BitLocker encryption management on Windows Server operating systems

Question

I would like to manage the BitLocker ( not Safeguard ) encryption on my various Windows servers. I am currently doing this successfully with the Windows 10 computers. In Sophos Central\My Products\Encryption I do not see any of the server objects listed so I cannot add them to the encryption policy that I have added the workstations to. I do not see encryption listed as a policy type that I can create under My Products\Server Protection. If I go to the Summary under the server objects I do not see " Device Encryption" listed as an installed component on the servers either even though it was included in the Endpoint Protection package that I deployed to all servers and workstations. 
 
 Thanks,

FormerMember · Accepted Answer

Device Encryption is not supported on servers. 
 There are various reasons, but one of the more applicable is that device encryption only protects the data when the machine is off (data at rest) and servers are rarely off and are also harder to steal the physical drives. Combined with the need for high performance, it makes encrypting the data on the drives a poor solution for server protection. 
 Now, encrypting the data when it is backed up is an excellent policy but Sophos Device Encryption does not service that use case.

FormerMember · Answer

I understand your point of view, but the SGN product was not built to that use case. It was designed for a large scale managed encryption solution that developed out of the LanCrypt product we used to sell. 
 Originally we provided our own encryption algo and a bootloader that moved the OS into an encrypted sub-set of the target drive. It provided true opaque protection of the drive. It came with a cost, however, and the performance hit combined with the points I outlined above led to there never being a server-target SGN solution. 
 For smaller use cases - we have Central Device Encryption which is still focused on an endpoint not a server - you will notice we have no policy option for encryption in Central. 
 However, if there is sufficient market appetite for a server based encryption solution it can be looked at. I suggest you put it in as a feature request.

MichaelMcLannahan · Answer

Sadly I don't believe Encryption is supported in this way for Servers - This document (and XLS spreadsheet) give a nice breakdown of supported features and O/S 
 
 https://support.sophos.com/support/s/article/KB-000034074?language=en_US 
 
 https://sophos.my.salesforce.com/sfc/p/30000001GN6a/a/3Z0000002ch9/ZHtSHhJGNd6IT7nCz.FKe.P1Z_nv.2xC12tTcK0YW44

BitLocker encryption management on Windows Server operating systems

Top Replies