Either way, an out-of-band remote access card like the Dell DRAC solves the problem of not being physically present when booting the machine. Even if you have a TPM, you may want to configure Bitlocker to additionally require a PIN (two-factor authentication). Some consider Bitlocker without a TPM to be more secure because it requires an external USB flash drive to boot. Once I typed in the 48-digit recovery key (not much harder than typing in a product key), Windows started: When I pressed Enter, this screen appeared: However I was able to access the console. But for some reason the machine didn’t see the flash drive: So how do we use the DRAC to get into the system? My first attempt was to use the DRAC media redirection to plug the USB flash drive into my local machine.

But what if you don’t do that? What happens if you boot with Bitlocker enabled but without the USB flash drive containing the startup key? You’ll see a screen like this: If you know you are going to need to reboot a remote server for system maintenance, you can temporarily disable Bitlocker as described near the bottom of this article. Be sure to save and print out the recovery key as well. You’ll need to save the startup key to a USB flash drive. Once that Group Policy setting is made, you can go to Control Panel to turn on Bitlocker on the system drive. (Note: for Server 2008 R2, set the policy for the “Windows 7 family”, not the one for “Windows Server 2008 and Windows Vista”.) Enable this policy, and you will be able to check the box Allow BitLocker without a compatible TPM. In Windows Server 2008 R2, you will find the setting in Local Group Policy under Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drive > Require additional authentication at startup. In this tutorial, we will show you how to allow the Operating System encryption using Bitlocker on a computer without the TPM chip using a GPO. Scenario 5 of this Technet article has instructions for enabling Bitlocker without a TPM, but they are incorrect at a crucial point. But what if your machine does not have a TPM? How do you configure Bitlocker, and how do you boot the machine if you are not at the server location? I found that a Dell Remote Access Controller (DRAC) is all that is needed. Microsoft’s Bitlocker can use a Trusted Platform Module (TPM) on the motherboard to provide a unified start-up experience, even unlocking system drives before a user logs on.

This is especially important with servers, which may be at a remote location. One of the challenges of implementing full-disk encryption is how to provide the key to unlock the drive when the system boots.

Bitlocker without tpm windows 10