Lockdown Lab #33 HIGH Windows Server

Enable BitLocker on all volumes

Enable BitLocker on all volumes

You think your data is safe behind your firewall? Think again. A stolen laptop, a rogue insider, or even a discarded drive from a decommissioned server can expose everything if it’s not encrypted at rest. This isn’t theoretical; I’ve seen data exfiltration from unencrypted drives far too many times.

BitLocker is built into Windows Server. No excuses. Encrypt all your volumes with AES-256 and store those recovery keys in Active Directory. This is basic data protection hygiene, and if you’re not doing it, you’re leaving a gaping hole in your data security strategy. Don’t rely on physical security alone.

To get it done, start with something like this: Enable-BitLocker -MountPoint “C:” -EncryptionMethod Aes256 -RecoveryPasswordProtector. Then, ensure those recovery keys are backed up to AD: Backup-BitLockerKeyProtector -MountPoint “C:” -KeyProtectorId (Get-BitLockerVolume -MountPoint “C:”).KeyProtector[1].KeyProtectorId.

Go enable BitLocker on every single Windows server volume you own.

The fix

# PowerShell

Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -RecoveryPasswordProtector

# Backup key to AD

Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId (Get-BitLockerVolume -MountPoint "C:").KeyProtector[1].KeyProtectorId

Reference: CIS Windows Server Benchmark 18.9.12

Mark this as done

Open the interactive hardening checklist and tick this off in your environment.

Open interactive checklist →

Related Posts

Configure Windows Event Forwarding (WEF)

If an attacker is moving laterally through your Windows network right now, and you can't see their steps, you've already lost. Most organizations are blind...

lockdown-labhardeningwindowslogging
/Shimi Cohen

Enable PowerShell script block logging

Attackers live in PowerShell. Your incident response team will be blind without proper logging. This is how you catch them before they pivot from initial...

lockdown-labhardeningwindowslogging
/Shimi Cohen

Disable SMBv1

WannaCry, NotPetya, EternalBlue. These aren't ancient history; they're a stark reminder of what happens when you leave an ancient, vulnerable protocol like SMBv1 enabled. It's...

lockdown-labhardeningwindowsnetwork
/Shimi Cohen