a few bitlocker real world questions

Question

I am new to Bitlocker - I just built a new PC - it has a newer ASUS mb and a extra hardware TPM chip purchased separately. I have three internal drives in the machine. I am curious about a few things.

(I will of course have recovery keys saved and available for below situations - so you can assume they are always available for below questions)

1) if I encrypt all drives, what happens if Windows SOFTWARE fails and I need to reinstall windows? Can I just re-add these encrypted drives to the new Bitlocker enabled Windows install since I have the keys?

2) What happens if the HARDWARE fails (motherboard, drive, TPM chip)?

3) Do I need to encrypt all drives or can I encrypt one or two?

4) What is the functional difference between a system with the hardware TPM chip vs just the software based Bitlocker?

thank you everyone!

Answer 1

Obviously, have TPM is better than don’t have, all aspects are advantages.
The TPM and system firmware collaborate to record measurements of how the system started, including loaded software and configuration details such as whether boot occurred from the hard drive or a USB device. BitLocker relies on the TPM to allow the use of a key only when startup occurs in an expected way. The system firmware and TPM are carefully designed to work together to provide the following capabilities:
• Hardware root of trust for measurement.
• Key used only when boot measurements are accurate.

More information here:
How Windows uses the TPM - Microsoft 365 Security | Microsoft Learn
https://learn.microsoft.com/en-us/windows/security/information-protection/tpm/how-windows-uses-the-tpm

-------------------------------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

1. You don't need to re-encrypt other drives, but make first sure you have all recovery keys saved. If you use MS live account with Windows 10, recovery keys should be escrowed there.
2. You will need to provide recovery key or delete partitions during new Windows setup.
3. You can select (I assume you are a home user)
4. TPM is not absolutelly required, you can use Password for Bitlocker if you don't have TPM hardware. This feature was introduced in Windows 8.

Answer 3

Thanks for the reply!

im set with answer 1-3, they helped!!

Number 4 however I still have the initial question...i know the TPM chip isn't necessary, but i have one installed; what im asking is - what is the actual functional differences between having the physical TPM chip vs only having the software based Bitlocker. (pros/cons)

Thanks!

Answer 4

awesome link and info, Thank you!

Do the keys stop working if the TPM hardware (chip) fails? What happens in that case?

Answer 5

No, your BitLocker recovery key and password don’t depend on TPM. When TPM broken, you even could insert your hard drives into another computer and use recovery key for decrypt or unlock.