In the past, setting up both FileVault encrypted macOS/OS X and BitLocker encrypted Windows on a Mac with Boot Camp required manually configuring the disk partitions in a specific way to work around limitations in the MBR (Master Boot Record) partition scheme. This now works by default using Boot Camp Assistant provided you have the following:
- In this short video, i’m going to be discussing some changes to Boot Camp Assistant iv’e noticed in the new iteration of OS X. Leave a like if you enjoyed!
- Using Boot Camp with OS X El Capitan DISCUSSION When I still had Yosemite installed on my iMac, I was running Windows 10 in Boot Camp, but I wiped the Boot Camp partition in preparation for updating OS X from Yosemite to El Capitan.
- One serious bug should be considered when trying to do this. El Capitan boot camp assistant will fail to remove your Windows partition if you don't want that Windows installation. And you will likely end up with backing up your Mac OS X and format the whole disk to bring everything back to normal.
How to Dual Boot Windows 10 on Mac OS X El Capitan Brian Fisher updated on 2021-09-18 09:49:15 Not only has Apple been diligently working on a new OS, El Capitan, but Microsoft isn’t too far behind, either.
- a Mac that supports booting Windows in EFI mode (all Mac computers that support Windows 10)
- Boot Camp Assistant 6 or later (included in OS X El Capitan or later, and OS X Yosemite via update)
- Windows 8 or later
This is due to Boot Camp Assistant 6 using a different method to create the Boot Camp partition to support EFI booting for Windows 8 or later. The best explanation I have found is in the article How El Capitan Boot Camp is Affected by Apple’s New System Integrity Protection (SIP):
Modern Macs always boot via EFI, but Windows hardware has only recently started natively booting EFI. While there was some support for EFI booting Windows 7, Apple didn’t support EFI booting Windows until Windows 8. With the newest Apple hardware, Windows 8 or later is required, and EFI booting is the only way that Windows will boot on the Mac.
Usually you don’t have to worry about any of this, since Boot Camp Assistant and the Windows installer will set everything up correctly.
If you use Boot Camp Assistant to create the Boot Camp partition, you’ll get a standard EFI “guard” MBR
The hybrid MBR has an entry for each of the first 4 partitions. The guard MBR has only a single entry that covers the entire disk
Boot Camp El Capitan
The key that allows having both FileVault and BitLocker is Boot Camp Assistant creating a “guard” MBR with only a single entry.
Why this didn’t work previously
Older versions of Boot Camp Assistant create a hybrid MBR to support running Windows 7 and earlier in legacy BIOS mode. The MBR partition scheme, however, has a limit of four primary partitions, and the hybrid MBR set up by Boot Camp Assistant uses all four.
As BitLocker requires a second partition, a hybrid MBR set up by Boot Camp Assistant has no spare partitions available for BitLocker.
Two partitions are required to run BitLocker because pre-startup authentication and system integrity verification must occur on a separate partition from the encrypted operating system drive. This configuration helps protect the operating system and the information in the encrypted drive.
—BitLocker frequently asked questions (FAQ)
Previous solutions worked around this by setting up the MBR manually.
Macs that support booting Windows in EFI mode
The Boot Camp Assistant configuration file (/Applications/Utilities/Boot Camp Assistant.app/Contents/Info.plist) provides an indication as to which Mac models are supported:
According to this, Macs with a model identifier higher than those listed above will be set up to boot Windows in EFI mode.
This matches Apple’s official list of Mac computers that support Windows 10.
Note: Apple’s list of Mac models you can use with Windows 8.1 includes older models. Presumably, these will be set up in legacy mode.
Configuring BitLocker on a Mac
BitLocker encryption normally requires a computer with a Trusted Platform Module (TPM). As Macs don’t have a TPM, the other requirement is to configure Windows to allow BitLocker without one:
Conclusion
On recent Macs, the combination of Boot Camp Assistant and allowing BitLocker without a TPM is all that is required to have both FileVault encrypted macOS/OS X and BitLocker encrypted Windows.
Some very interesting changes in how Windows is installed in Boot Camp on OS X 10.11 “El Capitan”. When you open Boot Camp Assistant on a new Mac that supports Windows 8 or later, you’ll get the new Boot Camp interface.
Notice the ISO image and partitioning are all on a single screen. Prior to El Capitan, you had to insert a USB Flash Drive and Boot Camp Assistant copied the Windows installer from an ISO disk image to the flash drive, and then downloaded and set up the Windows drivers to the correct location in the installer for the Mac hardware. El Capitan makes this a lot simpler. Just select the ISO and how much space you want from Boot Camp, and then you click Install.
After Boot Camp Assistantd completes, OS X restarts to the Windows installer, and you follow the normal Windows installation.
Behind the Scenes
So how is this possible? Where is the Windows installer if there is no installation media? Boot Camp Assistant doesn’t just create a Boot Camp partition, but also creates an additional partition called “OSXRESERVED” that is FAT32 formatted. It places this partition right after the recovery partition, and before the Boot Camp partition, as shown below.
The command line make this really clear. Partition 1 is the standard EFI partition, partition 2 is the Mac partition, partition 3 is the Recovery partition. All standard stuff. Partition 4 is now the OSXRESERVED partition, and partition 5 is the BOOTCAMP partition. You’ll also notice that disk2 is the Windows install ISO disk image that the Windows install files are copied from.
The OSXRESERVED partition has all the installer files, the Boot Camp drivers for Windows, and the EFI files for booting.
If you are familiar with EFI booting on OS X, you’ll see a familiar setup. The EFI folder on the OSXRESERVED partition is the same one you would normally find on the EFI partition (normally disk0s1). It appears that newer Macs have the ability to detect this partition and present it to Windows as if it were EFI installation media (such as a DVD or USB Flash drive).
So what happens to this partition after you are done installing? During the next boot into OS X, the OSXRESERVED partition is removed and put back into the Core Storage container of the OS X partition:
Note that the Device is disk0s5 since the other partition existed on startup, but then it was deleted. On next reboot, this device will change back to disk0s4, which is the standard device location for a Boot Camp partition.
This setup is not supported on all Macs that run El Capitan. Only hardware that has newer firmware supports this. We did a survey of all the shipping Macs, and here are the ones that support this new slicker setup:
Boot Camp El Capitan
Supported:
- Mac Pro
- MacBook Air 13‑inch
- MacBook Air 11‑inch
- MacBook Pro 13‑inch
- MacBook Pro 15‑inch
Older USB Installation
- iMac 21.5″
- iMac 27″
- MacBook Pro 13‑inch
- USB-C MacBook (surprising)
El Capitan Camp Santa Barbara
El Capitan’s Boot Camp-related updates are not just limited to Boot Camp Assistant. There are also changes in how Boot Camp is affected by the new System Integrity Protection (SIP). Tune in tomorrow for the next segment.
Boot Camp Mac El Capitan
Do you have Windows running on your Mac in a Boot Camp partition? Check out Winclone and Boot Runner to backup, migrate, and manage your Boot Camp partition.
Find this article interesting? Let me know what you think by tweeting at me on Twitter: @tperfitt