Enable Bitlocker

[petben]

I have created a GPO to set Bitlocker settings for the OS drive, saving the key to AD. I then run a command to enable Bitlocker if not already enabled.

 

Enable-BitLocker -MountPoint C: -SkipHardwareTest -RecoveryPasswordProtector

 

This works fine and a key is written to AD.

 

Last bit of testing I put the enable command in a startup script (rather than testing when logged in) but it hangs with error:

 

add-tpmprotectorinternal a required priveledge is not held by the client

 

 

Maybe I am enabling Bitlocker wrong? How you doing it?

 

Thanks

[mavhc]

I've not needed to actually run the command if the gpo settings say encrypt the drive (assuming it's able to, check event viewer>applications>microsoft>windows>bitlocker*

[LeMarchand]

Bit of a long shot, as I think it would also affect the way you have it working, but have you got these 2 GPOs set?

 

 

I haven't had to do a Bitlocker setup for years as it happens as part of our "new machine" config.

[petben]

Thanks, I will check those TPM GPO.

 

Mavhc - can you please post what the actual GPO setting is to enable bitlocker, maybe I’ve missed something. If you have the time a couple of screenshots of the general Bitlocker GPO and the Operating system drive bitlocker settings would be really great.

[jthompson]

I've found that some of our models encrypt automatically according to GPO, but other don't and need to have encryption started manually. I did dig into the finer details of it (msinfo32?) and IIRC it was something to do with chipsets supporting Credential Guard or not.

[petben]

I’ve read an article that suggests a run once scheduled task, and that was the only way they got it encrypted initially.

[CHiLL]

We were previously using Microsoft BitLocker Administration and Monitoring (MBAM) from the Microsoft Desktop Optimization Pack, though I understand that extended support will end for that in April 2026. We currently still deploy the MBAM client to initiate and enforce the BitLocker process, but we migrated away from using the MBAM database and moved it into SCCM for more central management. The BitLocker configurations are specified in SCCM under "Assets and Compliance > Overview > Endpoint Protection > BitLocker Management". I don't actually know if we still need the MBAM client deploying to clients or not though, or whether this SCCM configuration will enforce it without the client...but it works as it is atm with SCCM and the MBAM client, so that's how I've left it.

[mavhc]

Windows Components/BitLocker Drive Encryption

Disable new DMA devices when this computer is locked: Enabled

Prevent memory overwrite on restart: Disabled

Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista): Enabled

Require BitLocker backup to AD DS: Enabled

Select BitLocker recovery information to store: Recovery passwords and key packages

 

Windows Components/BitLocker Drive Encryption/Fixed Data Drives

Choose how BitLocker-protected fixed drives can be recovered: Enabled

Allow data recovery agent: Enabled

Configure user storage of BitLocker recovery information:

Allow 48-digit recovery password

Allow 256-bit recovery key

Omit recovery options from the BitLocker setup wizard: Enabled

Save BitLocker recovery information to AD DS for fixed data drives: Enabled

Configure storage of BitLocker recovery information to AD DS: Backup recovery passwords and key packages

Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives: Enabled

 

Configure use of hardware-based encryption for fixed data drives: Enabled

Use BitLocker software-based encryption when hardware encryption is not available: Enabled

Restrict encryption algorithms and cipher suites allowed for hardware-based encryption: Disabled

Deny write access to fixed drives not protected by BitLocker: Enabled

 

Windows Components/BitLocker Drive Encryption/Operating System Drives

Allow network unlock at startup: Enabled

Allow Secure Boot for integrity validation: Enabled

Choose how BitLocker-protected operating system drives can be recovered: Enabled

Allow data recovery agent: Enabled

Configure user storage of BitLocker recovery information:

Allow 48-digit recovery password

Allow 256-bit recovery key

Omit recovery options from the BitLocker setup wizard: Enabled

Save BitLocker recovery information to AD DS for operating system drives: Enabled

Configure storage of BitLocker recovery information to AD DS: Store recovery passwords and key packages

Do not enable BitLocker until recovery information is stored to AD DS for operating system drives: Enabled

 

Configure use of hardware-based encryption for operating system drives: Enabled

Use BitLocker software-based encryption when hardware encryption is not available: Enabled

Restrict encryption algorithms and cipher suites allowed for hardware-based encryption: Disabled

 

Disallow standard users from changing the PIN or password: Enabled

 

Windows Components/BitLocker Drive Encryption/Removable Data Drives

Configure use of hardware-based encryption for removable data drives: Enabled

Use BitLocker software-based encryption when hardware encryption is not available: Enabled

Restrict encryption algorithms and cipher suites allowed for hardware-based encryption: Disabled

 

Control use of BitLocker on removable drives: Enabled

Allow users to apply BitLocker protection on removable data drives: Enabled

Allow users to suspend and decrypt BitLocker protection on removable data drives: Disabled

 

Deny write access to removable drives not protected by BitLocker: Enabled

Do not allow write access to devices configured in another organization: Enabled