I've been ask to look at full disk encryption software for our mobile users. We're running Windows XP SP3 PCs on a domain and my understanding is that we will not be upgrading to Vista and have no current plans to upgrade to Windows 7. This would seem to rule out Bitlocker. We'd like to look at two different types of solutions:
- An Active Directory-integrated solution that syncs Domain accounts and passwords for single-sign on to a PC. This solution should allow Domain Admins to access any encrypted drive and gets bonus points if decryption/encrypted disk access authority can be delegated to non-Domain Admins on the Help Desk.
- A solution that runs on each PC individually or in some sort of workgroup mode that allows a single master password to decrypt the laptop's drive. Syncing with Domain user accounts and passwords would also be nice, for end-user single-sign on.
The solution must be reliable (e.g. not lose password sync when a user is forced to change her Domain password on the road.) This is a small shop, so ease of administration is important.
The powers that be may rule out TrueCrypt because of its recent security vulnerability, but for the purpose of the question, I'd like to hear how well it meets these requirements. Same thing with BitLocker - it may be ruled out because of a lack of desire to upgrade Windows, but I'm interested in the job it does on Vista/Windows 7.