Protection Before Windows Start

The device lock takes effect even before the boot process. This prevents attackers from accessing data via the operating system or external boot media. This is a decisive security advantage over solutions that only become active after Windows has started.

Unlock Anywhere® locks your device before the boot process begins—blocking attackers long before Windows or any external media can even load. By integrating seamlessly with UEFI and BitLocker encryption, it delivers powerful pre-boot protection that secures everything on your Windows device: emails, company data, credentials, and personal information. Unlike traditional security tools that activate only after startup, this proactive defense stops even the most sophisticated evil maid attacks—ensuring your data stays safe, always.

Unlock Anywhere® ensures protection before Windows starts through a pre-boot security architecture that activates before the operating system or any external media can access the device. Here’s how it works:

🔒 Pre-Boot Protection Mechanism

1. Lock Engages Before Boot:
   The system is locked at the firmware (UEFI) level — even before Windows or BitLocker can initialize. This means attackers cannot access or manipulate data through the operating system, USB boot media, or recovery tools.
2. Cloud-Based Boot Key Authorization:
   When a device powers on, it doesn’t automatically unlock BitLocker via the TPM chip. Instead, it sends a cryptographically secure request to the Unlock Anywhere® Cloud Service for a one-time boot key.
   – Only authorized devices receive the key.
   – The key activates BitLocker encryption and allows Windows to start.
   – Every boot is logged in the cloud for full auditability.
3. Protection from Offline and “Evil Maid” Attacks:
   Since the system remains encrypted until cloud authorization is granted, attackers cannot steal data or inject malware — even with physical access to the device.
4. Offline Security with QR Boot Code:
   If a device is offline, users must scan a unique QR code with their smartphone to obtain a one-time boot code from the cloud. This process keeps the same cryptographic security — no boot code means no startup.
5. TPM-Backed Anti-Tampering:
   The built-in Trusted Platform Module (TPM) enforces anti-hammering protection, making brute-force or tampering attempts virtually impossible.

✅ Result

Data remains encrypted and inaccessible until central authorization occurs — long before Windows loads. This pre-boot control gives enterprises a decisive security edge over solutions that only activate after startup.