When you install Bitlocker on a system without a TPM you need to put the startup key on a flash drive.
Since you can hardly expect the user to store his notebook and flash drive separately, would Bitlocker offer any advantage over an unencrypted system if both are lost/stolen?
If both of them were stolen by the same thief, which happens to have some knowledge of how Bitlocker works, you can pretty much assume your file system has been broken into.
You may want to consider using TPM if your data is extremely important, or even TPM + PIN. It's better to have to rely on stuff that's in your head rather than a USB key which anyone can get their hands on if they really want to.
I know this question is old but I tripped across it in related questions while looking for an answer of my own for this.
You can use manage-bde to require both the USB and a password in order to unlock a device. That effectively turns unlocking the machine into a 2FA ordeal. Unlike the Bitlocker UI which doesn't give you the option to apply multiple protectors, the manage-bde tool allows you to specify multiple protectors if you have 'Require additional authentication on start-up', which you likely already have figured out. My guess is the commands would run as follows:
manage-bde –protectors -add C: -startupkey [USB DRIVE]
manage-bde -on C:
[After it's encrypted]
manage-bde -protectors -add C: pw
You might be able to do this in one command, I just don't have a good means to test it on a fresh endpoint, but am curious enough I'm about to run it on my old laptop and let you know if you can do this in one command and will edit accordingly based on what I see.
Bitlocker can be compromised even with a TPM. Sure it's unlikely but it all depends on how much your data is worth to you and who's interested in it.
For the average Joe it's not worth it.
For CEO level security I think I'd be looking at adding an extra layer of encryption at the very least.
See: http://www.schneier.com/blog/archives/2009/12/defeating_micro.html
The two existing attacks against bitlocker are quite a stretch. Gaining access to the victims computer TWO TIMES is a very unlikely event. What will happen in most cases? The Laptop/Workstation gets stolen alltogether or just the harddrive. BitLocker will keep your data "safe" (of course there is NEVER a 100% security).
Only CEO data is important? Really? I think I can do a whole lot of damage with some random employees files.
"Since you can hardly expect the user to store his notebook and flash drive separately [...]" If you are unable to teach the employees basic security bahaviour, most of your precautions will fail.
Don't get me wrong here, but security isn't done the simple way :)
