Bitlocker can be configured on Cluster Shared Volumes (CSV) and Storage Area Network (SAN) drives as well.Bitlocker can be enabled for Hyper-V based virtual machines.Some device management systems used in a corporate environment will retrive the key so it is easier to keep track of for a large number of devices. The key can be managed through the Active Directory. Make sure you don’t backup the Bitlocker key to the same drive that is getting encrypted as it will be inaccessible when needed.Configure TPM policy through ‘Require additional authentication at startup’ group policy before deploying Bitlocker. Group policy available to deploy Bitlocker as well.If not TPM is available, can be configured to use a pin that can be manually entered when booting up. Really should use alongside a TPM chip.

Access to the chassis itself needs protecting as an onboard battery is used to save these configs.īitlocker is essential to prevent malicious actors who copy or steal a physical or virtual harddrive plugging it back in another environment and accessing files. Access to BIOS/UEFI needs to be protected with a password. Useful for preventing booting with different media to access the file system or removing the drive and booting somewhere else, etc.Used to protect the start up environment of a server by ensuring only trusted hardware and software runs when the computer boots.Host-based Intrusion Prevention System/Firewall in use.Only essential services and ports active.Use of encryption and NTFS on the file system.Keep it up to date with latest updates and patches.(Based partially on 70-744 study guide by Timothy Warner and web searches)īasic tips on security applicable to all Windows servers:

Bitlocker network unlock server 2016