#BitLocker auto-unlock (Windows) + password unlock (Linux Mint)

11 messages · Page 1 of 1 (latest)

distant glade
#

Hello people. I need help setting up BitLocker.

What I want:

  • Windows 11 should auto-unlock my BitLocker C: drive normally with TPM (no password on boot).
  • Linux Mint should be able to unlock the same BitLocker drive using a password.
  • I want to avoid using the recovery keys, as I might not always have my USB flash drive with me.

I am having problems setting a password when I try to enable BitLocker as it never asked me to set a password.

TLDR:
Windows = no password
Linux Mint = password
Recovery key = emergencies only

opaque turretBOT
#

Need Help Or Have a Problem, @distant glade?
You're probably looking for #tech-support or #1006577277313744996!

Once there, please be sure to provide plenty of details, follow the guidelines, ping the <@&787528858806124575> role, and be patient!

Look under the 🔧 Support category for the appropriate channel for your issue. See #server-information for more info.

brittle flax
#

I doubt linux supports bitlocker 🤔

#

But that's a question better asked in #linux-and-more

mild socket
# brittle flax I doubt linux supports bitlocker 🤔

Of course it does, but you need to provide it the key for decryption, ie the recovery key (or the normal key, but Windows hides that in the TPM). I’m not sure if there’s a config or app that you can use to make things easier, but storing the key as a read-protected file somewhere and mounting the encrypted drive with that should work. You of course don’t want the key to be readable on the disk, so you would need to protect the linux install with FDE like LUKS as well, though for lots of distros that’s a single checkbox

brittle flax
#

Looks like there is, but not my specialty

#

Called dislocker or smth

mild socket
distant glade
#

when I try to add a password with this command it errors:
manage-bde -protectors -add C: -password

ERROR: An error occurred (code 0x8031006a):
Group Policy settings do not permit the creation of a password.

then when I enable the group policy setting and refresh it and try again:

gpupdate /force
manage-bde -protectors -add C: -password

It says this:

ERROR: An error occurred (code 0x803100ab):
A password key protector cannot be added because a TPM protector exists on the drive.

Maybe it's not possible to have TMP + password?

thorny token
#

system volume cannot be protected with password, when TPM is the protector

distant glade
#

ok I will try encrypting the recovery key on mint and use that as a password then