BitLocker provides full disk encryption for Windows Server — protecting data if the underlying storage is ever accessed outside a running, unlocked instance. This guide covers setup and the specific considerations for a VPS.
Why Full Disk Encryption on a VPS Is a Special Case
Similar to the considerations covered for Linux (see Data Encryption at Rest: What It Means and How to Implement It), a VPS's storage is managed by your provider — BitLocker protects against certain threat scenarios but not against a provider with direct hypervisor-level access to a running instance.
Prerequisites
- Windows Server 2019/2022
- Administrator access
Step 1 — Install the BitLocker Feature
Install-WindowsFeature -Name BitLocker -IncludeManagementToolsRestart-Computer -ForceStep 2 — Enable BitLocker on the System Drive
Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -UsedSpaceOnly -RecoveryPasswordProtector-RecoveryPasswordProtector generates a recovery password — save this securely and separately, since it's required if normal unlock methods fail.
Step 3 — Retrieve and Securely Store the Recovery Key
(Get-BitLockerVolume -MountPoint "C:").KeyProtectorStore this recovery key in a secure location entirely separate from the server itself — if lost along with any other unlock mechanism, the encrypted data becomes permanently inaccessible.
The Remote Unlock Challenge
Similar to the Linux LUKS remote-unlock challenge, a VPS without physical console access to enter a passphrase/PIN at boot needs a different unlock strategy — TPM-based automatic unlock (if the VPS's virtualized environment supports a virtual TPM) is the most practical approach for unattended reboots.
Checking TPM Availability
Get-TpmVerify whether your specific VPS's virtualized environment provides TPM support — without it, BitLocker's automatic unlock capability is significantly more limited, requiring manual intervention on every boot.
Configuring TPM-Based Automatic Unlock (If TPM Is Available)
Enable-BitLocker -MountPoint "C:" -TpmProtectorLets the system automatically unlock using the TPM without manual passphrase entry at boot, provided the TPM confirms system integrity hasn't been compromised.
Checking BitLocker Status
Get-BitLockerVolumeEncrypting Additional Data Drives
Enable-BitLocker -MountPoint "D:" -EncryptionMethod Aes256 -RecoveryPasswordProtectorRealistic Assessment for VPS Use
As with Linux full disk encryption, weigh whether BitLocker's operational complexity (TPM dependency, recovery key management) is genuinely warranted for your specific threat model, versus more targeted approaches like encrypting specific sensitive application data or databases directly.
Common Errors
Server doesn't automatically unlock after reboot — without TPM support (common in some virtualized environments), BitLocker may require manual intervention at every boot; verify TPM availability before assuming automatic unlock will work.
Continue Reading
- Data Encryption at Rest: What It Means and How to Implement It
- How to Install Debian with Full Disk Encryption
- Windows Server Security Checklist for a New VPS
Browse more articles in Windows Server Administration.
