Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

We'd like to deploy TrueCrypt for a full system and usb stick encryption in our company. Our systems are Microsoft based with Windows 7 and our normal users do not have administrator privileges, thus having the restriction of not being able to change passwords. However, I'd like the users to be able to do so, as my experience shows, that users do not accept complex passwords (in terms of: they write it down on the laptop itself).

Does anyone have any experience with TrueCrypt in a corporate environment? If the TrueCrypt GUI will be started in administrator mode during startup, will the GUI be able to change the password of a container or the full system encryption?

share|improve this question
Slightly OT: Have you seriously looked at BitLocker, it's built into Win7, no passwords if you have TPM chips (which most computers in the last few years do), GPO management. It's not a silver bullet, but it works really well for most companies. – Chris S♦ Aug 23 '11 at 12:20
Yes I did - the problem is, that it does not encrypt external storage and that our users do not understand, that they are only allowed to save data in their home directory. This (and stupid programs) lead to unencrypted data outside of the home directory. Therefore it's not an option. But Thanks! :) – Lars Aug 23 '11 at 13:13
1  
BitLocker certainly can encrypt external storage; and you can use GPO to prevent them saving data to unencrypted removable media too if you want. I really don't mean to sound like a MS Advertisement, but most people who chose something other than BitLocker either 1. Have very tight requirements (government, financial industry, etc) 2. Don't know BitLocker or have misconceptions. or 3. Need something cross platform compatible (BL on works on Win7 & Server 2008 R2) – Chris S♦ Aug 23 '11 at 14:41
Thanks for the clarification - I did search a lot on BitLocker, could you give a reference for the external storage encryption? – Lars Aug 23 '11 at 14:56
1  
The BL Deployment Guide has a lot of good information. The GUI for removable storage calls it "BitLocker 2 Go", but it's almost the exact same thing as is used for hard drives (BL2Go Drives come with a utility to unlock the drive from XP & Vista). If you're good at the cli manage-bde can do everything from there, and gives straight-forward information (reference). – Chris S♦ Aug 23 '11 at 15:33

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.