{"id":853,"date":"2011-11-07T17:20:36","date_gmt":"2011-11-07T22:20:36","guid":{"rendered":"http:\/\/swildow.darktech.org\/wp\/?p=853"},"modified":"2011-11-07T17:20:36","modified_gmt":"2011-11-07T22:20:36","slug":"how-to-encrypt-backups-and-optionally-the-system-disks-on-windows-server-2008-and-sbs-2008-and-windows-vista-too","status":"publish","type":"post","link":"https:\/\/www.wildow.com\/blog\/?p=853","title":{"rendered":"How to encrypt backups and optionally the system disks on Windows Server 2008 and SBS 2008 and Windows Vista too"},"content":{"rendered":"

http:\/\/uksbsguy.com\/blogs\/doverton\/archive\/2009\/04\/26\/how-to-encrypt-backups-and-optionally-the-system-disks-on-windows-server-2008-and-sbs-2008.aspx<\/a><\/p>\n

 <\/p>\n

Hi,<\/p>\n

someone asked in the forums how if the backups on SBS 2008 and Windows Server 2008 were encrypted and the answer is no, even if the drives being backed up are BitLocker protected (more details here<\/a>).\u00a0 However you can get encrypted backups with a bit of effort.\u00a0 To do this you will need to at least BitLocker enable your removable drives and optionally your system disk.\u00a0 I used the information athttp:\/\/blogs.msdn.com\/askdavid\/archive\/2007\/06\/08\/enabling-bitlocker-on-removable-drives-usb-flash-drives-usb-hard-drives.aspx<\/a>\u00a0as a guide to putting together what I needed to do, so many thanks David Chandra for this.\u00a0 This same process can also be used on Windows Vista<\/p>\n

<\/p>\n

There are a couple of snags however and you need to work out which scenario you wish to have (if you have a TPM chip then option 2 & 3 can be replaced with entering a key into the TPM prompt:<\/p>\n

    \n
  1. encrypt just the backup disks you will need to run a script each time a volume is added back to the system<\/li>\n
  2. encrypt the system disk and the backup disks and you will need a USB key or key information to be entered every time you reboot the server<\/li>\n
  3. encrypt the system disk and the backup disks, but store the system unlock information unencrypted on the server so you do not have to enter decryption information every time.<\/li>\n<\/ol>\n

     <\/p>\n

    Given the choices above the steps are as follows (they build from option 1 through to option 3):<\/p>\n

      \n
    1. Option 1\n
        \n
      1. Add BitLocker to the server<\/li>\n
      2. Encrypt the Backup Hard Disks<\/li>\n
      3. Add an unlock script<\/li>\n<\/ol>\n<\/li>\n
      4. Option 2\n
          \n
        1. Prepare the system disk for BitLocker encryption<\/li>\n
        2. Encrypt the system<\/li>\n<\/ol>\n<\/li>\n
        3. Option 3\n
            \n
          1. Store the unlock key on the boot partition for automatic use<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n

            \u00a0Option 1 (encrypting the backup disks)<\/h2>\n

            You will need to repeat the steps below (excluding adding Bitlocker to the system) for each disk you want to encrypt.\u00a0 You can do this to an existing disk or a new disk.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n
            \"0000<\/a><\/td>\nAdd Bitlocker role<\/strong><\/p>\n

            To start this task we need to add the BitLocker role to SBS 2008.\u00a0 While BitLocker is built into Windows Server 2008 it is not installed.\u00a0 To install it start\u00a0Server Manager\u00a0<\/strong>from the\u00a0Start Menu<\/strong>\u00a0and then scroll the right hand window down until you can find<\/td>\n<\/tr>\n

            \"0001<\/a><\/td>\nIn the list of roles that can be added, select the BitLocker role and continue through the wizard until BitLocker is available<\/td>\n<\/tr>\n
            \"0002<\/a><\/td>\nTo be able to easily BitLocker the drive we need to add a drive letter.\u00a0 Run the command\u00a0diskmgmt.msc<\/strong>\u00a0to start the Disk Management tool.\u00a0 Find the Backup disk and right click on it and select\u00a0Change Drive Letter and Paths<\/strong>.<\/td>\n<\/tr>\n
            \"0003<\/a><\/td>\nYou will notice that the disk, which present and used does not have a drive letter, so we need to change this.\u00a0 Press the\u00a0Add<\/strong>button to add a drive letter that we can easily refer to in the command lines.<\/td>\n<\/tr>\n
            \"0003<\/a><\/td>\nPick the next available drive letter and press OK.\u00a0 In my example the drive letter is “E:<\/strong>“.\u00a0 In all the command lines below replace\u00a0E:<\/strong>with the right drive letter for your system.<\/td>\n<\/tr>\n
            \"0004<\/a><\/td>\nOpen and administrative Command Prompt from the start menu and check the title bar says\u00a0Administrator Command Prompt<\/strong>.\u00a0 Check that the disk is ready for encrypting with the commandscript manage-bde.wsf -status<\/strong>. Note this has to be run from\\Windows\\System32<\/strong>.<\/td>\n<\/tr>\n
            \"0005<\/a><\/td>\nTime to encrypt the disk and save the recovery keys.\u00a0 I’m going to save them to C:, but they can be saved to any disk in the system except the one being encrypted.
            \nType\u00a0script manage-bde.wsf -on E: -recoverykey C: -recoverypassword<\/strong>.
            \nYou will see several pieces of information including the disk ID, the file name for the\u00a0recovery key file<\/em><\/strong>\u00a0and the numeric password should you not have these to hand.\u00a0 You will need to make a note of this information, but do NOT store with the drive.<\/p>\n

            To create an unlock command, enter the command below replacing\u00a0<recovery key file>\u00a0<\/em><\/strong>with the filename from your output.\u00a0 The filename for the command in my example isc:\\unlock_backup_disk3.cmd<\/strong>\u00a0and you should change it to be appropriate to your system.
            \necho cscript c:\\windows\\system32\\manage-bde.wsf -unlock E: -recoverykey\u00a0<recovery key file><\/em><\/strong>\u00a0> c:\\unlock_backup_disk3.cmd<\/strong><\/td>\n<\/tr>\n

            \"0006<\/a><\/td>\nThe disk will now begin encrypting and depending on how much data is stored on it, may take some time.\u00a0 You can check the status with the command\u00a0cscript c:\\windows\\system32\\manage-bde.wsf -status<\/strong>\u00a0as shows in the screen shot until the disk is 100% encrypted.<\/td>\n<\/tr>\n
            \"0006<\/a><\/td>\nIf you intend on encrypting the system disk then you can remove the drive letter.\u00a0 The backup will still work if the drive has a drive letter, but it will now show up in the SBS Console and Computer windows, but should not be modified in any way.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

             <\/p>\n

            Option 2 & 3 (encrypting the system disk and enabling automatic unlocking of the USB drives)<\/h2>\n\n\n\n\n\n\n\n\n\n\n
            \"0007<\/a><\/td>\nDownload preparation tool from Microsoft athttp:\/\/www.microsoft.com\/downloads\/details.aspx?displaylang=en&FamilyID=320b9aa9-47e8-44f9-b8d0-4d7d6a75add0<\/a>\u00a0and then install the tool.<\/td>\n<\/tr>\n
            \"0007<\/a><\/td>\nStart the tool from the\u00a0Start Menu<\/strong>\u00a0– it is under\u00a0Accessories<\/strong>,System Tools<\/strong>,\u00a0BitLocker<\/strong>\u00a0and is called\u00a0BitLocker Drive Preparation Tool<\/strong>.<\/p>\n

            As is always the case when making major changes to a system ensure you have a backup of the system.<\/p>\n

            Press\u00a0Continue<\/strong>\u00a0to start the tool.<\/td>\n<\/tr>\n

            \"0009<\/a><\/td>\nThe tool will shrink your system drive and create a small S: drive which will contain the boot files.\u00a0 Once it is complete, pressFinish<\/strong>.<\/td>\n<\/tr>\n
            \u00a0\"0010<\/a><\/td>\nYou will need to restart your computer to continue the preparation.\u00a0 Press\u00a0Restart Now<\/strong>\u00a0to do so.<\/td>\n<\/tr>\n
            \u00a0\"0012<\/a><\/td>\nOnce you have rebooted and logged back in the tool will continue.\u00a0 Once it is finished, press\u00a0Close<\/strong>\u00a0to exit the tool.
            \nYour drives are now prepared to be encrypted.<\/td>\n<\/tr>\n
            \u00a0\"0013<\/a><\/td>\nTo encrypt the system disk enter the command below.\u00a0 I put a recovery key on the backup disk (which is encrypted) and also onto another disk to enable system start up.<\/p>\n

            For the system to start up it will need an unencrypted file system with the startup key present.\u00a0 You can either chose to put this onto the S: drive which is less secure as removing the boot disk will provide someone with all the encryption keys or if you wish for your system to be more secure you can put this onto a removable USB drive.
            \nIf your only desire was to encrypt the backups and have them automatically available when plugged into the server then this is fine.\u00a0 If you want greater overall security then you should use the removable key method.\u00a0 Note that to reboot the server this will be required, so automatic updates could cause a problem.
            \nLeaving this removable media in the system means that any would-be thief would still have the decryption means.<\/p>\n

            The command you need is:
            \ncscript manage-bde.wsf -on C: -recoverykey E: -recoverypassword -startupkey S:<\/p>\n

            E:<\/strong>\u00a0is the removable media I’m backing the key up to and\u00a0S:<\/strong>\u00a0is the system disk.\u00a0 Change S: to the startup usb key you will user to reboot the system with greater security.<\/p>\n

            Once again, mate a note of the key security information highlighted in the screen shot.<\/td>\n<\/tr>\n

            \u00a0\"0014<\/a><\/td>\nYou can once again see the progress being made by the encryption by using the\u00a0cscript manage-bde.wsf -status<\/strong>command.<\/td>\n<\/tr>\n
            \"0015<\/a><\/td>\nFinally, your SBS backup will no longer function correctly as the S: drive is not included in the backup set, but is a crucial part of the system backup.\u00a0 You will need to\u00a0Disable Backup<\/strong>\u00a0and re-create it before the backup will work again.<\/p>\n

            When you are re-creating the backup, when selecting the target device it will claim it is going to format the backup target, but for me it did not and previous backups were still available.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

            This whole process took a while as I had in total about 100GB to encrypt, between the system disk and backups, but I now have secure backups.<\/p>\n

             <\/p>\n

            Thanks
            \nDavid<\/p>\n

             <\/p>\n

             <\/p>\n","protected":false},"excerpt":{"rendered":"

            http:\/\/uksbsguy.com\/blogs\/doverton\/archive\/2009\/04\/26\/how-to-encrypt-backups-and-optionally-the-system-disks-on-windows-server-2008-and-sbs-2008.aspx   Hi, someone asked in the forums how if the backups on SBS 2008 and Windows Server 2008 were encrypted and the answer is no, even if the drives being backed up are BitLocker protected (more details here).\u00a0 However … Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-853","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/853","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=853"}],"version-history":[{"count":2,"href":"https:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/853\/revisions"}],"predecessor-version":[{"id":855,"href":"https:\/\/www.wildow.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/853\/revisions\/855"}],"wp:attachment":[{"href":"https:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=853"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=853"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wildow.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=853"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}