Bitlocker for data partition with TMP Chip but no OS encryption

Question

Hi,
I need clarifications on BitLocker.

I checnked on the Internet but I still can not understand well some key aspects of BitLocker.

1. Having the TPM chip 2.0, is it possible to save the encryption key inside this TPM chip and then have the OS read from it directly by BitLocker?

If the answer is "No" then what is this chip used for?

2. I have three partitions:
   • disk C (operating system)
   • disk D and E (data disk)

I do not wish to encrypt disk C but wish to encrypt only data disks: the other two disks.

In the past, on a PC, I encrypted all three partitions, starting with drive C.
On reboot I was never asked for any unlock password for D and E

Now on a new PC not having encrypted disk C but having started directly from disk D every time I restart the operating system I am prompted to enter the unlock password for disk D. This is definetly what I do not want to have. I can't find a way to remove this limitation.

When I start encrypting a disk that is not OS I get only two options:

• Use a password
• Use a smart card

Nothing else. This is either what I do not whant.

Anyone can please help me understand a bit better?

Thank you

Answer 1

Hello there,

Yes, it is possible to save the BitLocker encryption key in the TPM chip, as long as the TPM chip meets the requirements for BitLocker. To use the TPM chip with BitLocker, you need to have a TPM chip version 1.2 or higher, and the chip must be enabled and activated in the system BIOS.

Once the TPM chip is set up and enabled, you can configure BitLocker to use the TPM chip to store the encryption key. This means that the encryption key will be stored in the TPM chip and the operating system will be able to retrieve it directly from the chip when needed.

As for your other questions, it sounds like you want to encrypt disks D and E, but not disk C. To do this, you can simply enable BitLocker on disks D and E, but not on disk C. This will encrypt the data on disks D and E, but not on disk C.

As for the password prompt, it is possible that you have configured BitLocker to require a password or a smart card every time the system starts. If you want to change this behavior, you can go into the BitLocker settings and change the "Startup options" to either "Do not require a startup key at startup" or "Allow startup with a startup key only."

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 2

Hi,

many thanks for your reply. I have few additional question.

> you can configure BitLocker to use the TPM chip to store the encryption key.

Can you please refer me to some documents on how to do so or can you please teach me how to do so?
I have TMP IFX vendor ver. 5.63.3353.0 ver. 2.0 and my mobo is an Asus X99-A II

> As for the password prompt ... you can go into the BitLocker settings and change the "Startup options" to either "Do not require a startup key at startup" or "Allow startup with a startup key only."

Can you please tell me how to do so? I fail to find where to set this in Windows 11