5

I have been wanting to enable BitLocker without a compatible TPM (my MacBook Pro) on a Bootcamp partition that has read / write access to the EFI. Is there a way to do this?

9

I wanted to document this because the information that I've found is spread out and highly complicated. I've found a set of steps that are much simpler to enable BitLocker on a Bootcamp install of Windows. I've combined the information from these two sources for this guide:

The first step is to boot into your Windows partition, then log in, and open up an administrative command prompt.

Mount the UEFI partition to a drive letter: mountvol b: /s

Copy the Microsoft EFI binaries to the UEFI partition: bcdboot c:\windows /s b: /f UEFI

Unmount the UEFI partition: mountvol b: /d

Configure BitLocker to work without a TPM:

  1. Start => run => gpedit.msc
  2. Open the Local Computer Policy node
  3. Navigate to Computer Configuration \ Administrative Templates \ Windows Components \ Bit Locker Drive Encryption \ Operating System Drives
  4. Double click on Require additional authentication at startup
  5. Enable the feature and check the box next to Allow BitLocker without a compatible TPM, click Apply and Ok, and close out of Local Group Policy Editor.

Reboot your machine back to Windows.

You can now enable BitLocker on the device using just a passphrase.

  • Could anybody share an update if this solution is still working after several months? I tried something similar a while back and it all broke down after an OS update. The additional BitLocker partition was the source of many problems. – Frank Jan 11 '18 at 15:45
  • 1
    I can confirm that I did this on my MacBook Pro 2017 after it came back from repairs successfully. I haven't tried on the very latest builds of Windows, but it works fine with the release build of Windows 1709 and MacOS 10.12. It's also important to note that the approach above does not create an 'additional BitLocker partition'. It simply places the Microsoft EFI binaries into the existing Mac EFI partition so that the machine has the necessary binaries available to handle BitLocker at boot. – kop48 Jan 14 '18 at 23:43
  • If you're using a newer Macbook Pro (2018) then read my answer below. – Jim Aho Aug 23 '18 at 21:15
  • I have a 2018 macboo pro with bootcamp and Win 10 pro. The boot camp partition is 60GB and 35GB are free. I followed the gpedit instructions noted above. I got an 0x8004259a error when try to activate bit locker. Any ideas? – Peter Bliss Mar 5 at 21:27
2

If you're using a newer Macbook Pro (i'm using the 2018 model) then it's pretty easy actually. I'd really recommend you to read these two guides and then you'll be up and running with Bitlocker in like less than 15 minutes:

I'm writing this from inside Windows 10 on my newly encrypted Bitlocker drive running Bootcamp on a Macbook Pro 2018.

  • Do you no longer need to copy the EFI binaries over with the 2018 models? What setting did you use in the Apple Secure Boot Utility? – kop48 Aug 25 '18 at 20:16
  • No I did not need to copy binaries manually. What do you mean with Apple Secure Boot Utility? @kop48 – Jim Aho Aug 26 '18 at 6:57
  • Interesting! I'll have to try on my 2018 model and see how it goes. The new MacBooks have the Secure Enclave processor that validates the secure boot chain of the machine. You can relax that validation using the utility: support.apple.com/en-us/HT208330 – kop48 Aug 27 '18 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .