# Configure BitLocker

> Enables and configures BitLocker on a selected volume, including encryption method, protectors, recovery information handling and optional auto unlock for data volumes.

Source: https://docs.capaone.com/capaone/application-manager/powerbricks/bricks/configure-bitlocker/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

Enables and configures BitLocker on a selected volume, including encryption method, protectors, recovery information handling and optional auto unlock for data volumes.

## Parameters

#### Mount Point
*Required* — Default: `System Drive`

Selects the volume that BitLocker should protect. System Drive is the drive Windows is installed on and is the right choice on almost every device. Pick a specific drive letter only when you want to protect a data volume, for example D:. If the selected drive does not exist on the device, the brick fails. Allowed values: `System Drive`, `A:`, `B:`, `C:`, `D:`, `E:`, `F:`, `G:`, `H:`, `I:`, `J:`, `K:`, `L:`, `M:`, `N:`, `O:`, `P:`, `Q:`, `R:`, `S:`, `T:`, `U:`, `V:`, `W:`, `X:`, `Y:`, `Z:`.

#### Encryption Method
*Optional* — Default: `XTS-AES 256`

Selects the cipher used when BitLocker is enabled on the volume. Allowed values: `XTS-AES 128`, `XTS-AES 256`, `AES 128`, `AES 256`.

#### Used Space Only
*Optional* — Default: `True`

Encrypts only used sectors for a faster initial rollout. Disable to encrypt the full volume.

#### Skip Hardware Test
*Optional* — Default: `True`

Starts the encryption right away instead of first restarting the computer to test that the hardware can release the encryption key at start-up.  Enabled is the recommended setting. It is how the CapaBitLocker packages encrypt, and it lets a computer be encrypted in one run instead of waiting for a restart that may be hours away.  Disable it only if you want Windows to verify the hardware before any data is encrypted. The computer then has to be restarted before the encryption begins, and this brick ends with 'Cancel retry later' so the job runs again afterwards.

#### Wait For Encryption Completion
*Optional* — Default: `False`

Waits for BitLocker encryption to reach FullyEncrypted before the brick continues. Disable to continue immediately after encryption starts.

#### Use TPM Protector
*Optional* — Default: `True`

Protects the drive with the security chip built into the computer, so it unlocks by itself at start-up without anybody typing anything. This is the normal choice for the drive Windows is installed on.  If the security chip has not been taken into use yet, this brick prepares it before encrypting. That changes the computer: the chip gets an owner, and Windows is allowed to prepare it by itself in the future. Anything already protected by the chip is discarded, which on a computer that has never been encrypted means nothing.  Preparing the chip only takes effect after a restart, so the run ends with 'Cancel retry later' and the job runs again by itself. The computer is not restarted for you - add the 'Restart Computer' brick after this one if you want that to happen straight away. Until the computer has been restarted, every run ends the same way.  On a few computers the chip asks for the change to be confirmed on the machine itself at the next start-up, normally by pressing F12. Nobody sitting at the computer means nobody to confirm it, and the preparation then waits. The log says when this is the case.  Disable this only when the drive should be unlocked by something else, such as a startup key or a recovery password.

#### Startup Key Path
*Optional*

Optional folder path used for a startup key protector. Leave empty when not used.

#### Add Recovery Password Protector
*Optional* — Default: `True`

Creates a BitLocker recovery password protector so the volume can be recovered if normal protectors fail.

#### Recovery Key Path
*Optional*

Optional folder path where a .BEK recovery key protector should be created. Leave empty when not used.

#### Enable Auto Unlock
*Optional* — Default: `True`

Enables auto unlock for fixed data volumes. Ignored for the operating system volume.

#### Write Recovery Key To Active Directory
*Optional* — Default: `False`

Backs up the BitLocker recovery password to on-premises Active Directory. This requires AD DS permissions to create recovery information objects and can fail if the computer account lacks rights. Guidance: https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview

#### Write Recovery Key To Log
*Optional* — Default: `True`

Writes the BitLocker recovery password to the PowerBrick log. Enabled by default; disable when operational staff must not see the secret in logs.

## Details

- **Category:** Provisioning
- **Brick ID:** `BitLocker-Configure`

## Raw JSON definition

```json
{
  "category": "provisioning",
  "description": "Enables and configures BitLocker on a selected volume, including encryption method, protectors, recovery information handling and optional auto unlock for data volumes.",
  "developerVendor": "CapaSystems A/S",
  "displayName": null,
  "id": "BitLocker-Configure",
  "name": "Configure BitLocker",
  "parameters": [
    {
      "allowManualInput": false,
      "defaultValue": null,
      "defaultValueObject": {
        "id": "SystemDrive",
        "name": "System Drive"
      },
      "description": "Selects the volume that BitLocker should protect. System Drive is the drive Windows is installed on and is the right choice on almost every device. Pick a specific drive letter only when you want to protect a data volume, for example D:. If the selected drive does not exist on the device, the brick fails.",
      "id": "MountPoint",
      "name": "Mount Point",
      "regExValidation": "",
      "required": true,
      "type": "ComboBox",
      "value": null,
      "values": [],
      "valuesObject": [
        {
          "id": "SystemDrive",
          "name": "System Drive"
        },
        {
          "id": "A:",
          "name": "A:"
        },
        {
          "id": "B:",
          "name": "B:"
        },
        {
          "id": "C:",
          "name": "C:"
        },
        {
          "id": "D:",
          "name": "D:"
        },
        {
          "id": "E:",
          "name": "E:"
        },
        {
          "id": "F:",
          "name": "F:"
        },
        {
          "id": "G:",
          "name": "G:"
        },
        {
          "id": "H:",
          "name": "H:"
        },
        {
          "id": "I:",
          "name": "I:"
        },
        {
          "id": "J:",
          "name": "J:"
        },
        {
          "id": "K:",
          "name": "K:"
        },
        {
          "id": "L:",
          "name": "L:"
        },
        {
          "id": "M:",
          "name": "M:"
        },
        {
          "id": "N:",
          "name": "N:"
        },
        {
          "id": "O:",
          "name": "O:"
        },
        {
          "id": "P:",
          "name": "P:"
        },
        {
          "id": "Q:",
          "name": "Q:"
        },
        {
          "id": "R:",
          "name": "R:"
        },
        {
          "id": "S:",
          "name": "S:"
        },
        {
          "id": "T:",
          "name": "T:"
        },
        {
          "id": "U:",
          "name": "U:"
        },
        {
          "id": "V:",
          "name": "V:"
        },
        {
          "id": "W:",
          "name": "W:"
        },
        {
          "id": "X:",
          "name": "X:"
        },
        {
          "id": "Y:",
          "name": "Y:"
        },
        {
          "id": "Z:",
          "name": "Z:"
        }
      ]
    },
    {
      "allowManualInput": false,
      "defaultValue": null,
      "defaultValueObject": {
        "id": "XtsAes256",
        "name": "XTS-AES 256"
      },
      "description": "Selects the cipher used when BitLocker is enabled on the volume.",
      "id": "EncryptionMethod",
      "name": "Encryption Method",
      "regExValidation": "",
      "required": false,
      "type": "ComboBox",
      "value": null,
      "values": [],
      "valuesObject": [
        {
          "id": "XtsAes128",
          "name": "XTS-AES 128"
        },
        {
          "id": "XtsAes256",
          "name": "XTS-AES 256"
        },
        {
          "id": "Aes128",
          "name": "AES 128"
        },
        {
          "id": "Aes256",
          "name": "AES 256"
        }
      ]
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Encrypts only used sectors for a faster initial rollout. Disable to encrypt the full volume.",
      "id": "UsedSpaceOnly",
      "name": "Used Space Only",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Starts the encryption right away instead of first restarting the computer to test that the hardware can release the encryption key at start-up.\r\n\r\nEnabled is the recommended setting. It is how the CapaBitLocker packages encrypt, and it lets a computer be encrypted in one run instead of waiting for a restart that may be hours away.\r\n\r\nDisable it only if you want Windows to verify the hardware before any data is encrypted. The computer then has to be restarted before the encryption begins, and this brick ends with 'Cancel retry later' so the job runs again afterwards.",
      "id": "SkipHardwareTest",
      "name": "Skip Hardware Test",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "False",
      "defaultValueObject": null,
      "description": "Waits for BitLocker encryption to reach FullyEncrypted before the brick continues. Disable to continue immediately after encryption starts.",
      "id": "WaitForEncryptionCompletion",
      "name": "Wait For Encryption Completion",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Protects the drive with the security chip built into the computer, so it unlocks by itself at start-up without anybody typing anything. This is the normal choice for the drive Windows is installed on.\r\n\r\nIf the security chip has not been taken into use yet, this brick prepares it before encrypting. That changes the computer: the chip gets an owner, and Windows is allowed to prepare it by itself in the future. Anything already protected by the chip is discarded, which on a computer that has never been encrypted means nothing.\r\n\r\nPreparing the chip only takes effect after a restart, so the run ends with 'Cancel retry later' and the job runs again by itself. The computer is not restarted for you - add the 'Restart Computer' brick after this one if you want that to happen straight away. Until the computer has been restarted, every run ends the same way.\r\n\r\nOn a few computers the chip asks for the change to be confirmed on the machine itself at the next start-up, normally by pressing F12. Nobody sitting at the computer means nobody to confirm it, and the preparation then waits. The log says when this is the case.\r\n\r\nDisable this only when the drive should be unlocked by something else, such as a startup key or a recovery password.",
      "id": "TpmProtector",
      "name": "Use TPM Protector",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "",
      "defaultValueObject": null,
      "description": "Optional folder path used for a startup key protector. Leave empty when not used.",
      "id": "StartupKeyPath",
      "name": "Startup Key Path",
      "regExValidation": "",
      "required": false,
      "type": "TextBox",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Creates a BitLocker recovery password protector so the volume can be recovered if normal protectors fail.",
      "id": "RecoveryPasswordProtector",
      "name": "Add Recovery Password Protector",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "",
      "defaultValueObject": null,
      "description": "Optional folder path where a .BEK recovery key protector should be created. Leave empty when not used.",
      "id": "RecoveryKeyPath",
      "name": "Recovery Key Path",
      "regExValidation": "",
      "required": false,
      "type": "TextBox",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Enables auto unlock for fixed data volumes. Ignored for the operating system volume.",
      "id": "AutoUnlock",
      "name": "Enable Auto Unlock",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "False",
      "defaultValueObject": null,
      "description": "Backs up the BitLocker recovery password to on-premises Active Directory. This requires AD DS permissions to create recovery information objects and can fail if the computer account lacks rights. Guidance: https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview",
      "id": "WriteRecoveryKeyToActiveDirectory",
      "name": "Write Recovery Key To Active Directory",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Writes the BitLocker recovery password to the PowerBrick log. Enabled by default; disable when operational staff must not see the secret in logs.",
      "id": "WriteRecoveryKeyToLog",
      "name": "Write Recovery Key To Log",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    }
  ],
  "powershell": {
    "base64Encoded": true,
    "function": "ZnVuY3Rpb2..."
  },
  "type": "powerbrick",
  "version": "2026.9.15.1"
}
```