How to Encrypt VMware VM running Windows 2008 R2 with Microsoft Bitlocker

A piece of software at work has a HIPAA requirement that the drive is to be encrypted. No problem right, we use Microsoft BitLocker on our windows severs and PC’s. So in keeping with that I worked out a way to do so with our VMware Virtual Machines but it should work with any type of Virtual Machines as well.

The Goal: To encrypt windows 2008 using the built in Microsoft BitLocker.

The Problem:  Since we are working with a Virtual Machine there isn’t a TPM (Trusted Platform Module) Chip. This is normally where Bit locker would store the encryption key.

The Solution: BitLocker can use a USB or floppy drive to store the key in the case the hardware doesn’t have a TMP chip on board. That fact alone doesn’t do a lot of good with a VM because the USB would would always have to be mounted to the VM. However we can use that feature to instead point it to a disk volume we create to store the encryption key.

A few details about my environment:

• VMware ESX 4.1 Hosts
• VM with Windows 2008 R2 already running and ready to encrypt.
• Our domain as already been extended to store BitLocker keys (see here for more.)
• Our GPO policy that Bit Locker requires TPM to backup to AD DS.

Firstly enable Bitlocker on Windows 2008 and 2008 R2 Server. Its a Server Feature you can enabled called “BitLocker Drive Encryption”.

Next we will need a volume to store the encryption key since our VM doesn’t have a TPM Chip. You should add a additional Hard Drive to the VM and format it NTFS and mount it. I made mine 100 MB and labeled it  “EncryptionKey”. Another method would be to shrink the OS Volume by 100MB and create the volume from the freed up space however this shouldn’t be done as resizing the drive and extending the volume is then prevented. It’s better to just create a the new Virtual hard drive.

After the drive is added, formated and labeled  open the Run prompt and launch "gpedit.msc", We need to set the Group Policy Object (GPO) settings to enable BitLocker to store the key on a drive instead of TPM and to make sure it takes a backup of the key and stores it in AD.

Local Group Policy being used to edit BItLocker Settings

1. Click Start, type gpedit.mscin the Start Search box, and then press ENTER.
2. If theUser Account Controldialog box appears, confirm that the action it displays is what you want, and then click Continue.
3. In theLocal Group Policy Editorconsole tree, click Local Computer Policy, click Administrative Templates, click Windows Components, and then click BitLocker Drive Encryption.
4. Double-click the setting Store BitLocker recovery information in Active Directory Domain Services(Windows Server 2008 and Windows Vista).
5. Click to enable and Check to store Bitlocker Backup in AD FS.
6. Next Open the Operating System Drives folder and Double-click the setting Require additional authentication at startup.
7. Check Allow BitLocker without compatible TPM.

Store Bitlocker Recovery information in Active Directory Domain Services

Bitlocker Settings - Require additional authentication at startup

Now to encrypt a drive but a warning on disk space when it comes to thin provisioned disks. I learned from John Savill that:

“It's not efficient for BitLocker to encrypt free space on a drive, so BitLocker protects this empty space by creating a large placeholder file on the drive that uses up all space except for 6GB, to keep the system running during the encryption.”

In other words Bitlocker will write a file that fills the Encrypted drive to all but 6GB of the drive. In other words after we finish the encryption will need to get that then unused space back from the VM if its a Thin Provisioned disk.

Since we want to tell Bitlocker to use a disk we cannot use a Normal BitLocker GUI to start it. Instead open an elevated Administrative Command Line and  running the following to tell Bitlocker to encrypt the drive.


manage-bde.exe –on <Drive Letter to Encrypt>: -RecoveryPassword –StartupKey <Drive Letter to Encryption Key Volume >: 
Example:
manage-bde.exe –on C: -rp –sk F:

Be sure that the that the encryption Key volume Letter is correct and will always be there when the machine is mounted. I didn't really use the recovery password but generated it and saved it just in case the key didn’t work.

Output by the Manage-bde.exe Command Line.

Result from the Manage-bde.exe

Now reboot the VM and it should pass all the hardware tests. Log back in and working from “C:\Windows\System32” directory from elevated Administrative Command Line run:

manage-bde.exe -status

It should show see the Percent Encrypted for the drive growing. The drives icon will also now have a open padlock on it. If it’s still running you will notice that there’s only 6GB of free space. This will continue till the encryption finishes. Wait till it Finishes (rerun status to see) and reboot afterwards.

Result from "manage-bde.exe -status

Note: the Picture says the Version is windows 7, but I ensure you its is a Windows 2008 R2.

Congratulations. Your VM’s Drive is now encrypted with Bitlocker, however we are storing the Key on the same storage. If someone has better option I’m all ears as to how.

Follow up: If our storage or disk drive was thin provisioned. We need to reclaim all that space back from the VM that BitLocker wrote to then deleted while it encrypted the Volume. I’ll Try to write another post to address reclaiming free space from the Thin VM.

Warning – I take no responsibly for any harm that comes to you or your VM’s. Test for yourself what works for you in a safe environment and make sure you have backups.