A guide to Windows 7 security

Lock down your PC, protect your data, and safeguard your network with Windows 7's security tools.

Protecting Data

Thousands of computers, particularly laptops, are lost or stolen each year. If you don't have appropriate safeguards and security controls in place, unauthorized users who come into possession of your computer can access any sensitive data it contains. The risk of sensitive information being lost or stolen is even greater with the proliferation of tiny USB flash drives and other portable media capable of holding more and more data.

Windows 7 retains Vista's data-protection technologies, such as EFS (Encrypting File System) and support for AD RMS (Active Directory Rights Management Services). In addition to minor updates to those technologies, Windows 7 significantly improves on Vista's BitLocker drive encryption technology, and it adds BitLocker to Go for encrypting data on removable media.

Encrypting Drives With BitLocker

When BitLocker made its debut with Windows Vista, it was capable only of encrypting the primary operating system volume. Windows Vista SP2 (Service Pack 2) extended the functionality to encrypt other volumes, such as additional drives or partitions on the primary hard drive, but it still did not enable users to encrypt data on portable or removable disks. Windows 7 brings BitLocker to Go for protecting data on portable drives while still providing a means for sharing the data with partners, customers, or other parties.

171979-fig3.bitlocker._originaljpeg

Before you can begin using BitLocker Drive Encryption, your disk volumes have to be configured properly. Windows requires a small, unencrypted partition to contain the core system files it needs to begin the boot process and authenticate the user to access the encrypted volumes. Most people don't consider that when they're setting up the drive partitions initially, so Microsoft has created a tool to move things around and to repartition the drive to prepare it for BitLocker encryption. You can learn more about the BitLocker Drive Preparation Tool and download it from Microsoft's site.

Once your drive is properly partitioned, you can encrypt it with BitLocker. Click on BitLocker Drive Encryption in the Control Panel. The BitLocker console will display all of the available drives and their current state (whether BitLocker is currently protecting them). You will notice that the display separates the drives by whether they are fixed drives to be encrypted with BitLocker or removable drives to be protected with BitLocker to Go.

171979-fig6.encryptionprogress._originaljpeg

Click on Turn on BitLocker next to any unencrypted drive to begin the encryption process. The utility will ask you to assign a password for unlocking the encrypted data, or to insert your smartcard if you prefer to for authentication. BitLocker then offers an opportunity for you to save the BitLocker Recovery Key, either as a text file or printed out. You must have the BitLocker Recovery Key to unlock the data if you forget the password or if the authentication fails in any way.

Once the process begins you can go about using Windows as you normally would, and the tool will encrypt the data in the background. After it encrypts the drive, you can click on Manage BitLocker and opt to unlock encrypted drives automatically when you log on to Windows.

Using BitLocker Without a TPM

171979-fig5.bitlockertpm._originaljpeg

By default BitLocker requires a Trusted Platform Module (TPM) chip to store the BitLocker encryption keys and facilitate the encryption and decryption of the BitLocker-protected data. Unfortunately, many desktop and laptop computers are not equipped with a TPM chip, but all is not lost.

Microsoft has included the option to use BitLocker Drive Encryption without a compatible TPM, but accessing that option is not necessarily intuitive or easy. To use BitLocker without a TPM chip, follow these steps:

1. Click the Windows logo at the bottom left (the Start button).

2. In the 'Search Programs and Files' field at the bottom of the Start menu, type gpedit.msc and press Enter.

3. Under Computer Configuration, navigate to Administrative Templates, Windows Components, BitLocker Drive Encryption, Operating System Drives.

4. Double-click on the Require additional authentication at startup option.

5. Select the Enabled radio button at the top and check the Allow BitLocker without a compatible TPM check box.

6. Click OK.

Protecting Mobile Data With BitLocker to Go

Windows Vista was able to protect the drives and volumes that are part of the computer, but it could not encrypt data on removable drives. Windows 7 addresses that glaring lack of functionality with BitLocker to Go.

While you can continue working during the encryption process, when you initially encrypt a removable drive you must be sure not to remove it during the encryption process. If you do so before the process is complete, it may damage the data on the drive irreparably. If you must shut down or remove the drive prior to the completion of encryption, use the Pause button to halt the process first.

Using BitLocker to Go, you can protect data on USB thumb drives and other removable media. If you need to share sensitive information with other people, you can give them the encrypted data on the USB thumb drive and choose a password that you can share with them to unlock the contents. For additional protection, you can require a smartcard to unlock the data, and deliver the encrypted drive and the smartcard separately.

BitLocker to Go also gives administrators the ability to control how removable media can be used, as well as to enforce policies for protecting data on removable drives. Through Group Policy, administrators can make unprotected removable storage read-only and require that the system apply BitLocker encryption to any removable storage before users can save data to it.

Join the PC World newsletter!

Error: Please check your email address.

Tags Windows VistasecurityWindows 7

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tony Bradley

PC World (US online)
Show Comments

Essentials

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?