How To Prevent Data Theft With BitLocker

BitLocker is included with Windows 10 Enterprise or Professional editions, so the devices that on which you are enabling BitLocker need to be running one of those two versions.

Also, to deploy BitLocker drive encryption in the most secure way, your laptops need to be equipped with a Trusted Platform Module (TPM) chip. The TPM chip stores the encryption keys for the hard drive, and only releases them if it knows that the computer has not been tampered with. Most enterprise-grade computers from the last 5 years or so include a TPM chip, though sometimes they will need to be enabled in the BIOS or UEFI config.

Finally, if you would like to have BitLocker keys automatically backed up to Active Directory, you’ll need to enable this group policy setting:

Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Turn on BitLocker backup to Active Directory Domain Services

Also, consider the level of security that you would like BitLocker to provide. It can be configured to use various authentication methods which provide increasing levels of security:

• TPM Only: The TPM chip automatically unlocks the boot volume as long as no modifications to the boot environment have been detected.
• TPM + PIN: The user must enter a PIN in order to unlock the volume.
• TPM + Startup Key: The user must insert a USB flash drive that contains the startup key in order to boot the computer.

The TPM Only option will prevent a hard drive from being removed and read, but will not protect against an attack against the computer once it is booted. If you need higher levels of data protection, consider choosing one of the multifactor options.