BitLocker PIN as standard user, how do you handle it?
Posted by geocast90@reddit | sysadmin | View on Reddit | 4 comments
Hi Guys
I'm breaking my head over the whole BitLocker PIN and standard user setup topic.
To begin with. I have a AD managed environment. For a couple of user I would like them to have besides the TPM Bitlocker Key also a PIN on startup. No SCCM, no InTune or anything else to manage it.
Setting up BitLocker with TPM is easy. Set up some GPOs and a scheduled task or a start up script and your good to go.
But PINs are a totaly different matter. As you need admin priviledges to start with. So the only things I can think of are the following:
-
Setup TPM and Pin with the same script and set a dummy password that you instruct the users to change later
-
As there are only a few laptops needing it. Do it manually with an admin account together with the user
-
A scheduled task in system context that has permissions for standard users to read and execute and run a second scheduels task in user context that asks the user to set a PIN with a pop up and then triggers the first with the provided PIN
I was looking at these two blogs
https://www.rockenroll.tech/2021/11/16/bitlocker-startup-pin-the-modern-way/
And thinking I could to option 3 easiely with changing those scripts a bit.
But I was wondering, how are other people handling it? Does anyone use it at all. And who goes through the hastle of setting it up automatically?
Thanks for you input!
Agitated_Blackberry@reddit
I’ve used that Oliver Kieselbach solution in intune and it works well.
In a non intune environment I used an RMM tool to a script as system, prompt user for desired pin, and then set the pin as what they entered.
Your option 3 is the best way to handle it given your environment limitations.
You’ll also have to come up with a way to handle PIN resets as standard users can’t reset their own PINs. I tried to modify Oliver’s script to incorporate a reset function but never got it to work great.
PINs are a massive pain to deal with.
geocast90@reddit (OP)
I thought that is possible to reset your own pin. At least it doesn't ask for Admin permission. But need to re-check
milkthefat@reddit
I use SCCM to apply it via OSD TS. For user driven autopilot we are dropping the requirement. The scripting will be clunky and you’ll need to test thoroughly.
Oriichilari@reddit
What do you think you’re achieving by enforcing the pin on startup when they also have a TPM?