How to enable BitLocker device encryption on Windows 8 RT

  • Article
  • 3 minutes to read

This document describes the workflow to enable BitLocker device encryption on the local hard disk of a Windows Surface figurer that is running Windows 8 RT.

Applies to: Windows viii
Original KB number: 2855131

Summary

The document makes the following points:

  • Logons past guest accounts, local administrator accounts, or Microsoft accounts that are members of the guest group don't trigger BitLocker encryption of the local hard disk.
  • The first logon by a Microsoft business relationship that is a fellow member of the local computer's Administrators security grouping triggers BitLocker encryption of the local hard disk. A restart is required to complete the characteristic configuration.
  • The BitLocker recovery countersign is put on the OneDrive share of the administrator-enabled Microsoft account that triggered the encryption. That recovery key isn't visible on the OneDrive share when the share is viewed by using a web browser or a OneDrive viewing awarding.
  • Windows Explorer displays a padlock next to local drives that are BitLocker encrypted.
  • BitLocker recovery keys may be obtained from the following website through an e-mail message, a phone call, or a text message:
    Find my BitLocker recovery key

More data

Note

The sizes of dialog boxes and other UI elements that are depicted in this article were changed. Changes include the placement of text in a dialog box and the size/aspect ratio.

To see how the BitLocker device encryption workflow works, follow these steps:

  1. On a new Windows eight RT-based organisation, create a Guest account, and and then log on by using that account.

  2. Check the BitLocker status in Command Panel. The Guest user can't invoke BitLocker encryption.

    Screenshot of the BitLocker Drive Encryption page in Control Panel.

  3. Create a Microsoft account, and then associate that account with the Guest account that you created in stride 1.

    Screenshot of the Your account page in PC settings.

  4. Log off.

  5. Log on past using the Microsoft account that you created in step iii. Observe that the BitLocker add together-in reports that the drive isn't protected.

  6. Restart the computer, and then log on again by using the Microsoft account that you created in footstep iii. Notice that the BitLocker protection status remains unchanged.

    The net result is that logons that were made by using Microsoft accounts that are members of the Guest grouping don't trigger BitLocker encryption of the hard deejay.

  7. Create a new local account that is a fellow member of the local reckoner's Administrators security group. Notice that the BitLocker add-in reports that the drive isn't protected.

  8. Restart the computer. Again, notice that the BitLocker add-in reports that the drive isn't protected.

    The net outcome is that user logons that were made by using local computer accounts that are members of the Administrators grouping don't trigger BitLocker encryption of the difficult disk.

  9. Associate the administrator account that y'all created in step 7 with a new Microsoft account.

  10. Log on by using the Microsoft account that now has administrator permissions. Notice the post-obit on-screen message:

    Configuring Windows Feature
    X % computer
    Do non turn off your estimator

  11. Restart the computer when you lot're prompted, and notice that the "Configuring Windows Feature" operation continues.

    The net issue is that the kickoff logon by a Microsoft business relationship that is a member of the local estimator's Administrators grouping triggers BitLocker encryption of the local bulldoze.

  12. Log on by using the Microsoft business relationship that is a member of the Administrators grouping that you originally created in step 7. Notice the text modify that is displayed by the BitLocker particular in Command Panel.

    Screenshot of the BitLocker Drive Encryption page, which shows BitLocker is helping to protect your files.

  13. The padlock icon in Windows Explorer reports that the local bulldoze is BitLocker protected.

    Screenshot of the padlock icon in Windows Explorer.

  14. Detect that OneDrive never identifies the BitLocker recovery key.

    Even after the local drive is clearly BitLocker encrypted and the Control Panel UI says that the BitLocker recovery key is stored on the first logon of a Microsoft account that is a member of the local calculator's authoritative group, OneDrive doesn't show whatsoever BitLocker-related files.

    Screenshot of the Files page in OneDrive.

    The net result is that the OneDrive share for the administrator-enabled Microsoft business relationship that triggered the BitLocker device encryption shows no files.

  15. Observe that the TPM.MSC snap-in displays a status of "The TPM is ready for use."

    Screenshot of the Trusted Platform Module (TPM) Management on Local Computer window.

  16. Connect to Detect my BitLocker recovery key. You run across the following options:

    Screenshot of the Send a text to phone options in Microsoft account verification page.

  17. If you sent the recovery key by using a text bulletin, the targeted phone will receive a text bulletin that contains the Microsoft account security code. The text message resembles the following:

    Screenshot of the text message sample on the targeted phone.

  18. Type the code that y'all received in the text bulletin into the Find my BitLocker recovery key magician.

    Screenshot of the code entry page of the Find my BitLocker recovery key wizard.

    The Detect my BitLocker recovery key wizard reports the BitLocker recovery cardinal.

    Screenshot of the page displaying the BitLocker recovery key.