Bitlocker by group policy?

[FN-GM]

Hiya,

 

All our machines have TPM's and they are enabled and activated. By group policy how do I force the machines to encrypt please? I have been messing about and get this right.

 

Cheers

[sted]

i dont think you can force them to encrypt by gpo iirc you can just give them the settings for when they are. I suspect the answer is probably a powershell script

[FN-GM]

Thanks, does anyone else have any input please?

[koryo]

i dont think you can force them to encrypt by gpo iirc you can just give them the settings for when they are. I suspect the answer is probably a powershell script

 

OK that's a surprise - I wasn't aware of this and thought bitlocker could be enabled through GPO alone.

 

Have a read of the below - it's the Windows 7 Bitlocker deployment guide, and after a brief look it seems a WMI or CLI command is required. At least that's the impression I get taking a brief look at the getting ready for deployment section.

 

BitLocker Drive Encryption Deployment Guide for Windows 7

Edited October 27, 2014 by koryo

[sparkeh]

AFAIK you can only enforce Bitlocker settings via GPO, not actually kick off the encryption process.

[sted]

AFAIK you can only enforce Bitlocker settings via GPO, not actually kick off the encryption process.

 

you can force it on when imaging with mdt though iirc

[plexer]

Do you have SCCM in place?

 

Ben

[FN-GM]

Do you have SCCM in place?

 

Ben

 

I do, I know it can be done as a part of the image process. But I need a solution for existing machines.

 

What commands / scripts have people used to start the encryption.

Edited October 27, 2014 by FN-GM

[plexer]

Ok I know little of how SCCM operates are you not able to perform a task sequence on machines post imaging?

 

Ben

[FN-GM]

Ok I know little of how SCCM operates are you not able to perform a task sequence on machines post imaging?

 

Ben

 

But I need a solution for the existing machines. I don't want to go around imaging them all. The imaging side of things is already covered.

Edited October 27, 2014 by FN-GM

[plexer]

I never said re-image anything are you not able to allocate a standalone task sequence that just applies bitlocker and allocate it to those machines?

 

Ben

[cooka]

I don't think you can bitlocker using GP, but im pretty sure you can using SCCM

[jamesb]

If you've got Win8 or later, looks like there's a fairly simple PowerShell one-liner to kick it off: Enable-BitLocker

 

With the other commands (Get-BitLockerVolume) and a bit of handling in the script you should be able to put something together to kick it all off remotely.

 

If you've not got Win8 then you probably want to look at Manage-BDE instead: Manage-bde

 

Group policy will let you do most of the configuration, then one of the two commands above run remotely to actually kick off the encryption.

Edited October 28, 2014 by jamesb

[Arthur]

By group policy how do I force the machines to encrypt please?

If the encryption must be done via Group Policy, you're going to have to install and setup MBAM.

 

Otherwise you could use the BitLocker cmdlets included with Windows 8.1 (Enable-Bitlocker etc.). and run these via a Task Sequence as @plexer suggested or a script.