Enable Bitloacker on OS Volume from Command Line -unattended

Question

Hi,

I would like to enable Bitlocker Drive Encryption on Operating System Volume from command line in unattended method that do not require user input.

Here is what I have done so far, pleas let me know which stage I am doing it wrong or feel free to share your thoughts /methods if something is different from what I am trying now.

1. Group Policy <Require Additional Authentication at Startup> = Enabled

2. PowerShell <Add Key Protector>
   Add-BitLockerKeyProtector -MountPoint C: -Password ("MyPassword" | ConvertTo-SecureString -AsPlainText -
   Force) -PasswordProtector

but above command give me following error:

Answer 1

Try this:

$SecureString = ConvertTo-SecureString "1234" -AsPlainText -Force

Add-BitLockerKeyProtector -MountPoint "C:" -Pin $SecureString -TPMandPinProtector

Answer 2

Eventually it continue to work (no changes made)

But now when PC reboots, it say Bitloacker is not enabled:

Answer 3

Hello OSD

It sounds like you have checked several of the boxes that are required for BitLocker to be properly enabled. Could you validate if you have "PTT" enabled, or if this TPM is running in TPM 2.0 mode?

Have you attempted to "clear" the TPM within TPM.MSC?

Can you validate if you are also running within UEFI or Legacy BIOS mode? This can be found within MSinfo32 under "System Summary" in the "BIOS Mode" field.

We may also need to ensure that your BIOS is up to date. it may be beneficial to update your device to ensure that BIOS, as well as all relevant chipset drivers are fully up to date.

---

--If the reply is helpful, please Upvote and Accept as answer--

Answer 4

• TPM 2.0 , even tried with Clear the TPM.
• UEFI BIOS
• All latest patches