administrator guide
2.8 About decryption
You don't usually need to decrypt. If you need to exclude an encrypted endpoint from encryption you can do this by removing all of its users from the policy and then turning encryption off. In
Windows Explorer (on the endpoint), right-click on the system disk and select Manage BitLocker.
In the BitLocker Drive Encryption dialog, click Turn off BitLocker. Only a Windows Administrator can perform this operation.
If an encryption policy is applied and a user, with administrative privileges, attempts to manually decrypt their hard disk Sophos Central overrides the user's command and the disk will remain encrypted.
2.9 Recover Windows endpoints
If users forget their BitLocker PIN or password, they can regain access to their computer in two ways.
■
If the user was the last person to be logged into the computer, they can use the Sophos Self
Service Portal, see Retrieve recovery key via Self Service Portal
(page 18).
■
You can help them access their computer. These instructions tell you what the users will see and what they need to do. They must:
1. Restart the computer and press the Esc key in the BitLocker logon screen.
2. In the BitLocker recovery screen, find the Recovery Key ID.
3. Call the administrator and tell them the recovery key ID.
You can give them the recovery key. For help on retrieving a key for one of your users, see the Sophos Central Admin Help .
4. The user must enter the recovery key, then follow the on-screen instructions to create a new
PIN or password.
The instructions for creating a new PIN or password are displayed automatically and tell users what they need to do.
Note: This feature may not be available for all customers yet.
Users can access their computer again.
11
