KangaByte Computer Repair

Device Encryption & Security

Procedure: SP-007  |  Version: 1.5  |  Last Updated: 1 April 2025  |  Owner: Marcus Chen

BitLocker (Windows)

1. Check current encryption status: Manage-bde -status C:
2. Enable BitLocker: Manage-bde -on C: -RecoveryPassword
3. Save the recovery key to S:\Security\BitKeys\[JobNumber].txt
4. NEVER store the recovery key on the encrypted drive itself
5. Verify encryption is active: Manage-bde -status C: should show "Protection On"

FileVault (macOS)

1. System Preferences → Security & Privacy → FileVault → Turn On FileVault
2. Save the recovery key to S:\Security\FileVaultKeys\[JobNumber].txt
3. Ensure the customer has a way to unlock the Mac (Apple ID or local password)
4. Verify encryption is progressing (shown in the FileVault window)

BIOS/UEFI Passwords

• Set BIOS password only if customer requests it (document in the job record)
• Enter BIOS (Del or F2 at boot) → Security tab → Set Supervisor/User Password
• Enable Secure Boot where supported (under Boot tab)
• NEVER set a BIOS password without the customer's explicit knowledge
• Record BIOS passwords in the job record — the customer will need these

Secure Boot Verification

1. Enter BIOS and verify Secure Boot is enabled
2. Check that the OS is booted in UEFI mode (not Legacy/CSM)
3. Verify TPM 2.0 is enabled (required for BitLocker and Windows 11)
4. Run tpm.msc in Windows to confirm TPM status

Common Issues