Queries regarding Encryption

Hi James, 

First of all you do not need two partitions and you do not need have to configure from GPO. All you need to do keep enable the Bitlocker and push the policy from Enterprise Console. Let me know if this helps resolve your query.

Hello Haridoss

Thankyou for the reply, Bitlocker on our devices is currently set to 'off', i presume it needs to be turned on?

Does Sophos Encryption use a TPM Chip to?

Thanks

James

Hi James,

No, you don't have to turn on manually. And TPM is the majority of option for authentication. 

Hi James - SafeGuard will "manage" BitLocker for you. Once you've created the correct policies it'll enable BitLocker on the client and store the recovery key centrally.

You can (and should) use TPM as a protector, but since Windows 10 (compatible versions) it's possible to use BitLocker without needing a TPM chip. Rather than a PIN though this will be secured by a USB startup key/and/or a password.

You can use TPM with or without a PIN but a PIN (6 digits now) is recommended.  

Hello Michael

Thanks for the reply that's great to hear, Does Sophos initialize and Enable the TPM automatically also?

Thanks

James

Hi James - Assuming that the TPM is in a ready state already - yes. Make sure it's enabled AND active in BIOS (on some machines it can be in a hidden/non-active state despite being "on")

Best thing to check is that TPM.msc reports all is well with TPM already, so worth checking a sample machine first.

We actually issue a clear TPM command during our pre-install to make sure TPM is ready amd clear before we proceed.

Hello Michael

After checking within TPM Management it's starting the TPM is Ready to Prepare but has a know security problem, once we patch the TPM all should be good to go.

Thanks

James

Hi James. Sounds like you’re good to go.

What’s the known security problem?

Hello

Just states the TPM Firmware on the PC has a know security problem (HP Probook 450 3G - Windows 10 Pro). Probably just needs patching. I'm guessing it may need patching before the TPM and encryption will work?

Thanks

James

Sounds like it either needs a firmware update from HP or it can’t be addressed properly.

Have you applied this article yet?