is it possible to use a startup PIN and how is this accomplished?

Thanks for your insights!

 

[Brink]

Hello Dug, and welcome to Seven Forums.

Unfortunately the Use BitLocker without additional key and Require PIN at every startup options (step 5 in Option One) is not available unless you have a TPM.

 

[kmfraley]

Shawn,

Thank you for your reply and forgive my slow response (I got pulled in another direction). You are correct. As it turns out, the BIOS we're using on our hardware does not support the reading of USB drives during boot. So, we're looking for an alternative solution, even putting a TPM on board. Thanks for your help!

Kris