Enable-BitLocker

Syntax

Enable-BitLocker
      [-MountPoint] <String[]>
      -PasswordProtector
      [-Password] <SecureString>[-EncryptionMethod <BitLockerVolumeEncryptionMethodOnEnable>]
      [-HardwareEncryption][-SkipHardwareTest]
      [-UsedSpaceOnly][-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Enable-BitLocker
      [-MountPoint] <String[]>
      -RecoveryPasswordProtector
      [[-RecoveryPassword] <String>][-EncryptionMethod <BitLockerVolumeEncryptionMethodOnEnable>]
      [-HardwareEncryption][-SkipHardwareTest]
      [-UsedSpaceOnly]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Enable-BitLocker
      [-MountPoint] <String[]>
      -StartupKeyProtector
      [-StartupKeyPath] <String>[-EncryptionMethod <BitLockerVolumeEncryptionMethodOnEnable>]
      [-HardwareEncryption][-SkipHardwareTest]
      [-UsedSpaceOnly]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Enable-BitLocker
      [-MountPoint] <String[]>
      -TpmAndStartupKeyProtector
      [-StartupKeyPath] <String>[-EncryptionMethod <BitLockerVolumeEncryptionMethodOnEnable>]
      [-HardwareEncryption][-SkipHardwareTest]
      [-UsedSpaceOnly]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Enable-BitLocker
      [-MountPoint] <String[]>
      -TpmAndPinAndStartupKeyProtector
      -StartupKeyPath <String>[-Pin] <SecureString>
      [-EncryptionMethod <BitLockerVolumeEncryptionMethodOnEnable>][-HardwareEncryption]
      [-SkipHardwareTest]
      [-UsedSpaceOnly]
      [-WhatIf]
      [-Confirm][<CommonParameters>]

Enable-BitLocker
      [-MountPoint] <String[]>
      -AdAccountOrGroupProtector
      [-AdAccountOrGroup] <String>[-Service]
      [-EncryptionMethod <BitLockerVolumeEncryptionMethodOnEnable>]
      [-HardwareEncryption][-SkipHardwareTest]
      [-UsedSpaceOnly]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Enable-BitLocker
      [-MountPoint] <String[]>
      -TpmAndPinProtector
      [-Pin] <SecureString>[-EncryptionMethod <BitLockerVolumeEncryptionMethodOnEnable>]
      [-HardwareEncryption][-SkipHardwareTest]
      [-UsedSpaceOnly]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Enable-BitLocker
      [-MountPoint] <String[]>
      -TpmProtector[-EncryptionMethod <BitLockerVolumeEncryptionMethodOnEnable>]
      [-HardwareEncryption][-SkipHardwareTest]
      [-UsedSpaceOnly]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Enable-BitLocker
      [-MountPoint] <String[]>
      -RecoveryKeyProtector
      [-RecoveryKeyPath] <String>[-EncryptionMethod <BitLockerVolumeEncryptionMethodOnEnable>]
      [-HardwareEncryption][-SkipHardwareTest]
      [-UsedSpaceOnly]
      [-WhatIf]
      [-Confirm]
      [<CommonParameters>]

Description

The Enable-BitLocker cmdlet enables BitLocker Drive Encryption for a volume.

When you enable encryption, you must specify a volume, either by its drive letter or by its BitLocker volume object.

You must also establish a key protector. BitLocker uses a key protector to encrypt the volume encryption key. When a user accesses a BitLocker encrypted drive, such as when starting a computer, BitLocker requests the relevant key protector. For example, the user can enter a PIN or provide a USB drive that contains a key. BitLocker decrypts the encryption key and uses it to read data from the drive. You can use one of the following methods or combinations of methods for a key protector:

• Trusted Platform Module (TPM): BitLocker uses the computer's TPM to protect the encryption key. If you select this key protector, users can access the encrypted drive as long as it is connected to the system board that hosts the TPM and system boot integrity is intact. In general, TPM-based protectors can only be associated to an operating system volume.

• TPM and Personal Identification Number (PIN): BitLocker uses a combination of the TPM and a user-supplied PIN. A PIN is four to twenty digits or, if you allow enhanced PINs, is four to twenty letters, symbols, spaces, or numbers.

• TPM, PIN, and startup key: BitLocker uses a combination of the TPM, a user-supplied PIN, and input from of a USB memory device that contains an external key.

• TPM and startup key: BitLocker uses a combination of the TPM and a USB flash drive that contains the external key.

• Startup key: BitLocker uses a USB flash drive that contains the external key.

• Password: BitLocker uses a password.

• Recovery key: BitLocker uses a recovery key stored as a specified file.

• Recovery password: BitLocker uses a recovery password.

• Active Directory Domain Services (AD DS) account: BitLocker uses domain authentication.

You can specify only one of these methods or combinations when you enable encryption, but you can use the Add-BitLockerKeyProtector cmdlet to add other protectors.

For a password or PIN key protector, specify a secure string. You can use the ConvertTo-SecureString cmdlet to create a secure string. You can use secure strings in a script and still maintain confidentiality of passwords.

We strongly recommend specifying the encryption method. By default, BitLocker uses XTS-AES-128. You can opt XTS-AES-256 for stronger security. However, if you are encrypting a removable media and intend to use it on Windows 8.1 or Windows Server 2012 R2, you must opt either AES-128 or AES-256 for backward compatibility. You may request hardware encryption but we strongly advise against it. For further guidance, see the ADV180028 Security Advisory.

This cmdlet returns a BitLocker volume object. If you choose recovery password as your key protector but do not specify a 48-digit recovery password, this cmdlet generates a random one for you, and stores it in the RecoveryPassword field of the KeyProtector attribute of the BitLocker volume object.

If you use startup key or recovery key as part of your key protector, provide a path to store the key. This cmdlet stores the name of the file that contains the key in the KeyFileName field of the KeyProtector field in the BitLocker volume object.

If you use the Enable-BitLocker cmdlet on an encrypted volume or on a volume with encryption in process, it takes no action. If you use the cmdlet on a drive that has encryption paused, it resumes encryption on the volume.

By default, this cmdlet encrypts the entire drive. If you use the UsedSpaceOnly parameter, it only encrypts the used space on the disk. This option can significantly reduce encryption time.

It is common practice to add a recovery password for an operating system volume using the Add-BitLockerKeyProtector cmdlet, save the recovery password using the Backup-BitLockerKeyProtector cmdlet, and then enable BitLocker on that volume. This procedure ensures that you have a recovery option.

For an overview of BitLocker, see the BitLocker Drive Encryption Overview.

Examples

Example 1: Enable BitLocker

$SecureString = ConvertTo-SecureString "1234" -AsPlainText -Force
Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -UsedSpaceOnly -Pin $SecureString -TPMandPinProtector

This example enables BitLocker for a specified drive using the TPM and a PIN for key protector.

The first command uses the ConvertTo-SecureString cmdlet to create a secure string that contains a PIN and saves that string in the $SecureString variable. For more information about the ConvertTo-SecureString cmdlet, type Get-Help ConvertTo-SecureString.

The second command enables BitLocker encryption for the BitLocker volume that has the drive letter C:. The cmdlet specifies an encryption algorithm and the PIN saved in the $SecureString variable. The command also specifies that this volume uses a combination of the TPM and the PIN as key protector. The command also specifies to encrypt the used space data on the disk, instead of the entire volume. When the system writes data to the volume in the future, that data is encrypted.

Example 2: Enable BitLocker with a recovery key

Get-BitLockerVolume | Enable-BitLocker -EncryptionMethod Aes128 -RecoveryKeyPath "E:\Recovery\" -RecoveryKeyProtector

This command gets all the BitLocker volumes for the current computer and passes pipes them to the Enable-BitLocker cmdlet by using the pipe operator. This cmdlet specifies an encryption algorithm for the volume or volumes. This cmdlet specifies a path to a folder where the randomly generated recovery key will be stored and indicates that these volumes use a recovery key as a key protector.

Example 3: Enable BitLocker with a specified user account

Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes128 -AdAccountOrGroup "Western\SarahJones" -AdAccountOrGroupProtector

This command encrypts the BitLocker volume specified by the MountPoint parameter, and uses the AES 128 encryption method. The command also specifies an account and specifies that BitLocker uses user credentials as a key protector. When a user accesses this volume, BitLocker prompts for credentials for the user account Western\SarahJones.

Parameters

-AdAccountOrGroup

-AdAccountOrGroupProtector

-Confirm

-EncryptionMethod

-HardwareEncryption

-MountPoint

-Password

-PasswordProtector

-Pin

-RecoveryKeyPath

-RecoveryKeyProtector

-RecoveryPassword

-RecoveryPasswordProtector

-Service

-SkipHardwareTest

-StartupKeyPath

-StartupKeyProtector

-TpmAndPinAndStartupKeyProtector

-TpmAndPinProtector

-TpmAndStartupKeyProtector

-TpmProtector

-UsedSpaceOnly

-WhatIf

Inputs

BitLockerVolume[], String[]

Outputs

BitLockerVolume[]

Related Links

• Disable-BitLocker
• Get-BitLockerVolume
• Lock-BitLocker
• Resume-BitLocker
• Suspend-BitLocker
• Unlock-BitLocker