Encryption Management

BitLocker and FileVault management — auto-enable, recovery key escrow, compliance.

Overview

The Encryption Guard manages full-disk encryption on endpoints:

  • Windows: BitLocker Drive Encryption
  • macOS: FileVault 2

Auto-Enable Encryption

When the Encryption Guard is in enforce mode:

  1. The guard checks if disk encryption is enabled
  2. If not enabled, it automatically enables BitLocker/FileVault
  3. The recovery key is generated by the OS
  4. The key is AES-encrypted and sent to the central server
  5. The encryption status is reported in every heartbeat

Recovery Key Escrow

Recovery keys are stored on your server, not in Microsoft's or Apple's cloud:

  • Keys are encrypted with AES-256 before transmission
  • Only tenant_admin and super_admin can view recovery keys
  • Every key access is logged in recovery_key_access_log
  • Key rotation is tracked — previous keys are retained as non-current

Compliance Dashboard

The admin dashboard shows:

  • Per-device encryption status (encrypted / not encrypted / in progress)
  • Encryption algorithm and key strength
  • Recovery key availability
  • Last encryption check timestamp

Remote Force Encryption

Admins can send a force_encrypt remote command to enable encryption on a specific device immediately, without waiting for the policy cycle.