How to prevent user from taking the PC hard disk at home

[Magical_falcon]

Hello,

any body have an idea how to protect the HDD from the computer user to take it at home and copy the work files ?

the pc usb is protected but the user can open the pc case and take the HDD and use it on another computer , and if i encrypt it he should has the password to do his daily work , so how i can make him work normal and also prevent him from use or copy it outside or it just use a physical lock for the case is the only solution ?

[SomewhereinSC]

So you BitLocker the drive(s) your concerned with in the users system. If the user pulls the drive and put it into another system it will request the BitLocker key (which the user should not have).

[Magical_falcon]

but if he boot from this HDD from another computer , will it ask for the bitlocker password ?

[SomewhereinSC]

100% yes, BitLocker will pop on any hardware type changes…

[Magical_falcon]

he should have the password as he is already the user of the computer so he can decrypt it , plus not all computers has tpm to use bitlocker

[SomewhereinSC]

The user would not have the BitLocker key (only you should have that if these are managed systems). The user knowing his own BitLocker code to start the system is different than the key needed to active the drive if hardware is changed.

[Magical_falcon]

sorry , you mean there will be two keys one for manage user to login and the other key for me if something changed ?

[molan]

@Magical_falcon

sorry , you mean there will be two keys one for manage user to login and the other key for me if something changed ?

no. Bitlocker stores the keys in the computers TPM (that chip that is always in the news because MS now requires it for Win 11) the user never knows the Bitlocker Key. You don’t know the Key either. You would configure your systems to the key is backed up (AD, Entra ID, etc) so you can get it if needed.

to the end user nothing changes. they use the computer as normal and login with their credentials. but if they tamper with the computer the drive the computer will stop booting until the bitlocker key is provided. If they remove the drive its encrypted and that can’t read it unless they know the bitlocker key.

Bit locker has been around a long time and has been best practice for almost 2 decades. This is a solved problem and very easy to implement and manage.

[chris-kelly]

Bitlocker protects drives by using “protectors”. A bitlockered drive typically stores a protector in the system’s TPM (trusted platform module) chip and unlocks the drive automatically on boot. You can also optionally use an additional PIN protector which prompts for the PIN at boot time - this also requires the presence of a TPM.

Then there’s the recovery password protector - in a managed AD/Azure environment, this should be stored in AD/Azure and only sysadmins should have access to this - this lets a sysadmin get at the data in the event the original TPM is not available.

Once you take the drive out of that system with the original TPM, it’ll prompt for the full bitlocker recovery key.

If the system doesn’t have a TPM, you have no choice but to allow the user access to the unlock code, as the system wouldn’t be able to boot otherwise. That said, TPMs are standard issue and have been for a long time - if you’re running endpoints without one, you really need to consider replacing them.

[molan]

@chris-kelly

If the system doesn’t have a TPM, you have no choice but to allow the user access to the unlock code, as the system wouldn’t be able to boot otherwise. That said, TPMs are standard issue and have been for a long time - if you’re running endpoints without one, you really need to consider replacing them.

you could still use at USB dongle with the key stored on it to auto unlock on boot without TPM and just not tell the user about it, Kind of like one of those annoying hardware License keys some CAD programs used to use. but if the user was smart they could figure out how to bypass by simply moving the dongle to another computer if they pulled the drive.

But TPM is definitely the way to go. Any Computer built since win 11 that came with a win 11 compatibility sticker has TPM. Basically any business grade computer made in the last 20 years should have a TPM 1.2 at least, but you want TPM 2 for Win 11 compatibility.

Its really only cheap consumer PC gear pre-win 11 that probably didn’t have a TPM

[matt7863 (m@ttshaw)]

@Magical_falcon

he should have the password as he is already the user of the computer so he can decrypt it , plus not all computers has tpm to use bitlocker

You need to use devices with TPMs and a suitable encryption system that uses the TPM so that it cannot be accessed in another system.

Any other form of encryption is going to require just a password or hardware dongle etc which the user will need to have/know to use the computer - so they can work round it. TPM ties it to the physical device.

Also non technical measures:
tell them not to
make sure it’s in the AUP and T&Cs.
use a security seal.
If the company does not trust the user - don’t employee them.

Where I live I would be sacked (through formal process) for doing this. And the company within their right to prosecute for theft.
In many jobs I have had I would be in prison for a long time.

[Rod-IT]

@Magical_falcon

so how i can make him work normal and also prevent him from use or copy it outside or it just use a physical lock for the case is the only solution ?

If you have someone in your company doing this, refer them to HR, this isn’t a technical problem, though there are technical solutions, this is a people problem.

Essentially the user is stealing company data.

You can use products like DLP to prevent copy/move/duplicate etc, but these are often expensive and cumbersome to setup.

[matthew-martin (MartinCCSS)]

BitLocker and don’t give local admin. If they have local admin then they can retrieve the BitLocker recovery key.

I’d think emailing, cloud storage, or SMB to another machine would be more likely.

[general-tsao]

This is exactly what Bitlocker is for…if your corporate workstations are not being ordered with Windows PRO at the least and TPM chips, you should start ordering them that way.

[fuzzywuzzy]

And then there is the old failsafe lockable HHD caddy … ?

HDD locked into the caddy that it sits in ?

PC side door locked too ?

if removed in any other way than the key that admin support - i suggest you follow Rods advice ;0)

Sackable

[egp_dave]

Fire the user and have them arrested for theft and espionage. No, I’m not joking. If you are that worried then you have an HR and security problem.
You could also do what Amazon does and search employees after their shifts. The US Supreme Court said it was ok AFTER employees clock out (so you don’t even need to pay for being suspicious in the US!)

[Magical_falcon]

Thank you for everyone who reply and game me great ideas
for bad luck most computers dont have the TPM chip so i will add upgrading the computer one by one but this will take time , so i will work on the physical solution which is using the case lock for now to prevent this from happened again

ah btw about telling the HR about this employee , the Head of HR was the employee who did that
this person is left but we should prevent this risk from happened again

[jarmbrister]

This would require a huge shift in how things are done but, you could move to a server/remote desktop setup where employees log into a thin client. Physically secure the server(s).

[randomparts]

As many people have already addressed possible resolutions to this, I will simply add slap the user with a fish until they get the message.

[James9006]

Said fish should be a wet trout.