I just got my new MacBook Pro Mid 2018, encrypted my Mac OS Mojave partition with FileVault 2, installed Boot Camp and Windows 10 Pro and wondered if it is possible to encrypt the windows partition as well.

I tried using BitLocker and was able to successfully "encrypt" the Boot Camp partition after disabling TPM in gpedit.msc. I relogged a few times, and it seemed to work. After holding option key and choosing Windows in the Boot Screen, the typical BitLocker Bootloader appeared. On the other hand selecting Macintosh HD lead to the FileVault 2 Bootloader appearing.

However, I coincidently figured out how to skip the BitLocker bootloader.

At Mac OS Logon Screen I chose Guest user. It did the obligatory reboot and I was in the Guest OS. After rebooting again it wasn't possible anymore to enter the boot option menu by holding option key on startup. Booting lead me straight to the Guest OS every time. I couldn't even set another startup volume, because apparently there was no. At first glance I was shocked and I thought I had destroyed my bootloader completely.

So after resetting my NVRAM/PRAM by holding option+cmd+p+r on startup something very unexpected happened. The standard boot option menu was back, but when I chose Windows, the BitLocker bootloader was gone. I was able to start Windows and get into the OS and filesystem without entering my BitLocker password. In Windows settings BitLocker was deactivated and I was also able to see the full contents of Boot Camp drive from Mac OS, which of course wasn't possible before. It looks like BitLocker hasn't encrypted my drive ever, although it said it successfully did and showed me the bootloader with the password prompt before when I tried to boot from Windows.

The questions I have now are basically:

  • Is this a bug or is it logical somehow because of Apples new T2 architecture? Which leads me to the next question:
  • With that new T2 architecture, isn't it impossible to encrypt the whole system partition because resetting will reset the bootloader and boot menu every time?
  • How can I encrypt my Boot Camp partition completely?

TrueCrypt/VeraCrypt doesn't work as well. Obviously.

And yes, I thought about using FileVault 2 alongside with a firmware password and Windows Boot Camp without encryption. But I think this is rather not an option or safe because Apple, or more importantly the staff in their stores, are able to reset the firmware password which is kind of a big deal in my opinion. And also as far as I know, soldering out the RAM and doing other sneaky stuff still works to bypass the firmware password.

So what can I do? I do not want to use encrypted containers within the file system. I just want my Mac and my Windows Boot Camp partition encrypted, both standalone and completely. In the perfect case I could even use VeraCrypt for Mac OS instead of FileVault 2.

Tell me what you guys think :) But please no virtualization suggestions.

Thanks in advance.

You must log in to answer this question.

Browse other questions tagged .