What it does. 'Implements full disk encryption using Microsoft BitLocker on Windows Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-disk-encryption-with-bitlocker, or copy the skill folder into ~/.claude/skills/implementing-disk-encryption-with-bitlocker/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-disk-encryption-with-bitlocker/SKILL.md

SKILL.md (verbatim)

name: implementing-disk-encryption-with-bitlocker
description: 'Implements full disk encryption using Microsoft BitLocker on Windows
  endpoints to protect data at rest from unauthorized access in case of device loss
  or theft. Use when deploying encryption for compliance requirements, securing mobile
  workstations, or implementing data protection controls across the enterprise. Activates
  for requests involving BitLocker encryption, disk encryption, TPM configuration,
  or data-at-rest protection.

  '
domain: cybersecurity
subdomain: endpoint-security
tags:
- endpoint
- encryption
- BitLocker
- TPM
- data-protection
- windows-security
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.PS-02
- DE.CM-01
- PR.IR-01
mitre_attack:
- T1055
- T1547
- T1059
- T1036
- T1573

Implementing Disk Encryption with BitLocker

When to Use

Use this skill when:

• Encrypting Windows endpoints to protect data at rest for compliance (PCI DSS, HIPAA, GDPR)
• Deploying BitLocker across enterprise fleet via Intune, SCCM, or GPO
• Configuring TPM-based encryption with PIN or USB startup key for enhanced security
• Managing BitLocker recovery keys in Active Directory or Azure AD

Do not use this skill for Linux disk encryption (use LUKS/dm-crypt) or macOS (use FileVault).

Prerequisites

• Windows 10/11 Pro, Enterprise, or Education edition
• TPM 2.0 chip (recommended; TPM 1.2 supported with limitations)
• UEFI firmware with Secure Boot enabled (recommended)
• Separate system partition (200 MB minimum, created automatically by Windows installer)
• Active Directory or Azure AD for recovery key escrow

Workflow

Step 1: Verify TPM and System Requirements

# Check TPM status
Get-Tpm
# ManufacturerId, ManufacturerVersion, TpmPresent, TpmReady, TpmEnabled

# Check TPM version (2.0 required for best compatibility)
(Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm).SpecVersion

# Check UEFI/Secure Boot
Confirm-SecureBootUEFI
# Returns True if Secure Boot is enabled

# Check BitLocker readiness
$vol = Get-BitLockerVolume -MountPoint "C:"
$vol.VolumeStatus  # Should be "FullyDecrypted"
$vol.ProtectionStatus  # Should be "Off"

Step 2: Configure BitLocker GPO Settings

Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive Encryption

Operating System Drives:
  - Require additional authentication at startup: Enabled
    - Allow BitLocker without compatible TPM: Disabled (enforce TPM)
    - Configure TPM startup: Allow TPM
    - Configure TPM startup PIN: Allow startup PIN with TPM
    - Configure TPM startup key: Allow startup key with TPM

  - Choose how BitLocker-protected OS drives can be recovered: Enabled
    - Allow data recovery agent: True
    - Configure storage of recovery information to AD DS: Enabled
    - Save recovery info to AD DS for OS drives: Store recovery passwords and key packages
    - Do not enable BitLocker until recovery information is stored: Enabled

  - Choose drive encryption method and cipher strength:
    - OS drives: XTS-AES 256-bit (Windows 10 1511+)
    - Fixed drives: XTS-AES 256-bit
    - Removable drives: AES-CBC 256-bit (for cross-platform compatibility)

Fixed Data Drives:
  - Choose how BitLocker-protected fixed drives can be recovered: Enabled
    - Store recovery passwords in AD DS: Enabled

Removable Data Drives:
  - Control use of BitLocker on removable drives: Enabled
  - Configure use of passwords for removable drives: Require complexity

Step 3: Enable BitLocker - Command Line

# Enable BitLocker with TPM-only protector (transparent to user)
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 `
  -TpmProtector -SkipHardwareTest

# Enable BitLocker with TPM + PIN (recommended for laptops)
$pin = ConvertTo-SecureString "123456" -AsPlainText -Force
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 `
  -TpmAndPinProtector -Pin $pin

# Add recovery password protector
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

# Backup recovery key to Active Directory
Backup-BitLockerKeyProtector -MountPoint "C:" `
  -KeyProtectorId (Get-BitLockerVolume -MountPoint "C:").KeyProtector[1].KeyProtectorId

# Encrypt fixed data drives
Enable-BitLocker -MountPoint "D:" -EncryptionMethod XtsAes256 `
  -RecoveryPasswordProtector -AutoUnlockEnabled

Step 4: Deploy via Intune (Enterprise)

Intune → Endpoint Security → Disk encryption → Create Profile

Platform: Windows 10 and later
Profile: BitLocker

Settings:
  BitLocker base settings:
    - Encryption for operating system drives: Require
    - Encryption for fixed data drives: Require
    - Encryption for removable data drives: Require

  Operating system drive settings:
    - Additional authentication at startup: Require
    - TPM startup: Allowed
    - TPM startup PIN: Required (for high-security endpoints)
    - Encryption method: XTS-AES 256-bit
    - Recovery: Escrow to Azure AD

  Fixed drive settings:
    - Encryption method: XTS-AES 256-bit
    - Recovery: Escrow to Azure AD

  Assign to: All managed Windows devices (or specific groups)

Step 5: Manage Recovery Keys

# View recovery key on local system
(Get-BitLockerVolume -MountPoint "C:").KeyProtector |
  Where-Object {$_.KeyProtectorType -eq "RecoveryPassword"} |
  Select-Object KeyProtectorId, RecoveryPassword

# Retrieve recovery key from Active Directory (requires RSAT)
Get-ADObject -Filter {objectClass -eq "msFVE-RecoveryInformation"} `
  -SearchBase "CN=COMPUTER01,OU=Workstations,DC=corp,DC=example,DC=com" `
  -Properties msFVE-RecoveryPassword |
  Select-Object -ExpandProperty msFVE-RecoveryPassword

# Retrieve recovery key from Azure AD
# Azure Portal → Azure AD → Devices → [device] → BitLocker keys
# Or via Microsoft Graph API:
# GET /devices/{id}/bitlockerRecoveryKeys

Step 6: Monitor Encryption Status

# Check encryption status across fleet
manage-bde -status C:

# Expected output for encrypted drive:
#   Conversion Status: Fully Encrypted
#   Percentage Encrypted: 100.0%
#   Encryption Method: XTS-AES 256
#   Protection Status: Protection On
#   Key Protectors: TPM, Numerical Password

# PowerShell compliance check
$vol = Get-BitLockerVolume -MountPoint "C:"
if ($vol.ProtectionStatus -eq "On" -and $vol.VolumeStatus -eq "FullyEncrypted") {
    Write-Host "COMPLIANT: BitLocker enabled and fully encrypted"
} else {
    Write-Host "NON-COMPLIANT: BitLocker status - Protection: $($vol.ProtectionStatus), Volume: $($vol.VolumeStatus)"
}

Key Concepts

Tools & Systems

• BitLocker (built-in): Windows full disk encryption feature
• manage-bde.exe: Command-line BitLocker management tool
• BitLocker Recovery Password Viewer: RSAT tool for viewing recovery keys in Active Directory
• MBAM (Microsoft BitLocker Administration and Monitoring): Enterprise BitLocker management (legacy, replaced by Intune)
• Microsoft Intune: Cloud-based BitLocker policy deployment and recovery key management

Common Pitfalls

• Not escrowing recovery keys before encryption: If recovery keys are not saved to AD/Azure AD before encryption, they may be permanently lost if the TPM fails.
• Using TPM-only without PIN: TPM-only mode is transparent but vulnerable to cold boot attacks and evil maid attacks. Add a startup PIN for laptops leaving the office.
• Encrypting used space only on repurposed drives: If a drive previously contained sensitive data, "used space only" encryption leaves deleted data unencrypted in free space. Use full disk encryption for repurposed drives.
• Forgetting removable drives: USB drives and external disks are common data loss vectors. Enforce BitLocker To Go for removable media.
• No pre-provisioning for SCCM deployments: Pre-provision BitLocker during OSD task sequence to encrypt before OS deployment, avoiding the lengthy post-deployment encryption process.

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

BitLocker Disk Encryption Template

Endpoint Information

Encryption Configuration

Recovery Key Register

Compliance Checklist

• TPM 2.0 present and enabled
• Secure Boot enabled
• OS drive encrypted with XTS-AES 256
• Recovery key escrowed to AD/Azure AD
• PIN configured for laptop endpoints
• Fixed data drives encrypted
• Removable drive encryption policy active
• BitLocker cannot be disabled without admin

Sign-Off

references/api-reference.md (verbatim)

API Reference: Implementing Disk Encryption with BitLocker

manage-bde CLI

# Check status
manage-bde -status C:

# Enable BitLocker with TPM
manage-bde -on C: -RecoveryPassword -EncryptionMethod AES256

# Backup recovery key to AD
manage-bde -protectors -adbackup C: -ID {protector-id}

# Lock/unlock
manage-bde -lock D:
manage-bde -unlock D: -RecoveryPassword 123456-...

PowerShell BitLocker Cmdlets

# Get BitLocker volume
Get-BitLockerVolume -MountPoint "C:"

# Enable with TPM + PIN
Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 `
  -TpmAndPinProtector -Pin (ConvertTo-SecureString "1234" -AsPlainText -Force)

# Add recovery password
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

# Backup to AD
Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $id

Compliance Checks

Microsoft Graph API (Intune)

import requests
headers = {"Authorization": "Bearer <token>"}
resp = requests.get(
    "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices"
    "?$select=deviceName,isEncrypted",
    headers=headers)

References

• BitLocker: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/
• BitLocker PowerShell: https://learn.microsoft.com/en-us/powershell/module/bitlocker/

references/standards.md (verbatim)

Standards & References - Implementing Disk Encryption with BitLocker

Primary Standards

NIST SP 800-111 - Guide to Storage Encryption Technologies

• Publisher: NIST
• URL: https://csrc.nist.gov/publications/detail/sp/800-111/final
• Scope: Guidance on planning, implementing, and maintaining storage encryption solutions

FIPS 140-2/3 - Security Requirements for Cryptographic Modules

• Publisher: NIST
• Relevance: BitLocker uses FIPS 140-2 validated cryptographic modules when configured in FIPS-compliant mode

Compliance Mappings

Microsoft References

• BitLocker Overview: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/
• BitLocker Group Policy Reference: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-group-policy-settings
• BitLocker Recovery Guide: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/bitlocker-recovery-guide-plan
• TPM Recommendations: https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/tpm-recommendations

references/workflows.md (verbatim)

Workflows - Implementing Disk Encryption with BitLocker

Workflow 1: Enterprise BitLocker Deployment

[Pre-deployment assessment]
    │
    ├── Verify TPM 2.0 across fleet
    ├── Confirm UEFI/Secure Boot
    ├── Plan recovery key escrow (AD DS or Azure AD)
    │
    ▼
[Configure GPO/Intune policy]
    │
    ├── Set encryption method (XTS-AES 256)
    ├── Configure key protectors (TPM + PIN for laptops, TPM for desktops)
    ├── Enable recovery key escrow
    │
    ▼
[Pilot deployment (test group)]
    │
    ├── Verify encryption completes without errors
    ├── Test recovery key retrieval
    ├── Verify no boot issues
    │
    ▼
[Production rollout (phased)]
    │
    ▼
[Monitor encryption status via Intune/SCCM reports]
    │
    ▼
[Verify 100% coverage, address failures]

Workflow 2: BitLocker Recovery Process

[User locked out (BitLocker recovery screen)]
    │
    ▼
[User provides Recovery Key ID to helpdesk]
    │
    ▼
[Helpdesk retrieves recovery key]
    │
    ├── AD DS: RSAT BitLocker Recovery Password Viewer
    ├── Azure AD: Azure Portal → Devices → BitLocker keys
    ├── Intune: Intune Portal → Devices → Recovery keys
    │
    ▼
[User enters 48-digit recovery key]
    │
    ▼
[Investigate why recovery was triggered]
    │
    ├── BIOS/firmware update ──► [Expected, no action]
    ├── TPM failure ──► [Replace TPM or re-encrypt]
    ├── Boot configuration change ──► [Review change, re-seal TPM]
    └── Potential tampering ──► [Security investigation]

Workflow 3: Key Rotation

[Quarterly key rotation policy]
    │
    ▼
[Generate new recovery password]
    │
    ▼
[Backup new key to AD/Azure AD]
    │
    ▼
[Remove old recovery password protector]
    │
    ▼
[Verify new key works in test recovery]

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.