How to encrypt 2008 Server Running under esxi

disk-encryptionencryptionvmware-esxiwindows-server-2008-r2

I have a need to run multiple 2008 R2 VMs under the free esxi. Storage will be local to the host. As I understand it, BitLocker is not a supported option in a VM environment from either Microsoft or VMware's perspective.

What are my options?

Best Answer

If you're looking for an optimal full volume encryption solution, I'm not aware of one. An optimal solution would provide encryption on the host/storage level. This is easy to do with Hyper-V, but not so much with ESX. I'm surprised Microsoft does not use this more in Hyper-V marketing, but the reality is this scenario sadly demonstrates how important security is to most organizations/vendors when it comes to making decisions - not as important as the talk.

When Microsoft and VMWare say that they do not support it, what they mean is you should not use BitLocker at the guest level due to it is not an optimal solution. This is due to it possible to get a memory snapshot of a guest memory using a utility like vss2core.exe, which could facilitate attacking the encryption keys. Not trivial, but definitely something a determined adversary could do.

Otherwise, BitLocker works well on a guest. One caveat is you should not use dynamically expanding disks due to 2008 R2 will encrypt all the data and would instantly max out your disk. You can even put the Startup key (not the Recovery key) on a virtual floppy or the system partition to enable unattended startup. Note that the Startup key does not enable Recovery (aka decryption) of the data. You also need to enable a GPO setting for "Require additional authentication at startup" due to by default you need a TPM chip to enable BitLocker for an operating system volume.

Related Topic