administrator guide
(*) When Require startup authentication is enabled, the installation of TPM-only protection is not possible and therefore TPM+PIN is the first priority.
TPM-only
TPM+PIN
-
-
Passphrase
-
USB key
ok (1)
Win 7 no TPM ok (1*) ok (2)
ok (3)
Win 7 with TPM
-
ok (1) ok (2)
Win 8 no TPM ok (1*) ok (2) ok (3) ok (4)
Win 8 with TPM
-
ok (1) ok (2)
≥Win 8.1
no TPM
≥Win 8.1
with TPM ok (1*) ok (2) ok (3) ok (4)
Note: When Windows FIPS Mode is enabled, BitLocker encryption is only supported on systems with Windows 8.1 or higher. For detailed information on BitLocker in FIPS mode on Windows 7, see https://support.microsoft.com/en-us/kb/2990184 .
Note: You can use encrypted hard drives with Sophos Central Device Encryption. For more information, see https://docs.microsoft.com/en-us/windows/device-security/encrypted-hard-drive .
2.5 Device Encryption authentication modes
You can use the Require startup authentication switch in the Device Encryption settings to control whether users need to authenticate when they log on to their computers. The authentication mode installed on the computers depends on the system, the
BitLocker group policy settings
(page 9), and the configured Device Encryption policy. Depending on the Device Encryption system compatibility (page 6) , one of the following authentication modes will be installed on the
endpoints:
■
■
TPM+PIN
(page 8)
Passphrase (page 8)
■
■
TPM-only
(page 8)
USB key
(page 9)
On endpoints that are already encrypted with BitLocker, a message informs users about the required steps.
When you turn on Require startup authentication users are prompted to define a PIN / passphrase / USB key and click Apply. They will have to use this PIN / passphrase / USB key every time they start the computer after that. When you turn off Require startup authentication
TPM-only mode is applied automatically and no additional authentication is required. Users are informed that their computer will unlock the device automatically when it starts up.
Sophos Device Encryption can automatically configure the group policy object (GPO) so that all authentication modes are allowed, provided that the corresponding setting is set to not configured.
When you configure the setting manually, the software does not overwrite these definitions. For more information, see
BitLocker group policy settings
(page 9).
7
Sophos Central Device Encryption
Users can decide to postpone the installation of the authentication modes. In this case, no encryption takes place. Whenever a user logs back on to Windows or when you deploy a new encryption policy, the system prompts the user to restart the computer. After the restart, the authentication mode is installed and Device Encryption starts. Users will not be able to decrypt their devices after that.
2.5.1 TPM+PIN
The TPM+PIN mode uses the computer's TPM security hardware and a PIN as authentication.
Users have to enter this PIN in the Windows pre-boot environment every time the computer starts.
TPM+PIN requires a prepared TPM and the GPO settings of the system must allow the TPM+PIN mode.
If all conditions are met, the TPM+PIN setting dialog will be displayed and the user is prompted to define a PIN. The user can click Restart and Encrypt to immediately reboot the computer and start encryption.
If the GPO setting Allow enhanced PINs for startup is enabled, the PIN may include numbers, letters, and special characters. Otherwise, only numbers are allowed.
PINs for BitLocker are between 4 and 20 characters in length. You can define a higher minimum length through a group policy. The Sophos Central agent software sets the group policy to allow enhanced PINs. The dialog tells the user which characters may be entered and what minimum/maximum lengths are allowed.
Note: All users of a specific Windows computer need to use the same PIN to unlock the system disk. After that, they log on to the operating system with their individual credentials. Single sign-on is not supported for Windows computers.
2.5.2 Passphrase
For authentication at endpoints without TPM security hardware, a passphrase can be used. Users have to enter this passphrase in the Windows pre-boot environment every time the computer starts.
Passphrase protection requires Windows 8.0 or higher and the GPO settings of the system must allow the passphrase mode.
If all conditions are met, the passphrase setting dialog will be displayed and the user is prompted to define a passphrase of 8-100 characters in length. The user can click Restart and Encrypt to immediately reboot the computer and start encryption.
2.5.3 TPM-only
The TPM-only mode uses the computer's TPM security hardware without any PIN authentication.
This means that the user can start the computer without being prompted for a PIN in the Windows pre-boot environment.
TPM-only requires a prepared TPM and the Device Encryption policy setting Require startup
authentication must be disabled. Furthermore, the GPO settings of the system must allow
TPM-only protection.
8
