Enable bitlocker of C: automatically and save recovery key to specific locations

JOE TAM 86 Reputation points
2022-08-16T08:48:55.587+00:00

Dear sir,

Backgroup: 

Customer has 500 PC in Windows 10 Professional version:

They want to have a solution to perform below function:

  1. Allow join domain Windows 10 PC to enable bitlocker feature
  2. Enable C: of system drive encrypt automatically
  3. Generate bitlocker recovery kit and save into specify drive (e.g. C:\temp) Is it possible to perform all 3 tasks in GPO with any scripts? Or any methods can do without lot of manual work?

Regards,
Joe Tam

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,746 questions
Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,853 questions
Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,754 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,363 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Reza-Ameri 16,831 Reputation points
    2022-08-17T16:11:41.03+00:00

    It is recommended to save the BitLocker key in a safe place like inside the Active Directory, because if the hard disk fail or not accessible you will lose the key or at least backup it inside the Active Directory. Join domain and enable BitLocker is possible using the PowerShell and to save drive you may use Backup-BitLockerKeyProtector, have a look at:
    https://learn.microsoft.com/en-us/powershell/module/bitlocker/backup-bitlockerkeyprotector?view=windowsserver2022-ps

    0 comments