Windows Advisor: Understanding and Configuring BitLocker with TPM Vista SP1 has a greatly improved BitLocker. Still, use BitLocker with a Trusted Platform Module for best results. By Zubair Alexander I wrote about the BitLocker feature in Microsoft Windows Vista almost two years ago, when Vista had just been released. With Vista Service Pack 1 (SP1), Microsoft implemented a few enhancements to the BitLocker feature and also made available three new tools for its management and repair. Though BitLocker can be used with or without a Trusted Platform Module (TPM) chip, TPM offers an additional level of security and is the preferred way to use BitLocker in Vista or Windows Server 2008. In this article, I'll discuss a few important concepts that will help you understand how TPM and BitLocker work together on a Vista computer that has a TPM chip installed. I'll also show you how to configure the Basic Input Output System (BIOS) and the operating system properly to get BitLocker working. In our scenario, we'll assume that you have a Vista laptop with a TPM chip installed on the motherboard. In order to get BitLocker working, you'll first need to configure the TPM settings in the laptop's BIOS, and then configure BitLocker in the OS. But before we get started, let's get go over certain important concepts. Trusted Module Platform
The TPM is a microchip that supports several advanced security features, such as storing encryption keys, digital certificates and passwords. The BitLocker feature in Vista works with the TPM chip. Depending on your BIOS and manufacturer, TPM Security may be set to OFF in the BIOS by default, meaning TPM can't be used. For example, my test computer was a Dell Latitude D630 and had the TPM functionality turned off. More specifically, there were two settings for TPM in the BIOS on my computer -- TPM Security and TPM Activation -- and they were both turned off by default. Enabling TPM Security is very simple: Go into BIOS and set it to ON. To turn on TPM Activation, you first need to set TPM Security to ON, save the changes in the BIOS setup, reboot the computer, and then reenter BIOS setup to activate TPM. Once this is done, you're ready to configure BitLocker in the OS. BitLocker System Requirements
Before you get started, make sure that your computer meets the minimum system requirements. Here are the system requirements for BitLocker: - Two partitions -- one for the system volume (e.g., Drive D) and one for the OS volume (e.g., Drive C).
- The system partition (Drive D) is unencrypted and the OS volume (Drive C) is encrypted.
- The system partition (Drive D) is at least 1.5GB and is set as the active partition.
Keep in mind that these are the minimum system requirements; you can encrypt more than one volume in Vista (for example, both Drive C and Drive D can be protected with BitLocker). Also, note that the BIOS setting should be configured to start up with the hard drive, not with the CD or USB drive. To install Vista, you may need to configure the system to boot from the CD/DVD drive first, but after the installation Microsoft recommends that you configure the BIOS to boot from the hard drive to use BitLocker. If you're working on a computer that already has Vista installed, you don't need to reinstall the operating system. You can simply use the new BitLocker Drive Preparation Tool (which I'll discuss later in this article) to configure your drives to work properly with BitLocker.... Read rest here. Zubair Alexander, MCSE, MCT, MCSA, and Microsoft MVP is the owner of SeattlePro Enterprises, an IT training and consulting business. His experience covers a wide range of spectrum: trainer, consultant, systems administrator, security architect, network engineer, author, technical editor, college instructor and public speaker. Zubair holds more than 18 technical certifications and Bachelor of Science degrees in Aeronautics & Astronautics Engineering Mathematics and Computer Information Systems. His Web site, www.techgalaxy.net, is dedicated to technical resources for IT professionals.
Check out MCPmag.com's column archive for more savvy tips and tricks from Zubair, Jeffery Hicks, Chris Wolf and other frequent contributors. | 
