I have been wanting to enable BitLocker without a compatible TPM (my MacBook Pro) on a Bootcamp partition that has read / write access to the EFI. Is there a way to do this?
I wanted to document this because the information that I've found is spread out and highly complicated. I've found a set of steps that are much simpler to enable BitLocker on a Bootcamp install of Windows. I've combined the information from these two sources for this guide:
- How do I mount the EFI partition on Windows 8.1 so that it is readable and writeable?
- Bitlocker in Windows 8.1 inside Bootcamp on the MacBook Pro (mid 2009)
The first step is to boot into your Windows partition, then log in, and open up an administrative command prompt.
Mount the UEFI partition to a drive letter:
mountvol b: /s
Copy the Microsoft EFI binaries to the UEFI partition:
bcdboot c:\windows /s b: /f UEFI
Unmount the UEFI partition:
mountvol b: /d
Configure BitLocker to work without a TPM:
- Start => run =>
- Open the Local Computer Policy node
- Navigate to
Computer Configuration \ Administrative Templates \ Windows Components \ Bit Locker Drive Encryption \ Operating System Drives
- Double click on
Require additional authentication at startup
- Enable the feature and check the box next to
Allow BitLocker without a compatible TPM, click Apply and Ok, and close out of Local Group Policy Editor.
Reboot your machine back to Windows.
You can now enable BitLocker on the device using just a passphrase.
If you're using a newer Macbook Pro (i'm using the 2018 model) then it's pretty easy actually. I'd really recommend you to read these two guides and then you'll be up and running with Bitlocker in like less than 15 minutes:
- (Good description and overview) https://tonyho.net/filevault-and-bitlocker-on-a-mac-with-boot-camp/
- (Actual guide) https://www.howtogeek.com/howto/6229/how-to-use-bitlocker-on-drives-without-tpm/
I'm writing this from inside Windows 10 on my newly encrypted Bitlocker drive running Bootcamp on a Macbook Pro 2018.