Kaspersky Endpoint Security for Windows 11.1.1

Full disk encryption using BitLocker Drive Encryption technology

Prior to starting full disk encryption on a computer, you are advised to make sure that the computer is not infected. To do so, start the Full Scan or Critical Areas Scan task. Performing full disk encryption on a computer that is infected by a rootkit may cause the computer to become inoperable.

The use of BitLocker Drive Encryption technology on computers with a server operating system may require installation of the BitLocker Drive Encryption component using the Add roles and components wizard.

To apply full disk encryption using BitLocker Drive Encryption technology:

1. Open the Kaspersky Security Center Administration Console.
2. In the Managed devices folder in the Administration Console tree, open the folder with the name of the administration group to which the relevant client computers belong.
3. In the workspace, select the Policies tab.
4. Select the necessary policy.
5. Double-click it to open the policy properties window.
6. In the Data encryption section, select Full Disk Encryption.
7. In the Encryption technology drop-down list, select BitLocker Drive Encryption.
8. In the Encryption mode drop-down list, select Encrypt all hard drives.

   If the computer has several operating systems installed, after encryption you will be able to load only the operating system in which the encryption was performed.

9. If you want to enable BitLocker authentication in the preboot environment on tablet computers, select the Allow use of authentication requiring preboot keyboard input on tablets check box.

   The touchscreen of tablet computers is not available in the preboot environment. To complete BitLocker authentication on tablet computers, the user must connect a USB keyboard, for example.

10. Select one of the following types of encryption:
    • If you want to use hardware encryption, select the Use hardware encryption check box.
    • If you want to use software encryption, clear the Use hardware encryption check box.
11. Select one of the following encryption methods:
    • If you want to apply encryption only to those hard drive sectors that are occupied by files, select the Encrypt used disk space only check box.
    • If you want to apply encryption to the entire hard drive, clear the Encrypt used disk space only check box.

      This function is applicable only to unencrypted hard drives. If a hard drive was previously encrypted using the Encrypt used disk space only function, after applying a policy in Encrypt all hard drives mode, sectors that are not occupied by files will still not be encrypted.

12. Select a method for accessing hard drives that were encrypted with BitLocker.
    • If you want to use a
      Trusted Platform Module

      A microchip developed to provide basic functions related to security (for example, for storing encryption keys). A Trusted Platform Module is usually installed on the computer motherboard and interacts with all other system components via the hardware bus.

      (TPM) to store encryption keys, select the Use Trusted Platform Module (TPM) option.
    • If you are not using a TPM for full disk encryption, select the Use password option and specify the minimum number of characters that a password must contain in the Minimum password length field.

    The availability of a TPM is mandatory for the Windows 7 and Windows 2008 R2 operating systems, as well as for earlier versions.

13. If you selected the Use Trusted Platform Module (TPM) option during the previous step:
    • If you want to set a PIN code that will be requested when the user attempts to access an encryption key, select the Use PIN check box and in the Minimum PIN length field, specify the minimum number of digits that a PIN code must contain.
    • If you would like access to encrypted hard drives without a trusted platform module on the computer using a password, select the Use password if Trusted Platform Module (TPM) is unavailable check box, and in the Minimum password length field indicate the minimum number of characters the password should contain.

      In this event, access to encryption keys will occur using the given password just like if the Use password check box is selected.

      If the Use password if Trusted Platform Module (TPM) is unavailable check box is cleared and the trusted platform module is not available, full disk encryption will not start.

14. Click OK to save changes.
15. Apply the policy.

    For details on applying a Kaspersky Security Center policy, refer to Kaspersky Security Center Help.

After applying the policy on the client computer with Kaspersky Endpoint Security installed, the following queries will be made:

• If encryption of the system hard drive is configured in the Kaspersky Security Center policy:
  • If a TPM module is available, a PIN code prompt window appears.
  • If a TPM module is not available, you will see a password prompt window for preboot authentication.
• If the Federal Information Processing standard compatibility mode is enabled for computer operating system, then in Windows 8 and earlier versions of operating system, a request for connecting a storage device is displayed to save the recovery key file.

If there is no access to encryption keys, the user may request the local network administrator to provide a recovery key (if the recovery key was not saved earlier on the storage device or was lost).