# Bitlocker

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FRM5zh4P3IpYMn4wVbxvE%2Fbanner_bitlocker.png?alt=media&#x26;token=278b744a-69a0-40c4-a95f-8f58ab405f7d" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
This tutorial requires one device of any in the following categories:

* [x] [YubiKey 5 Series](https://www.yubico.com/store/#yubikey-5-series)
* [x] [YubiKey 5 FIPs Series](https://www.yubico.com/store/#yubikey-5-fips-series)
  {% endhint %}

## <mark style="color:red;">❊ Create Certificate</mark>

Create a new notepad document on your computer and name it <mark style="color:blue;">**bitlocker-certificate.txt**</mark>

Open the new text file and paste the following text inside:

```properties
[Version]
Signature="$Windows NT$"

[NewRequest]
Subject = "CN=Bitlocker, OU=YourName, O=YourOrganization, C=US"
KeyLength = 2048
HashAlgorithm = Sha256
Exportable = TRUE
KeySpec = "AT_KEYEXCHANGE"
FriendlyName = "Bitlocker Encryption"
KeyUsage = "CERT_KEY_ENCIPHERMENT_KEY_USAGE"
KeyUsageProperty = "NCRYPT_ALLOW_DECRYPT_FLAG"
RequestType = Cert
SMIME = FALSE
ValidityPeriodUnits = 10
ValidityPeriod = Years

[EnhancedKeyUsageExtension]
OID=1.3.6.1.4.1.311.67.1.1 ; BitLocker Drive Encryption
OID=1.3.6.1.4.1.311.67.1.2 ; BitLocker Data Recovery Agent
OID=1.3.6.1.4.1.311.10.3.4 ; Encrypted file System
OID=1.3.6.1.4.1.311.20.2.2 ; Smart card login
OID=1.3.6.1.4.1.311.10.3.4.1 ; File recovery
OID=1.3.6.1.4.1.311.21.6 ; Key recovery agent
```

{% hint style="info" %}
In the above code, you can change the text in the <mark style="color:red;">**Subject**</mark> line. You can also modify the <mark style="color:red;">**FriendlyName**</mark>, and the <mark style="color:red;">**ValidityPeriodUnits**</mark>.&#x20;

By default, the certificate is set to expire in <mark style="color:blue;">**5 years**</mark>.
{% endhint %}

## <mark style="color:red;">❊ Regedit Changes</mark>

Next, modify the registry to enable Bitlocker.

{% tabs %}
{% tab title="Download" %}
{% file src="<https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2F9SsUe7pZo4eLh37JP90H%2Fbitlocker_regedit.reg?alt=media&token=29d72d0f-e4cc-4209-a622-e604d834101b>" %}
{% endtab %}

{% tab title="Source Code" %}

```
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE]
"SelfSignedCertificates"=dword:00000001
"CertificateOID"="1.3.6.1.4.1.311.67.1.1"
```

{% endtab %}
{% endtabs %}

Download the above <mark style="color:red;">**.reg**</mark> file to your computer, and then double-click to execute it.&#x20;

{% hint style="warning" %}
If using the source code; DO NOT modify the <mark style="color:red;">**CertificateOID**</mark>.\ <mark style="color:red;">**1.3.6.1.4.1.311.67.1.1**</mark> must match in both the registry, and in the <mark style="color:blue;">**bitlocker-certificate.txt**</mark> file you created in the first step.
{% endhint %}

## <mark style="color:red;">❊ Local Group Policy Editor</mark>

Next, open <mark style="color:red;">**Local Group Policy Editor**</mark>**.**

Click ![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FSyfQrdxjBzXS136qtRW3%2Fwindows_10x_icon.png?alt=media\&token=ef09892d-afb2-4d50-9f03-e869bce31407)-> Run and type <mark style="color:yellow;">**`gpedit.msc`**</mark>

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FhsdVpmYAZFFCe42AG6SJ%2Frun_local_group.png?alt=media&#x26;token=e2c6903d-fa4d-4c2c-bfa9-34221f6204c8" alt=""><figcaption></figcaption></figure>

Browse to: <mark style="color:red;">**`Local Computer Policy`**</mark> -> <mark style="color:orange;">**`Computer Configuration`**</mark> -><mark style="color:yellow;">**`Administrative Templates`**</mark> -> <mark style="color:yellow;">**`Windows Components`**</mark> -> <mark style="color:green;">**`BitLocker Drive`**</mark> <mark style="color:green;">**`Encryption`**</mark>

Select <mark style="color:red;">**`Validate smart card certificate usage rule compliance`**</mark>

Set: <mark style="color:yellow;">**`Enabled`**</mark>

Ensure  <mark style="color:red;">**`Object identifier`**</mark> set to <mark style="color:yellow;">**`1.3.6.1.4.1.311.67.1.1`**</mark>

If you changed the Object Identifier (OID) number in previous steps, you must match that same OID number.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2Fys5Xtzry1zkrb0GWDca5%2Flocal_bitlocker.png?alt=media&#x26;token=696a4784-d9ae-46c2-8a0b-5b7dc15efb0f" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">❊ Powershell</mark>

Open <mark style="color:yellow;">**Powershell**</mark> and change directories to the folder where you saved the <mark style="color:blue;">**bitlocker-certificate.txt**</mark> file.

For my example, I used my C: drive since my file is located in C:\Bitlocker\bitlocker-certificate.txt

```powershell
cd C:\Bitlocker\
```

After navigating to the correct folder, run the command:

```powershell
certreq -new .\bitlocker-certificate.txt
```

Save new file as <mark style="color:red;">**`bitlocker-certificate.req`**</mark>

## <mark style="color:red;">❊ Certificate Manager</mark>

Open ![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FSyfQrdxjBzXS136qtRW3%2Fwindows_10x_icon.png?alt=media\&token=ef09892d-afb2-4d50-9f03-e869bce31407) and search for <mark style="color:red;">**Manage User Certificates**</mark> or go to ![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FSyfQrdxjBzXS136qtRW3%2Fwindows_10x_icon.png?alt=media\&token=ef09892d-afb2-4d50-9f03-e869bce31407)-> Run and type <mark style="color:red;">**`certmgr.msc`**</mark>

Browse to: <mark style="color:red;">**`Certificates`**</mark> – <mark style="color:red;">**`Current User`**</mark> -> <mark style="color:red;">**`Personal`**</mark> -> <mark style="color:yellow;">**`Certificates`**</mark>

Look for a certificate called <mark style="color:blue;">**Bitlocker**</mark>**.**

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FXrK7JbEobmUpw8qkhN33%2Fbitlocker_cert.png?alt=media&#x26;token=279a62a5-6b9b-4998-8466-e1b3361d7c98" alt=""><figcaption></figcaption></figure>

Right-click on <mark style="color:yellow;">**Bitlocker**</mark> certificate and select <mark style="color:red;">**All Tasks**</mark> -> <mark style="color:red;">**Export**</mark>

Click <mark style="color:red;">**`Next`**</mark> -> select <mark style="color:red;">**`Yes, export the private key`**</mark> -> click <mark style="color:red;">**`Next`**</mark> again.

Click <mark style="color:red;">**`Next`**</mark> -> check <mark style="color:red;">**`Password`**</mark> box -> enter a password for the certificate.

Click <mark style="color:red;">**`Next`**</mark> -> select <mark style="color:red;">**`Browse…`**</mark> -> save the file as <mark style="color:yellow;">**`bitlocker-certificate.pfx`**</mark> -> click <mark style="color:red;">**`Next`**</mark>, and finally <mark style="color:red;">**`Finish`**</mark>

## <mark style="color:red;">❊ Import Certificate</mark>

This next section will show you how to import your certificate onto your Yubikey PIV interface. The important thing to know is that your PIV interface comes with 4 main slots. Each slot has a different way of behaving which includes if you will enter a PIN or not.

<table><thead><tr><th width="87.33333333333331">Slot</th><th width="201">Slot Name</th><th width="72">PIN</th><th>PIN Policy</th></tr></thead><tbody><tr><td><mark style="color:red;"><strong>9A</strong></mark></td><td>Authentication</td><td><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FWtRVmoJu3cHGrnkRuLRu%2Fcheck.png?alt=media&#x26;token=02ef37f6-5cb6-4b6e-916d-63a9c6433763" alt=""></td><td><p>PIN is required to perform operations.</p><p>Remembers PIN for short period.</p></td></tr><tr><td><mark style="color:red;"><strong>9C</strong></mark></td><td>Digital Signature</td><td><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FWtRVmoJu3cHGrnkRuLRu%2Fcheck.png?alt=media&#x26;token=02ef37f6-5cb6-4b6e-916d-63a9c6433763" alt=""></td><td>PIN must be submitted every time immediately before a sign operation.</td></tr><tr><td><mark style="color:red;"><strong>9D</strong></mark></td><td>Key Management</td><td><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FWtRVmoJu3cHGrnkRuLRu%2Fcheck.png?alt=media&#x26;token=02ef37f6-5cb6-4b6e-916d-63a9c6433763" alt=""></td><td><p>PIN is required to perform operations.</p><p>Remembers PIN for short period.</p></td></tr><tr><td><mark style="color:red;"><strong>9E</strong></mark></td><td>Card Authentication</td><td></td><td>PIN is NOT required.<br>PIN policy can be changed.</td></tr></tbody></table>

You can import your Bitlocker certificate into <mark style="color:yellow;">**9A**</mark>**,&#x20;**<mark style="color:yellow;">**9D**</mark> or <mark style="color:yellow;">**9E**</mark>. If you do import your certificate into slot 9E and wish to require a PIN every time you unlock the drive, you will need to change the PIN / TOUCH policy.

{% hint style="info" %}
To change the PIN / TOUCH policy, you must do it when you import your certificate / key. Once the key is on the YubiKey there is no way to change the policy.\
\
It must be done via command-line (explained below).
{% endhint %}

<mark style="color:orange;">**Choose ONE**</mark> of the following two methods. Do not use both. Method 2 allows you to change the PIN / TOUCH policy on your PIV slot and can only be done with the command-line. This is only available on Yubikeys running firmware v5.4.x+

If you use the Yubikey Manager to import, the PIN / TOUCH policy will use the default settings.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FsxzaK1femJKVCi6VS3fm%2Fbanner_bitlocker_method_1.png?alt=media&#x26;token=4c6dbae6-6179-444d-9797-d55df8e3a1a1" alt=""><figcaption></figcaption></figure>

Launch <mark style="color:red;">**Yubikey Manager**</mark>.

Go to: <mark style="color:red;">**`Applications`**</mark> -> <mark style="color:red;">**`PIV`**</mark> -> and select the desired slot: <mark style="color:yellow;">**Authentication**</mark> or<mark style="color:yellow;">**`Card Authentication`**</mark>

At the bottom right, click <mark style="color:red;">**Import**</mark> and browse to the location where you saved the <mark style="color:yellow;">**`bitlocker-certificate.pfx`**</mark>

Once you select the PFX, it will ask you to enter the password you provided when you first exported the certificate in the ![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FvruVNIOWoWHUaDrROjUK%2Flink%20\(1\).png?alt=media\&token=8ac71312-243b-4852-999d-74eaa595ec54) [**Certificate Manager**](#certificate-manager) step.

You will be asked for your Yubikey <mark style="color:red;">**Management Key**</mark>, enter it or select **Use Default** if you haven't changed it.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2F73g14ltZkQ1V2oacSMUk%2Fbanner_bitlocker_method_2.png?alt=media&#x26;token=d9fdab2b-2cae-4673-9301-ae6cbe31c1cb" alt=""><figcaption></figcaption></figure>

This method enables the PIN / TOUCH policy. Requires Yubikey firmware v5.4.x+

Don't know what ykman is or how to run these commands?\
![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FvruVNIOWoWHUaDrROjUK%2Flink%20\(1\).png?alt=media\&token=8ac71312-243b-4852-999d-74eaa595ec54) [**Read our section on finding and setting up the ykman CLI.**](https://yubico.gitbook.io/yubikey5/guides/setting-up-cli-ykman#how-to-get)<br>

| command                                        | options                                |
| ---------------------------------------------- | -------------------------------------- |
| <mark style="color:red;">--pin-policy</mark>   | `DEFAULT \| NEVER \| ONCE \| ALWAYS`   |
| <mark style="color:red;">--touch-policy</mark> | `DEFAULT \| NEVER \| ALWAYS \| CACHED` |

Determine what policies work best for you. In the code examples below:

* \--pin-policy ALWAYS
* \--touch-policy ALWAYS

{% hint style="warning" %}
There are reports that specifying a different PIN POLICY will result in Bitlocker being unable to unencrypt your drive. The reason for this isn't exactly known, but if you attempt to define a PIN policy and you receive the error "No valid smartcard", please re-import the certificate without a PIN policy specified.

You can still specify the touch policy.
{% endhint %}

{% tabs %}
{% tab title="Slot 9A" %}

```sh
ykman piv keys import --touch-policy ALWAYS 9a "C:\path\to\private\bitlocker-certificate.pfx"
ykman piv certificates import 9a "C:\path\to\private\bitlocker-certificate.pfx"
```

{% endtab %}

{% tab title="Slot 9D" %}

```sh
ykman piv keys import --touch-policy ALWAYS 9d "C:\path\to\private\bitlocker-certificate.pfx"
ykman piv certificates import 9d "C:\path\to\private\bitlocker-certificate.pfx"
```

{% endtab %}

{% tab title="Slot 9E" %}

```sh
ykman piv keys import --touch-policy ALWAYS 9e "C:\path\to\private\bitlocker-certificate.pfx"
ykman piv certificates import 9e "C:\path\to\private\bitlocker-certificate.pfx"
```

{% endtab %}
{% endtabs %}

## <mark style="color:red;">❊ Validate Certificate</mark>

To ensure the correct Bitlocker certificate is being loaded; click ![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FSyfQrdxjBzXS136qtRW3%2Fwindows_10x_icon.png?alt=media\&token=ef09892d-afb2-4d50-9f03-e869bce31407) and type <mark style="color:red;">**Control Panel**</mark>.

After the control panel opens, locate and click <mark style="color:red;">**User Accounts**</mark>**.**

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FCN1wsjsdDJHdmQAGe6Oq%2Fcp_user_accounts.png?alt=media&#x26;token=08fd48a4-3287-4c30-b6da-b56e9c94802d" alt=""><figcaption></figcaption></figure>

Once the account dialog opens, on the left-side, select <mark style="color:red;">**Manage your file encryption Certificates**</mark>**.**

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2F0FZkQsDwg7BZwjupP0Dd%2Fcp_users_manage_cert.png?alt=media&#x26;token=a4fe4ecf-79e7-4b99-b745-d13006eb1491" alt=""><figcaption></figcaption></figure>

And finally, the last dialog will open and display the PIV certificate that will be used for Bitlocker.&#x20;

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2F4R9HbiHo8JtSAeHVCZeq%2Fbitlocker_cert_verify.png?alt=media&#x26;token=0ae5e4e7-367c-47d8-96e9-e5e759d25eec" alt=""><figcaption></figcaption></figure>

If the wrong certificate appears, click <mark style="color:red;">**Select Certificate**</mark> button on the right and choose the correct one. Make sure you click <mark style="color:red;">**More Choices**</mark> if you have multiple PIV certificates on your Yubikey.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FAJfCH8cAhj8NQRjixfFF%2Fpiv_more_choices.png?alt=media&#x26;token=9559fb5c-4014-4053-9bd8-eef9b15a4650" alt=""><figcaption></figcaption></figure>

Once you click <mark style="color:red;">**Next**</mark>, you will be asked if you wish to backup your certificate. You can do this if you've lost your original certificate. This is just another opportunity to make sure you have a spare.

## <mark style="color:red;">❊ Enable Bitlocker on Drive</mark>

Finally, you can now enable Bitlocker on the drive you use to encrypt.

Click ![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FSyfQrdxjBzXS136qtRW3%2Fwindows_10x_icon.png?alt=media\&token=ef09892d-afb2-4d50-9f03-e869bce31407) and type <mark style="color:red;">**Manage Bitlocker**</mark>**.**

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2F5fOjvH8fqUCU5TeN6zrp%2Fmanage_bitlocker.png?alt=media&#x26;token=5ab6d6a7-2498-41a3-9d34-4895bc14344d" alt=""><figcaption></figcaption></figure>

You will be shown a list of all your drives, and the option to <mark style="color:red;">**Turn on Bitlocker**</mark>**.**

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FfDzk7dMNZyZP1DRF7qyi%2Fbitlocker_manage_off.png?alt=media&#x26;token=92ad9fec-f89e-401e-8fda-188eaa1b6edb" alt=""><figcaption></figcaption></figure>

Once the dialog opens, select your desired options. In this example, I have selected to use both a password AND a smart card:

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2Fj04tPiDMEml6eujfjAmv%2Fbitlocker_turn_on.png?alt=media&#x26;token=83fef7fd-2828-45b9-8877-411b6fd0ab43" alt=""><figcaption></figcaption></figure>

Finally, you will be presented with a screen to save your Recovery Key.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FMeGM0jMWWc1Ssacxv0fn%2Fbitlocker_last_steppng.png?alt=media&#x26;token=c252b75c-541c-40a8-b327-aef116a43924" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
**SAVE YOUR RECOVERY KEY**
{% endhint %}

If you forget your password or your Yubikey no longer works, you will be unable to get into your drive without your recovery key.

<div align="left"><figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2Fz78uU02mYxrCNPy6tof9%2Fanim_watching.gif?alt=media&#x26;token=07225345-f941-4ff0-beea-45ae948f52ee" alt=""><figcaption><p>SAVE YOUR RECOVERY KEY</p></figcaption></figure></div>

## <mark style="color:red;">❊ Existing Bitlocker Drive</mark>

If you had an existing drive with Bitlocker enabled prior to adding your smart card, go to ![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FSyfQrdxjBzXS136qtRW3%2Fwindows_10x_icon.png?alt=media\&token=ef09892d-afb2-4d50-9f03-e869bce31407) and type <mark style="color:red;">**Manage Bitlocker**</mark>.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2F5fOjvH8fqUCU5TeN6zrp%2Fmanage_bitlocker.png?alt=media&#x26;token=5ab6d6a7-2498-41a3-9d34-4895bc14344d" alt=""><figcaption></figcaption></figure>

Select an existing drive with Bitlocker enabled and view the options next to the drive.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FYCPXVCyRyqoFeOppXjHG%2Fbitlocker_smartcard_add.png?alt=media&#x26;token=78192b8b-b373-4187-9d13-721a42fa79a4" alt=""><figcaption></figcaption></figure>

Then select <mark style="color:red;">**Add Smart Card**</mark>**.**

Your Yubikey PIV certificate should automatically be added to your drive.

If you get a prompt that shows multiple certificates from your Yubikey, select the correct certificate.

If you have an existing Bitlocker drive which is not giving you the option to use your Yubikey, select the option <mark style="color:red;">**Remove Smart Card**</mark>, wait a few seconds, and then select <mark style="color:red;">**Add smart card**</mark>. Bitlocker sometimes glitches if you encrypt a drive and then add the smart card.

## <mark style="color:red;">❊ Unlocking Your Bitlocker Enabled Drive</mark>

Once you have everything configured properly; it's now time to test out your drive.

Select one of your locked drives.

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FtxA0r45S1ylWqieCzaMV%2Fbitlocker_unlock.png?alt=media&#x26;token=d7b1c2d0-23f1-4663-b599-ae9e5d6a9e31" alt=""><figcaption></figcaption></figure>

You will be presented with numerous ways to unlock your drive. For this example, we'll select <mark style="color:red;">**Use Smart Card**</mark>**.**

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2F4pzIe0a6TMjwHEejGxsv%2Fbitlocker_unlock2.png?alt=media&#x26;token=3bbd754d-9c3c-4a1d-ad19-ca574d1798af" alt=""><figcaption></figcaption></figure>

You'll be prompted to enter your <mark style="color:red;">**PIV Pin**</mark>. This is the PIN you set in the section ![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FvruVNIOWoWHUaDrROjUK%2Flink%20\(1\).png?alt=media\&token=8ac71312-243b-4852-999d-74eaa595ec54) [ii. Pins](https://yubico.gitbook.io/yubikey5/tutorials/broken-reference).

If you did not ever set a new PIN, then the default pin is <mark style="color:yellow;">**123456**</mark>

You can view a list of default Yubikey credentials on the ![](https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FvruVNIOWoWHUaDrROjUK%2Flink%20\(1\).png?alt=media\&token=8ac71312-243b-4852-999d-74eaa595ec54) [**Defaults page**](https://yubico.gitbook.io/yubikey5/tutorials/broken-reference).

## <mark style="color:red;">❊ Bitlocker Toys</mark>

I have a script I use which allows me to lock my drive by simply right-clicking on the drive. If you wish to have this toy, download and install it below:

{% file src="<https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FPpDcRo2rasG7yjumkj3y%2Fbitlocker_lock_unlock_tool.zip?alt=media&token=28caa98e-1bdc-4179-a353-3d75153c6b67>" %}

To install, unzip the contents of the zip file somewhere.

Double-click the file <mark style="color:red;">**Bitlocker\_Add\_Lock\_Drive\_to\_context\_menu.reg**</mark>

Copy the file <mark style="color:red;">**lock-bde.bat**</mark> to <mark style="color:yellow;">**C:\Windows**</mark>

If you wish to uninstall, run the file <mark style="color:red;">**Bitlocker\_Remove\_Lock\_Drive\_from\_context\_menu.reg**</mark>

Once installed, you can open your <mark style="color:red;">**Windows File Explorer**</mark>, right click on the bitlocker drive, and select the option available:

<figure><img src="https://3439786616-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFqFACNHWgp8HSNubDNCu%2Fuploads%2FDMqJsf3x6VnEZR9KtP8g%2Fbitlocker_context.png?alt=media&#x26;token=6810228f-eab7-447f-b26c-918d2a587577" alt=""><figcaption></figcaption></figure>