Windows Boot-up security & Logging

I'm trying to research into more ways of locking company devices down. From the worst case if they were ever stolen it would be hard for your average Jo to access anything and general access on day to day usage/privacy.

Currently using Bitlocker 256 on all HDD's.

Few questions:

1. I have a PC with 3 HDD's, can I password the D:\ and the G:\ to keep stored data separate. So if i walk away from the PC for a few minutes and don't Windows+L the drives are not accessed without a Password.

2. Boot-up, we have Pin's to access our logons. Is there any additional security we can add already built into 10 e.g 2 Step authentication.

3. Many years ago I used to have a flash drive with a few XP boot files on so if the drive was not in the PC it wouldn't boot. Is this a thing anymore, can you make a "Key" to access your Laptop/PC. Hopefully not the old way of moving files but something on the lines of a hashkey 10 looks for before booting passed Bios.

Regards,

MrColletive

1. Once the drives are unlocked in Windows with BitLocker they do not automatically re-lock - you need to educate your users to lock their workstations before leaving them or set the screensaver to come on after XX amount of time and enable the lock screen from that point.

2. You can set BitLocker to unlock with a USB "Token" - other than that there are plenty of third-party things available - for example I use: Two-Factor Authentication (2FA) Solutions | Secure Access | SafeNet


3. As per 2