My boss just bought 2 Surface 3's for use here in a domain environment. They did not have bit locker turned on. I need to read up on how to use bit locker. I assume that I can assign a password to for bit locker. If bit locker is on, or files that are copied to an external source unencrypted? What if someone else breaks into the Surface with a logon or uses a utility to find the users password. If they find the users password and logs in, can they see the files or is their a second level of protection to prevent them for reading files.?