Just remember that anyone else who gets the drive can make a copy too. The file is hidden, so you need to enable the viewing of hidden files to more easily make a copy. You can make a backup copy the '.bek' file in the root of the drive in case you lose it. This is assuming that 'c' is your system drive and 'e' is the letter assigned to your currently-inserted flash drive.įrom now on you'll be asked to insert the key when you start up the computer. Manage-bde -protectors -add c: -TPMAndStartupKey e: You have to launch it with administrator privileges. Now we are going to use the command prompt. Change this to 'Require Startup Key With TPM'.

There's a drop-down menu labeled 'Configure TPM Startup'. Only Pro and Enterprise users need to apply. Home versions of Windows don't have BitLocker unfortunately. The first step in this process is to enable BitLocker on your computer. Which means if your laptop falls into the wrong hands there's no way to unlock it without the key drive. Interestingly, you can actually use a USB drive set up with the cryptographic key to unlock that machine instead. It's a dedicated cryptoprocessor that decrypts the contents of your drive.

Just about every modern computer has something called a trusted protection module. Even better it turns out to be quite easy. Still, it's a worthy offering to the gods of data security. This is especially painful on a laptop that might not have that many to begin with. Of course, one downside of this is that you have to sacrifice a USB port permanently. If the key is not present you can't use the computer. There's plenty of software out there that will let you use a USB drive as a security key.

Usb lock key