Re: Whole Disk Encryption

[Rich Graves <rgraves () CARLETON EDU>]

A ssuming that all laptops are in a domain and that you push settings with GPO, BitLocker key recovery is decent. If 
you combine the built-in AD tools with SCCM, it's nearly as good as PGP. You will have ample opportunity to gain 
experience with it, because even with the most liberal PCR settings, users will violate the boot integrity check 
frequently, and at the most inconvenient times. We have about 100 PCs running BitLocker, but I would not recommend it. 

There is no supported enterprise escrow for FileVault 2. If all laptops are imaged and encrypted by central IT techs, 
then it ought to be possible to come up with manual procedures, just like some people did with TrueCrypt. If encryption 
is decentralized, forget about it. 
-- 

Rich Graves http://claimid.com/rcgraves 
Carleton.edu Sr UNIX and Security Admin 
CMC135: 507-222-7079 Cell: 952-292-6529