Skip to content
WindowsHardening

Area 08 / 12

BitLocker & Boot Security

A lost laptop should be a hardware cost, not a data breach. This area configures BitLocker with XTS-AES 256, chooses between TPM-only and TPM+PIN based on threat model, escrows recovery keys to Active Directory or Microsoft Entra ID, and verifies Secure Boot and DMA protections that the whole encryption story depends on.

Start the path

Learning path

0/4 done
  1. 01BitLocker hardening: XTS-AES 256, TPM+PIN, key escrowConfigure BitLocker for real-world threats: encryption method, TPM-only vs TPM+PIN, recovery key escrow to AD or Entra ID, Secure Boot, DMA protection and fleet verification.
  2. 02BitLocker recovery keys: escrow, rotation and auditingManage BitLocker recovery keys properly: escrow to AD DS or Entra ID, prove coverage, restrict who can read keys, audit every access and rotate keys after use.
  3. 03Secure Boot, UEFI and the BlackLotus mitigationsHarden the Windows boot chain: verify Secure Boot, apply the CVE-2023-24932 BlackLotus revocations, adopt the 2023 certificates and lock UEFI firmware.
  4. 04VBS, memory integrity (HVCI) and Kernel DMA ProtectionEnable virtualization-based security, memory integrity (HVCI) and Kernel DMA Protection: requirements, GPO and Intune settings, driver testing, verification.