Bitlocker Kurtarma

[Olivie Inoue]

Aspart of the BitLocker recovery process, it's recommended to determine what caused a device to enter in recovery mode. Root cause analysis might help to prevent the problem from occurring again in the future. For instance, if you determine that an attacker modified a device by obtaining physical access, you can implement new security policies for tracking who has physical presence.

For planned scenarios, such as a known hardware or firmware upgrades, initiating recovery can be avoided by temporarily suspending BitLocker protection. Suspending BitLocker leaves the drive fully encrypted, and the administrator can quickly resume BitLocker protection after the planned task is completed. Using suspend and resume also reseals the encryption key without requiring the entry of the recovery key.

If suspended, BitLocker automatically resumes protection when the device is rebooted, unless a reboot count is specified using PowerShell or the manage-bde.exe command line tool. For more information about suspending BitLocker, review the BitLocker operations guide.

Recovery is described within the context of unplanned or undesired behavior. However, recovery can also be caused as an intended production scenario, for example in order to manage access control. When devices are redeployed to other departments or employees in the organization, BitLocker can be forced into recovery before the device is delivered to a new user.

When Startup Repair is launched automatically due to boot failures, it only executes operating system and driver file repairs, provided that the boot logs or any available crash dump point to a specific corrupted file. On devices that support specific TPM measurements for PCR[7], the TPM validates that Windows RE is a trusted operating environment and unlocks any BitLocker-protected drives if Windows RE has not been modified. If the Windows RE environment has been modified, for example the TPM is disabled, the drives stay locked until the BitLocker recovery key is provided. If Startup Repair can't run automatically, and instead Windows RE is manually started from a repair disk, then the BitLocker recovery key must be provided to unlock the BitLocker-protected drives.

Windows RE will also ask for your BitLocker recovery key when you start a Remove everything reset from Windows RE on a device that uses the TPM + PIN or Password for OS drive protector. If you start BitLocker recovery on a keyboardless device with TPM-only protection, Windows RE, not the boot manager, will ask for the BitLocker recovery key. After you enter the key, you can access Windows RE troubleshooting tools or start Windows normally.

Both the Recovery password and Recovery key can be supplied by users in the Control Panel applet (for data and removable drives), or in the preboot recovery screen. It's recommended to configure policy settings to customize the preboot recovery screen, for example by adding a custom message, URL, and help desk contact information. For more information, review the article BitLocker preboot recovery screen.

Answering the questions helps to determine the best BitLocker recovery process for the organization, and to configure BitLocker policy settings accordingly. For example, if the organization has a process for resetting passwords, a similar process can be used for BitLocker recovery. If users aren't allowed to save or retrieve recovery information, the organization can use a data recovery agents (DRAs), or automatically back up recovery information.

In each of these policies, select Save BitLocker recovery information to Active Directory Domain Services and then choose which BitLocker recovery information to store in AD DS. Use the option Do not enable BitLocker until recovery information is stored in AD DS to prevent users from enabling BitLocker unless the backup of BitLocker recovery information for the drive to Microsoft Entra ID or AD DS succeeds.

To recover BitLocker, a user can use a recovery password, if available. The BitLocker recovery password is unique to the device it was created on, and can be saved in different ways. Depending on the configured policy settings, the recovery password can be:

Having access to the recovery password allows the holder to unlock a BitLocker-protected volume and access all of its data. Therefore, it's important for your organization to establish procedures to control access to recovery passwords and ensure that they're stored securely, separate from the devices they protect.

There's an option for storing the BitLocker recovery key in a user's Microsoft account. The option is available for devices that aren't members of a domain and that the user is using a Microsoft account. Storing the recovery password in a Microsoft account is the default recommended recovery key storage method for devices that aren't Microsoft Entra joined or Active Directory joined.

Backup of the recovery password should be configured before BitLocker is enabled, but can also be done after encryption, as described in the BitLocker operations guide.

The preferred backup methodology in an organization is to automatically store BitLocker recovery information in a central location. Depending on the organization's requirements, the recovery information can be stored in Microsoft Entra ID, AD DS, or file shares.

There's no automatic way to store the recovery key for removable storage devices in Microsoft Entra ID or AD DS. However, you can use PowerShell or the manage.bde.exe command to do so. For more information and examples, review the BitLocker operations guide.

DRAs can be used to recover OS drives, fixed data drives, and removable data drives. However, when used to recover OS drives, the operating system drive must be mounted on another device as a data drive for the DRA to be able to unlock the drive. Data recovery agents are added to the drive when it's encrypted, and can be updated after encryption occurs.

The benefit of using a DRA over password or key recovery is that the DRA acts as a master key for BitLocker. With a DRA you can recover any volume protected by the policy, without having to find a specific password or key for each individual volume.

The BitLocker recovery information for Microsoft Entra joined devices can be stored in Microsoft Entra ID. The advantage of storing the BitLocker recovery passwords in Microsoft Entra ID, is that users can easily retrieve the passwords for the devices assigned to them from the web, without involving the help desk.

The BitLocker recovery password information stored in Microsoft Entra ID is a bitlockerRecoveryKey resource type. The resource can be retrieved from the Microsoft Entra admin center, the Microsoft Intune admin center (for devices enrolled in Microsoft Intune), using PowerShell, or using Microsoft Graph. For more information, see bitlockerRecoveryKey resource type.

The BitLocker recovery information for a device joined to an Active Directory domain can be stored in AD DS. The information is stored in a child object of the computer object itself. Each BitLocker recovery object includes the recovery password and other recovery information. More than one BitLocker recovery object can exist under each computer object, because there can be more than one recovery password associated with a BitLocker-enabled volume.

The BitLocker key package isn't saved by default. To save the package along with the recovery password in AD DS, the Backup recovery password and key package policy setting must be selected in the policy that controls the recovery method. The key package can also be exported from a working volume.

BitLocker, bilgisayar zerindeki kullanıcı verilerini korumak amacıyla tasarlanan bir Microsoft şifreleme rndr. BitLocker ile ilgili bir sorun olması durumunda BitLocker kurtarma anahtarına ynelik bir istem ile karşılaşırsınız. BitLocker istemi iin alışır durumda bir kurtarma anahtarınız yoksa bilgisayara erişemezsiniz.

Windows 8.1'den itibaren Windows, Modern Beklemeyi destekleyen aygıtlarda BitLocker Aygıt Şifrelemesi'ni otomatik olarak etkinleştirir. Windows 10 ve 11 ile Microsoft, daha geniş bir aygıt aralığında BitLocker Aygıt Şifreleme desteği sunar. Bunlara Modern Beklemeyi destekleyen ve Windows 10 Home Edition veya Windows 11 alıştıran aygıtlar da dahildir. Dell'in şu anda gnderdiği tm bilgisayarlar Modern Bekleme uyumludur ve yukarıda belirtilenler geerlidir. Şifrelemeyi yasaklamadan veya zorlamadan bu davranışı kontrol eden, Dell'in ntr durumda bıraktığı bir kayıt defteri anahtarıdır. Windows bunu, şifreleme onayı olarak yorumlar.

BitLocker şifrelemesi genellikle, aygıtınıza tam ynetici erişimi olan bir kullanıcı tarafından veya bu kullanıcı adına zellikle etkinleştirilir. Bu kullanıcı siz, başka bir kullanıcı veya aygıtınızı yneten bir kuruluş olabilir. Dell, herhangi bir aygıtta BitLocker'ı etkinleştirmez. BitLocker, bir ynetici tarafından gerekleştirilen kurulum veya etki alanı yapılandırması sırasında kullanıcı tarafından etkinleştirilir.

Windows'un alışma zamanı ve BIOS'un ykseltildiği zaman arasındaki PCR bankaları değiştiğinden BIOS Gncelleştirmesi bir BitLocker Kurtarma olayını tetikler. Ancak tm Dell BIOS gncelleştirmeleri, bellenimi gncelleştirmenin bir sonucu olarak BitLocker Kurtarma olayının meydana gelmemesi iin ykseltmeden nce BitLocker'ı askıya alır. Bilgisayar kurtarma moduna girerse bunun nedeni muhtemelen nykleme srcs numaralandırmasını değiştirirken harici bir srcnn bağlı olmasıdır. Kullanıcılar bunu BIOS'ta yapılandırabilir. Bu zel senaryonun dışında, BitLocker şifrelemeyi beklenmedik şekilde tetikleyen bir olay bulunmaz. BitLocker şifreleme işlemi arka planda gerekleşir ve genellikle bir Kurtarma olayı meydana gelene kadar kullanıcılar tarafından fark edilmez.

BitLocker kurulum işlemi, etkinleştirme sırasında kurtarma anahtarının oluşturulmasını zorlar. Gerekli BitLocker kurtarma anahtarını bulamamanız ve kurtarma anahtarı gerektirebilecek bir yapılandırma değişikliğini geri alamamanız durumunda, Windows 10 kurtarma seeneklerinden birini kullanarak aygıtınızı sıfırlamanız gerekir. Aygıtınızın sıfırlanması tm dosyalarınızı kaldırır.

3a8082e126