BitLocker | KC's Blog

Encrypting Disks with BitLocker in PowerShell

Kent Chen — Fri, 23 Jun 2023 00:22:52 +0000

When I need to turn on BitLocker on either a system drive or an external USB drive, I usually just right-click the drive, choose Turn on BitLocker, and then follow the wizard. It works pretty well and does what I need. What I didn’t know is that there are a lot more options you can choose from when you do so using PowerShell.

For example, there is more than just one encryption method you can use. With -EncryptionMethod, you can specify one of 4 methods to encrypt your drive, AES128, AES258, XtsAes128, or XtsAes256.

Enable-BitLocker -MountPoint "c:" -EncryptionMethod Aes256 -RecoveryKeyPath "E:\Recovery\" -RecoveryKeyProtector

You can also enable BitLocker with a specified AD user account so that when a user accesses the encrypted drive, they will get prompted for credentials for that account.

Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes128 -AdAccountOrGroup "Western\SarahJones" -AdAccountOrGroupProtector

Have you ever wondered what is wrong with my BitLocker drive that has a warning sign?

Get-BitLockerVolume tells you everything.

Aha…it’s because the Protection is off. Let’s Resume-BitLocker it.

What’s my encrypted system drive’s recovery password?

(Get-bitlockervolume -MountPoint "C:").KeyProtector

Can I save it to Active Directory so I don’t have to keep the file? Sure thing.

Backup-BitLockerKeyProtector -MountPoint "C" -KeyProtectorId (Get-bitlockervolume -MountPoint "C:").KeyProtector[1].KeyProtectorId

But whoops, it says “Group Policy does not permit the storage of recovery information to Active Directory”. What to do?

There are two policies you will need to change here. Open the policy assigned to the GPO, and go to the following location.

Computer Configuration > Policies > Administrative Templates > Windows Components > BitLocker Drive Encryption

And enable the policy called Store BitLocker Recovery information in Active Directory Domain Services

Then go to one of the following sub-locations of BitLocker Drive Encryption, whichever one you would be using.

Fixed Data Drives
Operating System Drives
Removable Data Drives

And enable the policy called Choose how BitLocker-protected operating system drives can be recovered.

If it still doesn’t work, you may have to install the BitLocker management tools on the AD server.

Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools

With GPO configured to save the BitLocker keys to AD, we can enable BitLocker and save the keys directly to AD in PowerShell.

Add-BitLockerKeyProtector -MountPoint C: -RecoveryPasswordProtector | Out-Null
Enable-BitLocker -MountPoint C: -TpmProtector -EncryptionMethod Aes256 -SkipHardwareTest

The post Encrypting Disks with BitLocker in PowerShell first appeared on KC's Blog.

MDT – BitLocker Encrypting Failed

Kent Chen — Mon, 24 May 2021 07:14:00 +0000

One of the steps deploying a computer these days is to encrypt the disk by enabling BitLocker in the sequence. But I was getting an error message telling me that the encryption failed because

TPM Password missing. Please provide Password via TpmOwnerPassword or AdminPassword

Since none of the password is present in the sequence or the configuration file, the encryption wasn’t going through.

So where to put the these passwords so that the deploy sequence can go through without the problem?

In MDT’s DeploymentWorkbench, right-click the Deployment Share you have, and choose Properties.

Switch to Rules tab and add the following line under [Default] section.

TpmOwnerPassword=passphase

Click OK to save the setting, which saves the change to CustomSettings.ini file under Control folder in MDT deployment share folder.

Now try again and the encryption should go through.

Behind the scene, the TpmOwnerPassword is used during the TPM initialization process for encryption. However, since retaining ownership password is no longer a safe measure in BitLocker, it will be set to a random value in the latest Windows 10 builds. So, it seems that the TpmOwnerPassword is obsolete and no longer used. However, if it still prevents you from enabling BitLocker during the deployment, hope this one helps.

The post MDT – BitLocker Encrypting Failed first appeared on KC's Blog.

How To Unlock BitLocker Encrypted Disks in Windows Server 2012

Kent Chen — Sun, 10 Sep 2017 05:53:29 +0000

I have a BitLocker encrypted external drive that I needed to read from a Windows Server 2012. When I connected it to the server and right-click on the drive I don’t see the Unlock Drive option from the context menu like I usually see on my Windows 10 computer. So, what to do?

How to enable BitLocker encryption on Windows Server 2012

The reason I don’t see the Unlock Drive option is that the BitLocker feature is not enabled by default on a newly installed Windows Server 2012.

To enable the feature, open Server Manager and launch Add Roles and Features wizard.

Select BitLocker Drive Encryption option in Features stage and click Install.

It takes a few moment to get it installed. You will need to restart the server to have the change taken in place.

Once installed and restarted, you will see the Unlock Drive option appeared in the context menu.

And you will be able to unlock the drive by providing the password. If you need to access the same encrypted drive repeatedly, you can check “Automatically unlock on this PC” option.

The other way around this is to use the PowerShell cmdlet if you don’t want to enable BitLocker feature on the server.

The syntax of the cmdlet Unlock-BitLocker is something like this.

Unlock-BitLocker [-MountPoint]  -Password  [-WhatIf] [-Confirm] []

The post How To Unlock BitLocker Encrypted Disks in Windows Server 2012 first appeared on KC's Blog.