Enabling Bitlocker encryption on domain computers

Question

Is there a way to automate full disk encryption with GPO on active directory users with TPM enabled??

Answer 1

Hello

Thank you for your question and reaching out.

Yes, If your client computers has TPM enabled you can archive this using GPO.

These settings are available in Local Group Policy Editor, under the section Administrative Templates > Windows Components > BitLocker Drive Encryption.

GPO contains a lot of settings, so we will highlight only those that are likely to be of major interest to MSPs:

Enable and allow network unlock at startup.
Ability to choose additional startup authentication.
Configure password settings and requirements. You can also configure passwords using a policy for removable drives.
Control access and usage of removable drives not protected by BitLocker.
Change hardware-based encryption settings for local drives.

Reference :

https://learn.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings

---------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Thank you for reaching out.

I have tried this method. But I have to manually enable BitLocker on every PC to start the encryption process. the GPO that I applied does not automatically make the encryption.