What OS on the laptops?
I assume XP Professional?
If they were running Vista Enterprise or Ultimate, I would use the built in BitLocker Drive Encrytion, which provides transparent full disk encryption.
If the OS is XP Pro:
Is the end goal:
Full disk encryption?
If the answer is yes:
• With full disk encryption, everything is encrypted, but key recovery can be a royal pain.
• This needs support if you are to boot windows.
• full disk encryption means you have a boot-loader that asks for the key at boot time, which requires heavy support from the OS.
o PGP Whole Disk Encryption locks down the entire contents of a laptop, desktop, external drive, or USB flash drive, including boot sectors, system, and swap files. The encryption is transparent to the user, automatically protecting data
Central management is integrated in LDAP (AD)
is a commercial and closed source program, so you can't fully audit it yourself
"Popular whole disk encryption vendor, PGP Corporation, has a remote support “feature” which allows unattended reboots, fully-bypassing the decryption boot process."
http://www.pgp.com/products/wholediskencryption/
o BestCrypt supports AES, Blowfish, Twofish, GOST 28147-89, IDEA, CAST-128, Triple DES and DES, comes with a development kit and source code (not open source though, you can just audit it), hidden containers, swap encryption, Linux and Windows support and so on. See http://www.jetico.com/
If the answer is no:
Just encrypted certain files? EG: NTFS encryption using certificates (from AD for example)
• With Windows XP you can use X.509 certificates from Active Directory to encrypt & sign mails or use NTFS encryption. You can have your own RootCA (offline) and Subordinate CA right on your Windows 2003 server, and have a recovery center for employees who quit.
o This will allow them to _also_ encrypt files on their NTFS file system.
o basically they can encrypt files or folders
o EFS (NTFS feature) is good for just files
• TrueCrypt will allow you to encrypt a USB disk or another (Non-Boot) disk or a volume, using transparent full disk encryption, with keys or passwords, hidden volumes, plausible deniability, AES-256, Blowfish and Twofish support, etc.
o Free open-source disk encryption software for Windows Vista/XP/2000 and Linux
Main Features:
Creates a virtual encrypted disk within a file and mounts it as a real disk.
Encrypts an entire hard disk partition or a storage device such as USB flash drive.
Encryption is automatic, real-time (on-the-fly) and transparent.
Provides two levels of plausible deniability, in case an adversary forces you to reveal the password:
o 1) Hidden volume (steganography – more information may be found here).
o 2) No TrueCrypt volume can be identified (volumes cannot be distinguished from random data).
Encryption algorithms: AES-256, Serpent, and Twofish. Mode of operation: LRW.
o But you would have to either clear the swap file on shutdown (I recommend doing this with GPO) or disable it altogether (not recommended)….
o You would also want to place the Profile to the encrypted drive as well.
o This way would keep data confidential, provided that they keep the data on the encrypted disk.
o This would not clean browsing history and such, so you would need to set that up in the GPO as well.
o http://www.truecrypt.org
Check your BIOS on the laptops. Some laptops allow you to use the BIOS to control the HD bit locker password. If you fail to type it in, the HD will remain locked, and just return errors on every command to it.