Is it possible to have (preferrably with Windows-on-board tools of Windows Server 2012 R2 and Windows Server 2016) to have a software raid mirror on 2 encrypted disks? (Locally preferred.)

From what I know, I have to use an SSD for normal/fast hardware encryption (at least via Bitlocker), so I am planning to put 2 ssd disks into a SW mirror.

I want to achieve 2 things:

1) theft protection
 a) if hardware gets stolen, drives are useless to thief

2) failure protection
 a) if a drive fails, the other takes over and the failed drive can be replaced
 b) if the pc fails, the drives run in another pc (or at least can be recovered)

The drives will be home of some VM hard drives, so they don't need to be bootable/system drive.

They should unlock automatically on Windows startup though, in order to reboot the machines unattended, also to have the hyper-v vhds available straight away.

Is this possible? If so, how is this possible?

  • BitLocker is not supported for Windows Server 2012 R2 Hyper-V hosts. It is supported on Windows Server 2016 Hyper-V. Also, most SSD encryption is broken. See: serverfault.com/questions/939961/… – Greg Askew Dec 2 '18 at 14:04
  • What if someone steals the entire machine? All they need do is power it on, and it'll unlock. – djsmiley2k TMW Dec 2 '18 at 20:02
  • @djsmiley2k Yes, that is a scenario, so this could be prevented by not having a Windows Login and the thief not being able to access anything further on the system? Again, I am not sure what is available/possible here. – Andreas Reiff Dec 11 '18 at 11:16

This is definitely possible, and not too difficult to achieve.

What you have to do is get a hardware RAID controller (Bitlocker doesn't work on software RAIDs), and set two drives up in RAID 1, so that even if one of the drives fails, the other has a complete copy of all the data.

Once you have the drives set up in a RAID array, all you have to do is configure Bitlocker as you normally would on a drive. Bitlocker drives can be decrypted on other PCs.

So if the computer stops working, you can access your data from another computer, and if someone steals your drives, they won't be able to access your data.

  • 1
    RAID 0 does not provide for requirement 2a from OP- " if a drive fails, the other takes over and the failed drive can be replaced" RAID 1 would provide this with the indicated 2 drives – Dave M Dec 2 '18 at 12:07
  • @DaveM My bad, no idea why I said RAID 0, thanks – rahuldottech Dec 2 '18 at 12:12
  • 2 questions: 1) if whole system gets stolen, this does not work, i. e. drives can be decrypted? 2) I asked for software raid, if possible. It has e. g. the advantage of no additional hardware dependency. This would work the same without bitlocker (which isnt available in Sever 2012 anyway according to a´comment) but with Veracrypt whole-disk-encryption, I assume? – Andreas Reiff Dec 14 '18 at 7:47
  • @AndreasReiff If the whole system gets stolen, unless they have the password, they cannot decrypt the data. Also, I am unaware of any mainstream or popular disk encryption solution supporting software RAID. – rahuldottech Dec 14 '18 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.