How do I set up Windows BitLocker to re-enter the password to unlock the BitLocker protected drive every time I perform a user login operation on a computer shared by multiple people?

Question

Project background note:

1. Multiple people share a computer;
2. BitLocker has been used to set the encryption of non-system drive D in the system;
3. The system environment is Windows 10 Professional or Windows 11 Professional;
4. You have joined the organization network of the domain.

What problem is the project to solve:

At present, as long as the user performs the user login operation once and enters the correct password to unlock the D drive, any other user can bypass the BitLocker re-password authentication requirements as long as the user logs in to the computer without restarting the computer;

Suppose that user A's encrypted drive D stores private information and does not want unauthorized access by user B, who shares the computer with him;

Expected solutions:

1.Windows system group policy

2.Windows Powershell script

Hope to get your technical guidance;

A screenshot of the Settings would have been helpful;

Thank you very much;

Answer 1

Here you go:

Answer 2

Not totally sure, but I would look first into auto-unlock feature, you should disable it:

https://www.elevenforum.com/t/turn-on-or-off-auto-unlock-for-bitlocker-drive-in-windows-11.2804/

Answer 3

Hi @tj_zero •

you can the following powershell command to lock drive:

Lock-BitLocker -MountPoint "E:" -ForceDismount -confirm

for more details about the powershell command please read the following article:

https://learn.microsoft.com/en-us/powershell/module/bitlocker/lock-bitlocker?view=windowsserver2022-ps

Please don’t forget to accept helpful answer and close this thread

Answer 4

Hello，

Firstly, I'm afraid that it is a normal phenomenon.

If a user has successfully logged in to the computer and unlocked the BitLocker-protected drive once, the subsequent users can indeed bypass the BitLocker re-password authentication requirement if the computer is not restarted. This is because BitLocker remembers the unlocked state of the drive until the computer is restarted.

Meanwhile, I also test the command to disable auto unlock drive, it's the same result.

To ensure that each user is required to enter the BitLocker password on every login, you would need to restart the computer after each user session or implement additional security measures.

As far as I can think, you can consider the following:

Use hibernation instead of sleep or lock: Instead of putting the computer to sleep or locking the screen, users can hibernate the system. Hibernation saves the system state to the hard disk and requires the BitLocker password to resume, thus enforcing re-authentication for each user.

Best Regards，

Hania Lian

Answer 5

When the computer is shared, NTFS permissions won't allow that user A opens files of user B (with permissions set accordingly) unless user A is an admin. So without A being admin, no need for bitlocker unless you would like to protect against offline access. In that case, you could use EFS, which would not unlock a whole partition, but just single files. High comfort as well and files of user A are secured against access by user B - online and offline! If you insist on using bitlocker, you may use a scheduled task that uses the batch command manage-bde -lock d: Set it to be triggered at user logoff and at session lock. Executor: system account ("system")