What are the methods and procedures for securing travel laptops in a domain?

Question

System administration

Good afternoon everyone!
There is a task to ensure the information security of business laptops.
We have an infrastructure based on the 2012 r2 domain and using VPN channels based on CISCO.
Laptop fleet: win 7, win 8.1.
Services are used: jabber, corp. portal, mail, crm, sed and shared folders.
Users travel around the CIS and Europe, so they use networks whenever possible. I would like to hear the regulations that you use to ensure security in similar or similar cases.
PS Well, or just tips and ideas that you may have)) From our

Answer 1

1) The first method is to encrypt beeches, covers the risks of loss / theft, etc. For example, diskcryptor or Windows something - for an amateur
2) Backdoor for the ability to delete info \ distraction of a beech a la ptraffer.ru/analiz-trafika/70-control-monitor
Other questions or the first paragraph continue or the second, so to speak

Answer 2

VMware Horizon FLEX

Answer 3

To the first point said mace-ftl diskcryptor 1. I do not know if it supports the possibility of a recovery key when entering a password multiple times and then locking it. For example, bitlocker can leave password recovery keys in AD, in case the user has blocked it himself or not, or the usb key carrier has failed if manual password entry is not used. 2. I also recommend using one-time passwords for the built-in administrator account, but valid for a certain time.

Answer 4

First.
I support the previous comments about protecting the HDD by encryption.
I recommend the SafeGuard Encryption product from Sophos. Block after x attempts, login only for pre-authorized users, etc.
Second.
These are information security policies for employees, which describe the rules of behavior outside the office (business trip, home), etc.