I have a Windows 10 laptop with two drives: an HDD that I use to store my data, and an SSD where the OS is stored allong with programs I use more frequently/require more performance.
I use Bitlocker to secure my data, and have both drives encrypted. My laptop has a TPM chip. What happens is that one of the drives (data drive) is automatically unlocked when I sign in, but the system asks me for a password on bootup to unlock the OS drive.
Is there any way to have both drives unlock automatically on sign in with the keys stored in the TPM chip? No options for auto-unlock appear under the OS drive in windows.
Thanks
Best Answer
Yes, you can have your OS drive automatically boot from a bitlocker'd drive without prompting for a passowrd. Mine works that way. But it requires either an activated TPM, or a bitlocker password on a USB key, or both.
Use of just the TPM means that if someone steals your drive, they can't read it - but if they steal your computer, and manage to log in, they can.
Use of just the USB key means you'll have to have the USB key plugged in when you boot.
Optinally you can use TPM + PIN, or TPM + USB. Like "just TPM" both of these lock the drive to the computer, and protect the boot environment from changes, via the TPM. They add either "something you know" (PIN) or "something you have" (USB key) to the need for the TPM.
The recovery key, in case you were wondering, bypasses the need to match the TPM... useful if you change the boot environment (while leaving BL enabled) or need to access the drive from another machine.
See "What is a BitLocker Drive Encryption startup key or PIN?" at microsoft.com , and "How to configure BitLocker with TPM, PIN, and USB StartupKey" at mrhorn.com for the detailed procedures.