# CapaBitLocker v4.0 - Variables

> The CapaBitLocker variables you can set, including which drives to encrypt and where recovery keys are saved.

Source: https://docs.capaone.com/capainstaller/capabitlocker/capabitlocker-v4-0/capabitlocker-v4-0-variables/  
Product: CapaInstaller — a separate CapaSystems product; do not apply this page to any other.

*CapaBitLocker v4.0 released on December 16, 2022*

---

### BitLocker variables

<details>
<summary>gsDrivesToEncrypt / gsDrivesToDecrypt</summary>

The variable value can be *All* or *System*

`Default setting = All (recommended)`

*All* = All fixed drives are encrypted/decrypted

*System* = Only the operating system drive is encrypted/decrypted

![Disk Management showing Disk 0 with a GPT system drive C, Disk 1 with MBR data drives D and E, and Disk 2 with GPT data drive F](/attachments/capainstaller/capabitlocker-disk-management.png)
*Disk Management*

![Log output for the System setting: only drive C will be encrypted, 1 drive will be encrypted](/attachments/capainstaller/capabitlocker-drives-to-encrypt-system.png)
*System*

![Log output for the All setting: drives C and F will be encrypted, drives D and E are MBR based and cannot be encrypted](/attachments/capainstaller/capabitlocker-drives-to-encrypt-all.png)
*All*

</details>

<details>
<summary>gbFailPackageOnError</summary>

The variable value can be *True* or *False*

`Default setting = False (recommended)`

*True* = Package status will be set to *Failed* in the CapaInstaller Console, when the first non-critical error is detected

*False* = Package status will be set to *Installed* in the CapaInstaller Console, when non-critical errors are detected

In the example below, an error is written to the logfile, because gbFailPackageOnError is set to **True**

![Log output ending in a highlighted ERROR line: One or more drives will not be encrypted](/attachments/capainstaller/capabitlocker-fail-on-error-true-log.png)
*True*

![CapaInstaller Console showing CapaBitLocker - Encrypt Drives v4.0 with status Failed](/attachments/capainstaller/capabitlocker-fail-on-error-true-console.png)
*CapaInstaller Console View*

In the example below, a warning is written to the logfile, because gbFailPackageOnError is set to **False**

![Log output ending in a highlighted WARNING line: One or more drives will not be encrypted](/attachments/capainstaller/capabitlocker-fail-on-error-false-log.png)
*False*

![CapaInstaller Console showing CapaBitLocker - Encrypt Drives v4.0 with status Installed](/attachments/capainstaller/capabitlocker-fail-on-error-false-console.png)
*CapaInstaller Console View*

</details>

<details>
<summary>gbMaskSensitiveData</summary>

The variable value can be *True* or *False*

`Default setting = True (recommended)`

*True* = The last 4 digits of the Recovery Key ID and the Recovery Key Password is replaced with asterisk characters in the log file located on the endpoint

*False* = The full value of the Recovery Key ID and the Recovery Key Password is visible in the log file located on the endpoint

![Log output where the last four digits of the recovery password ID and password are replaced with asterisks](/attachments/capainstaller/capabitlocker-mask-sensitive-data-true.png)
*True*

</details>

<details>
<summary>gbSaveRecoveryKeyInActiveDirectory</summary>

The variable value can be *True* or *False*

`Default setting = True (recommended)`

*True* = Recovery Key is saved in Active Directory

*False* = Recovery Key is not saved in Active Directory

![Log output confirming the recovery password was successfully saved in Active Directory](/attachments/capainstaller/capabitlocker-save-recovery-key-ad-true.png)
*True*

💡 CapaBitLocker automatically detects if the domain is available before saving the recovery key in Active Directory.

</details>

<details>
<summary>gbSaveRecoveryKeyInCapaInstaller</summary>

The variable value can be *True* or *False*

`Default setting = True (recommended)`

*True* = Recovery Key is saved in CapaInstaller Custom Inventory

*False* = Recovery Key is not saved in CapaInstaller Custom Inventory

![Log output confirming the recovery password was saved in CapaInstaller](/attachments/capainstaller/capabitlocker-save-recovery-key-capainstaller-true.png)
*True*

</details>

<details>
<summary>gbWaitForEncryptionToComplete / gbWaitForDecryptionToComplete</summary>

The variable value can be *True* or *False*

`Default setting = True`

*True* = Package will wait for encryption of drives to finish, before changing status to Installed

*False* = Package will initiate encryption of drives and change status to Installed afterwards

![Log output tracking encryption of drive C from 4% to 100%, after saving the recovery password in Active Directory and CapaInstaller](/attachments/capainstaller/capabitlocker-wait-for-encryption.png)

💡 All recovery keys are saved and auto-unlock on data drives are enabled, immediately after drive encryption has been initiated.

</details>

<details>
<summary>giRebootCount</summary>

The variable value can be a number between 0 and 10

`Default setting = 1`

0 = BitLocker is suspended infinitely and must be resumed manually

1-10 = BitLocker is suspended until the specified number of reboots has been performed

💡 BitLocker is suspended instantly.

</details>

---

### Common variables

<details>
<summary>gsIpAddressesToExclude</summary>

The variable value can be a full or a partial IPv4 address on endpoints that should be excluded.

`Default setting = ""`

The \* character must be used as a wildcard, when defining partial IPv4 addresses.

The , character must be used when defining multiple IPv4 addresses.

Example: `192.168.100.*,192.168.101.*`

</details>

<details>
<summary>gsGatewayAddressesToExclude</summary>

The variable value can be a full or a partial IPv4 address on gateways that should be excluded.

`Default setting = ""`

The \* character must be used as a wildcard, when defining partial IPv4 addresses.

The , character must be used when defining multiple IPv4 addresses.

Example: `192.168.100.*,192.168.101.*`

</details>

<details>
<summary>gsDeviceNamesToExclude</summary>

The variable value can be the NetBIOS name of endpoints that should be excluded.

`Default setting = ""`

The , character must be used when defining multiple endpoints.

</details>

<details>
<summary>gsHardwareModelsToExclude</summary>

The variable value can be the name of the hardware models that should be excluded.

`Default setting = ""`

The hardware model name is matched with the "System Model" value from the "SysInfo" command.

The , character must be used when defining multiple endpoints.

</details>

<details>
<summary>gbRequirePowerConnection</summary>

The variable value can be *True* or *False*

`Default setting = True`

*True* = External power connection is required

*False* = External power connection is not required

💡 This setting only affects laptops.

</details>

<details>
<summary>gbDisableCustomInventoryCollection</summary>

The variable value can be *True* or *False*

`Default setting = False`

*True* = Custom inventory is not collected during package execution **(not recommended)**

*False* = Custom inventory is collected during package execution

</details>