Recovery passwords, however, give you full control over the drives. Furthermore, these passwords are not comparable to PINs, because, with PINs, you are only able to start the machines, so a thief, that has somehow acquired such a PIN, will not be able to access the data on the drive.
Please be aware, that without having these recovery passwords, you are facing data loss, as soon as the end-user forgets his PIN. Imagine you have applied bitlocker to all your machines and you use Active Directory to store the recovery passwords. I find it relevant because the usual way of using the delegation of control wizard cannot satisfy the need for least privilege and we need to use a largely unknown method instead, which will be described here. This article is meant for system administrators, who try to apply the principle of least privilege when it comes to Active Directory.
0 kommentar(er)
