Advanced BitLocker Guide - NHS / 2nd Line Support / Infrastructure
Prepared for Mohamed
Advanced Interview Notes, Labs and Real-World Scenarios
Chapter 1 - BitLocker Architecture
• Full Disk Encryption.
• TPM stores keys securely.
• Recovery Keys are associated with the Computer Object.
• Protects data at rest.
• Works with TPM, PIN, USB Startup Key or combinations.
Chapter 2 - TPM Deep Dive
What TPM does:
• Stores cryptographic keys.
• Validates boot process.
• Detects tampering.
Common interview question:
Why does BitLocker work better with TPM?
Answer: Because TPM securely stores encryption keys and validates system integrity before
unlocking the drive.
Chapter 3 - Secure Boot
Secure Boot prevents unauthorized bootloaders from loading.
If Secure Boot settings change, BitLocker may request a Recovery Key.
Chapter 4 - Active Directory Integration
Recovery Keys are backed up to Active Directory.
Keys are stored against the Computer Account.
ADUC -> Computer Object -> BitLocker Recovery Tab.
Important:
Search by Computer Name or Recovery Key ID, not by User Name.
Chapter 5 - Intune Management
Common settings:
• Enable BitLocker silently.
• Store Recovery Keys in Entra ID.
• Require TPM.
• Encrypt OS Drives.
• Encrypt Fixed Data Drives.
• Compliance Policies.
Chapter 6 - Group Policy Configuration
Common GPO:
Computer Configuration
-> Administrative Templates
-> Windows Components
-> BitLocker Drive Encryption
Typical settings:
• Store Recovery Information in AD
• Require TPM
• Allow PIN at startup
• Choose encryption algorithm
Chapter 7 - Commands
manage-bde -status
manage-bde -protectors -get C:
manage-bde -on C:
Get-BitLockerVolume
Enable-BitLocker
Chapter 8 - NHS Scenarios
Scenario 1:
Doctor cannot access laptop after BIOS update.
Action:
Verify identity -> Retrieve Recovery Key -> Unlock -> Investigate BIOS update.
Scenario 2:
Nurse reports repeated BitLocker prompts.
Action:
Check TPM health.
Check BIOS updates.
Review Event Logs.
Scenario 3:
Stolen laptop.
Answer:
Data remains protected because the drive is encrypted.
Chapter 9 - Full Lab Environment
LAB TOPOLOGY
Windows Server 2025
Domain: [Link]
Windows 11 Client
Joined to Domain
Tasks:
1. Verify TPM.
2. Enable BitLocker.
3. Backup Recovery Key.
4. Confirm key in AD.
5. Force Recovery Mode.
6. Recover using Recovery Key.
7. Document incident.
Chapter 10 - Interview Questions
1. What is BitLocker?
2. Why use TPM?
3. What causes Recovery Mode?
4. Where are Recovery Keys stored?
5. How do you retrieve a Recovery Key?
6. Difference between encryption and password protection?
7. Why is BitLocker important in hospitals?
8. How would you troubleshoot repeated Recovery prompts?
9. Can BitLocker be managed by Intune?
10. Can BitLocker be used on shared desktops?
Chapter 11 - Infrastructure Knowledge
BitLocker + TPM + Secure Boot work together.
Infrastructure Engineers should understand:
• Active Directory
• Group Policy
• Entra ID
• Intune
• Windows Security Baselines
• Device Compliance Policies
Final Revision Checklist
□ Explain BitLocker confidently.
□ Explain TPM.
□ Explain Secure Boot.
□ Retrieve Recovery Keys from AD.
□ Understand Recovery Key ID.
□ Configure BitLocker GPO.
□ Configure Intune Policies.
□ Perform recovery scenarios.
□ Answer NHS-focused questions.