My infrastructue uses BitLocker encrypted drives with TPM but no start up PIN. Recovery keys are stored in the AD. A few of my users are worried that no startup PIN is insecure as to the old WinMagic setup with a startup PIN before booting the OS.
In our design it is clearly stated that the most important thing is that the hard drive is encrypted in case the computer is stolen or lost.
What can I tell my concerned users, that will make them understand that the startup PIN does not really introduce any extra security.
Best Answer
Why not just explain to them the transparent mode operation of BitLocker in conjunction with TPM and that no startup PIN is required.
You could also implement TPM + PIN if it's that big an issue with the users.