Using bitlocker to isolate users' data

Posted: 09-05-2006, 08:52 PM
I have a machine that has no TPM hardware. The machine needs to run Vista.
Multiple users each need to be able to power up and shut down the computer
by themselves, and store their data on the machine's hard drive. Also, each
user wants assurance that if any other user pulls the hard drive and reads
it in another machine, then that latter user can't read the former user's
data. If a user forgets his password (and loses his backup recovery keys,
etc), all of the data which he has stored on the machine should be
unrecoverable.
The problem of a user pulling the hard drive, installing a trojan horse into
Vista, and then putting the hard drive back in the machine for other users
to continue using is a threat which I'm explicitly _not_ trying to solve at
the moment. Neither am I trying to solve the problem of other users planting
any kind of hardware bugs in/on the machine.
If I use bitlocker to encrypt everything, then all users need to know the
bootup password, so all users have the ability to pull the hard drive and
read all data, which is unacceptable.
If each user uses EFS, then all users would have the ability to pull the
hard drive and at least get directory listings of other users' data even if
users' private EFS keys weren't stored on the hard drive, which is also
unacceptable.

So how do I accomplish this user isolation?

Using bitlocker to isolate users' data


Responses to "Using bitlocker to isolate users' data"

Jamie Hunter [MS]
Guest
Posts: n/a
 
Re: Using bitlocker to isolate users' data
Posted: 09-08-2006, 06:02 AM
This would be achievable if you had TPM hardware on the machine. We can
hopefully address this scenario in the near future, but pondering over this,
I can't see a BitLocker and/or EFS combination that would address all of the
requirements below.
-
Jamie Hunter [MS]
---

"Roof Fiddler" <fiddler@roof.com> wrote in message
news:O2pfz0S0GHA.2072@TK2MSFTNGP06.phx.gbl...
>I have a machine that has no TPM hardware. The machine needs to run Vista.
>Multiple users each need to be able to power up and shut down the computer
>by themselves, and store their data on the machine's hard drive. Also, each
>user wants assurance that if any other user pulls the hard drive and reads
>it in another machine, then that latter user can't read the former user's
>data. If a user forgets his password (and loses his backup recovery keys,
>etc), all of the data which he has stored on the machine should be
>unrecoverable.
> The problem of a user pulling the hard drive, installing a trojan horse
> into Vista, and then putting the hard drive back in the machine for other
> users to continue using is a threat which I'm explicitly _not_ trying to
> solve at the moment. Neither am I trying to solve the problem of other
> users planting any kind of hardware bugs in/on the machine.
> If I use bitlocker to encrypt everything, then all users need to know the
> bootup password, so all users have the ability to pull the hard drive and
> read all data, which is unacceptable.
> If each user uses EFS, then all users would have the ability to pull the
> hard drive and at least get directory listings of other users' data even
> if users' private EFS keys weren't stored on the hard drive, which is also
> unacceptable.
>
> So how do I accomplish this user isolation?
>
 
LinkBack Thread Tools Display Modes
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


Similar Threads
Thread Thread Starter Forum Replies Last Post
BitLocker MICHAEL Windows Vista Security 12 10-10-2007 06:49 PM
C:\Users\all users\start menu - DENIED James Windows Vista File Management 2 10-19-2006 06:04 PM
C:\Users\All Users permission denied Len Norton Windows Vista File Management 8 10-04-2006 12:27 PM
cant connect to my doccuments on \\domaincontroller\users\users sh IT PHYTOSAN Windows Vista Networking & Sharing 0 10-04-2006 02:41 AM
Bitlocker bug Vipin Windows Vista Security 2 07-21-2006 08:20 PM