11

I have been wanting to enable BitLocker without a compatible TPM (my MacBook Pro) on a Bootcamp partition that has read / write access to the EFI. Is there a way to do this?

Improve this question
0

5 Answers 5

Reset to default
12

I wanted to document this because the information that I've found is spread out and highly complicated. I've found a set of steps that are much simpler to enable BitLocker on a Bootcamp install of Windows. I've combined the information from these two sources for this guide:

The first step is to boot into your Windows partition, then log in, and open up an administrative command prompt.

Mount the UEFI partition to a drive letter: mountvol b: /s

Copy the Microsoft EFI binaries to the UEFI partition: bcdboot c:\windows /s b: /f UEFI

Unmount the UEFI partition: mountvol b: /d

Configure BitLocker to work without a TPM:

  1. Start => run => gpedit.msc
  2. Open the Local Computer Policy node
  3. Navigate to Computer Configuration \ Administrative Templates \ Windows Components \ Bit Locker Drive Encryption \ Operating System Drives
  4. Double click on Require additional authentication at startup
  5. Enable the feature and check the box next to Allow BitLocker without a compatible TPM, click Apply and Ok, and close out of Local Group Policy Editor.

Reboot your machine back to Windows.

You can now enable BitLocker on the device using just a passphrase.

Improve this answer
9
  • Could anybody share an update if this solution is still working after several months? I tried something similar a while back and it all broke down after an OS update. The additional BitLocker partition was the source of many problems.
    – u17
    Commented Jan 11, 2018 at 15:45
  • 1
    I can confirm that I did this on my MacBook Pro 2017 after it came back from repairs successfully. I haven't tried on the very latest builds of Windows, but it works fine with the release build of Windows 1709 and MacOS 10.12. It's also important to note that the approach above does not create an 'additional BitLocker partition'. It simply places the Microsoft EFI binaries into the existing Mac EFI partition so that the machine has the necessary binaries available to handle BitLocker at boot.
    – kop48
    Commented Jan 14, 2018 at 23:43
  • If you're using a newer Macbook Pro (2018) then read my answer below.
    – Jim Aho
    Commented Aug 23, 2018 at 21:15
  • I have a 2018 macboo pro with bootcamp and Win 10 pro. The boot camp partition is 60GB and 35GB are free. I followed the gpedit instructions noted above. I got an 0x8004259a error when try to activate bit locker. Any ideas?
    – Peter Bliss
    Commented Mar 5, 2019 at 21:27
  • @PeterBliss the error text is as follows: "The volume you have selected to shrink may be corrupted. Use Chkdsk to fix the corruption problem, and then try to shrink the volume again." Try running chkdsk
    – kop48
    Commented Aug 21, 2020 at 16:55
4

I had to encypt both Mac OS and Windows and wasn't sure about order, but found this article:

In short words:

  1. First enable FileVault on Mac
  2. Reboot in Windows
  3. Disable TPM as described in other comments (using gpedit.msc)
  4. Start Bitlocker encryption
  5. Reboot Windows to finish the encryption (Bitlocker will prompt you to do so)

I tested this on MacBook Pro 13 2020 MacOS 10.15.7 and latest Windows 10.

Improve this answer
3
  • In StatckExchange sites we like an answer to be useful even if the link is not reachable, ie precis the information in the answer. This is very important for places like medium whioch do not allow free access, they limit the number of articles you can read, so at the end of a month I will not be able to make any use of this answer
    – mmmmmm
    Commented Jan 14, 2021 at 12:28
  • @mmmmmm I amended my answer. I thought only premium articles are limited on medium.
    – matuma
    Commented Jan 15, 2021 at 14:20
  • Good clarification, I should have that as the assumption. However, I don't believe that it matters whether FileVault is enabled on it or not if you're using APFS.
    – kop48
    Commented Jan 21, 2021 at 22:40
3

If you're using a newer Macbook Pro (i'm using the 2018 model) then it's pretty easy actually. I'd really recommend you to read these two guides and then you'll be up and running with Bitlocker in like less than 15 minutes:

I'm writing this from inside Windows 10 on my newly encrypted Bitlocker drive running Bootcamp on a Macbook Pro 2018.

Improve this answer
5
  • Do you no longer need to copy the EFI binaries over with the 2018 models? What setting did you use in the Apple Secure Boot Utility?
    – kop48
    Commented Aug 25, 2018 at 20:16
  • No I did not need to copy binaries manually. What do you mean with Apple Secure Boot Utility? @kop48
    – Jim Aho
    Commented Aug 26, 2018 at 6:57
  • Interesting! I'll have to try on my 2018 model and see how it goes. The new MacBooks have the Secure Enclave processor that validates the secure boot chain of the machine. You can relax that validation using the utility: support.apple.com/en-us/HT208330
    – kop48
    Commented Aug 27, 2018 at 15:30
  • I get this error "Bitlocker could not be enabled" "The data drive specified is not specified to automatically unlock on the current computer and cannot be unlocked automatically. C: was not encrypted" this error following restart after following the steps that your links link to themselves howtogeek.com/howto/6229/… Initial thoughts: what is the "data drive" that the error is referring to and where is the setting to "automatically unlock"
    – therobyouknow
    Commented Sep 20, 2020 at 12:39
  • My issue documented further here: superuser.com/questions/1587124/…
    – therobyouknow
    Commented Sep 20, 2020 at 13:01
1

Adding some instructions on how to do this so that it works with Parallels too.

  1. Follow all of the instructions above while booted into Windows natively with Bootcamp, but DON'T ENABLE BITLOCKER YET.

  2. Next, go back to MacOS, fire up Parallels and create the VM from the Bootcamp partition.

  3. Once you've done that, enable Bitlocker from within the VM in Parallels, set it to start with a password.

Voila! You'll now be able to unlock Bitlocker with a password either from Parallels, or booting natively with Bootcamp.

Improve this answer
-1

Successful solution, overcoming error

I followed these steps for my MacBook Pro 15inch 2016 (touchbar) and was then able to over come the error I got as I've also described in the third step:

  1. How-To Geek: How to Use BitLocker Without a Trusted Platform Module (TPM)

  2. How-To Geek: How to Set Up BitLocker Encryption on Windows

  3. Which drive is the “data drive” referred to in the Bitlocker error “The data drive specified” where would it be set to “automatically unlock”? (solution to overcome error: "the data drive specified is not set to automatically unlock on the current computer and cannot be unlocked automatically" and "C: was not encrypted").

Improve this answer
1
  • In StatckExchange sites we like an answer to be useful even if the link is not reachable, ie precis the information in the answer.
    – mmmmmm
    Commented Jan 15, 2021 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .