Configure BitLocker
Enables and configures BitLocker on a selected volume, including encryption method, protectors, recovery information handling and optional auto unlock for data volumes.
Parameters
Section titled “Parameters”Mount Point
Section titled “Mount Point”Required — Default: System Drive
Selects the volume that BitLocker should protect. System Drive is the drive Windows is installed on and is the right choice on almost every device. Pick a specific drive letter only when you want to protect a data volume, for example D:. If the selected drive does not exist on the device, the brick fails. Allowed values: System Drive, A:, B:, C:, D:, E:, F:, G:, H:, I:, J:, K:, L:, M:, N:, O:, P:, Q:, R:, S:, T:, U:, V:, W:, X:, Y:, Z:.
Encryption Method
Section titled “Encryption Method”Optional — Default: XTS-AES 256
Selects the cipher used when BitLocker is enabled on the volume. Allowed values: XTS-AES 128, XTS-AES 256, AES 128, AES 256.
Used Space Only
Section titled “Used Space Only”Optional — Default: True
Encrypts only used sectors for a faster initial rollout. Disable to encrypt the full volume.
Skip Hardware Test
Section titled “Skip Hardware Test”Optional — Default: True
Starts the encryption right away instead of first restarting the computer to test that the hardware can release the encryption key at start-up. Enabled is the recommended setting. It is how the CapaBitLocker packages encrypt, and it lets a computer be encrypted in one run instead of waiting for a restart that may be hours away. Disable it only if you want Windows to verify the hardware before any data is encrypted. The computer then has to be restarted before the encryption begins, and this brick ends with ‘Cancel retry later’ so the job runs again afterwards.
Wait For Encryption Completion
Section titled “Wait For Encryption Completion”Optional — Default: False
Waits for BitLocker encryption to reach FullyEncrypted before the brick continues. Disable to continue immediately after encryption starts.
Use TPM Protector
Section titled “Use TPM Protector”Optional — Default: True
Protects the drive with the security chip built into the computer, so it unlocks by itself at start-up without anybody typing anything. This is the normal choice for the drive Windows is installed on. If the security chip has not been taken into use yet, this brick prepares it before encrypting. That changes the computer: the chip gets an owner, and Windows is allowed to prepare it by itself in the future. Anything already protected by the chip is discarded, which on a computer that has never been encrypted means nothing. Preparing the chip only takes effect after a restart, so the run ends with ‘Cancel retry later’ and the job runs again by itself. The computer is not restarted for you - add the ‘Restart Computer’ brick after this one if you want that to happen straight away. Until the computer has been restarted, every run ends the same way. On a few computers the chip asks for the change to be confirmed on the machine itself at the next start-up, normally by pressing F12. Nobody sitting at the computer means nobody to confirm it, and the preparation then waits. The log says when this is the case. Disable this only when the drive should be unlocked by something else, such as a startup key or a recovery password.
Startup Key Path
Section titled “Startup Key Path”Optional
Optional folder path used for a startup key protector. Leave empty when not used.
Add Recovery Password Protector
Section titled “Add Recovery Password Protector”Optional — Default: True
Creates a BitLocker recovery password protector so the volume can be recovered if normal protectors fail.
Recovery Key Path
Section titled “Recovery Key Path”Optional
Optional folder path where a .BEK recovery key protector should be created. Leave empty when not used.
Enable Auto Unlock
Section titled “Enable Auto Unlock”Optional — Default: True
Enables auto unlock for fixed data volumes. Ignored for the operating system volume.
Write Recovery Key To Active Directory
Section titled “Write Recovery Key To Active Directory”Optional — Default: False
Backs up the BitLocker recovery password to on-premises Active Directory. This requires AD DS permissions to create recovery information objects and can fail if the computer account lacks rights. Guidance: https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview
Write Recovery Key To Log
Section titled “Write Recovery Key To Log”Optional — Default: True
Writes the BitLocker recovery password to the PowerBrick log. Enabled by default; disable when operational staff must not see the secret in logs.
Details
Section titled “Details”- Category: Provisioning
- Brick ID:
BitLocker-Configure
{ "category": "provisioning", "description": "Enables and configures BitLocker on a selected volume, including encryption method, protectors, recovery information handling and optional auto unlock for data volumes.", "developerVendor": "CapaSystems A/S", "displayName": null, "id": "BitLocker-Configure", "name": "Configure BitLocker", "parameters": [ { "allowManualInput": false, "defaultValue": null, "defaultValueObject": { "id": "SystemDrive", "name": "System Drive" }, "description": "Selects the volume that BitLocker should protect. System Drive is the drive Windows is installed on and is the right choice on almost every device. Pick a specific drive letter only when you want to protect a data volume, for example D:. If the selected drive does not exist on the device, the brick fails.", "id": "MountPoint", "name": "Mount Point", "regExValidation": "", "required": true, "type": "ComboBox", "value": null, "values": [], "valuesObject": [ { "id": "SystemDrive", "name": "System Drive" }, { "id": "A:", "name": "A:" }, { "id": "B:", "name": "B:" }, { "id": "C:", "name": "C:" }, { "id": "D:", "name": "D:" }, { "id": "E:", "name": "E:" }, { "id": "F:", "name": "F:" }, { "id": "G:", "name": "G:" }, { "id": "H:", "name": "H:" }, { "id": "I:", "name": "I:" }, { "id": "J:", "name": "J:" }, { "id": "K:", "name": "K:" }, { "id": "L:", "name": "L:" }, { "id": "M:", "name": "M:" }, { "id": "N:", "name": "N:" }, { "id": "O:", "name": "O:" }, { "id": "P:", "name": "P:" }, { "id": "Q:", "name": "Q:" }, { "id": "R:", "name": "R:" }, { "id": "S:", "name": "S:" }, { "id": "T:", "name": "T:" }, { "id": "U:", "name": "U:" }, { "id": "V:", "name": "V:" }, { "id": "W:", "name": "W:" }, { "id": "X:", "name": "X:" }, { "id": "Y:", "name": "Y:" }, { "id": "Z:", "name": "Z:" } ] }, { "allowManualInput": false, "defaultValue": null, "defaultValueObject": { "id": "XtsAes256", "name": "XTS-AES 256" }, "description": "Selects the cipher used when BitLocker is enabled on the volume.", "id": "EncryptionMethod", "name": "Encryption Method", "regExValidation": "", "required": false, "type": "ComboBox", "value": null, "values": [], "valuesObject": [ { "id": "XtsAes128", "name": "XTS-AES 128" }, { "id": "XtsAes256", "name": "XTS-AES 256" }, { "id": "Aes128", "name": "AES 128" }, { "id": "Aes256", "name": "AES 256" } ] }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Encrypts only used sectors for a faster initial rollout. Disable to encrypt the full volume.", "id": "UsedSpaceOnly", "name": "Used Space Only", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Starts the encryption right away instead of first restarting the computer to test that the hardware can release the encryption key at start-up.\r\n\r\nEnabled is the recommended setting. It is how the CapaBitLocker packages encrypt, and it lets a computer be encrypted in one run instead of waiting for a restart that may be hours away.\r\n\r\nDisable it only if you want Windows to verify the hardware before any data is encrypted. The computer then has to be restarted before the encryption begins, and this brick ends with 'Cancel retry later' so the job runs again afterwards.", "id": "SkipHardwareTest", "name": "Skip Hardware Test", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "False", "defaultValueObject": null, "description": "Waits for BitLocker encryption to reach FullyEncrypted before the brick continues. Disable to continue immediately after encryption starts.", "id": "WaitForEncryptionCompletion", "name": "Wait For Encryption Completion", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Protects the drive with the security chip built into the computer, so it unlocks by itself at start-up without anybody typing anything. This is the normal choice for the drive Windows is installed on.\r\n\r\nIf the security chip has not been taken into use yet, this brick prepares it before encrypting. That changes the computer: the chip gets an owner, and Windows is allowed to prepare it by itself in the future. Anything already protected by the chip is discarded, which on a computer that has never been encrypted means nothing.\r\n\r\nPreparing the chip only takes effect after a restart, so the run ends with 'Cancel retry later' and the job runs again by itself. The computer is not restarted for you - add the 'Restart Computer' brick after this one if you want that to happen straight away. Until the computer has been restarted, every run ends the same way.\r\n\r\nOn a few computers the chip asks for the change to be confirmed on the machine itself at the next start-up, normally by pressing F12. Nobody sitting at the computer means nobody to confirm it, and the preparation then waits. The log says when this is the case.\r\n\r\nDisable this only when the drive should be unlocked by something else, such as a startup key or a recovery password.", "id": "TpmProtector", "name": "Use TPM Protector", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "", "defaultValueObject": null, "description": "Optional folder path used for a startup key protector. Leave empty when not used.", "id": "StartupKeyPath", "name": "Startup Key Path", "regExValidation": "", "required": false, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Creates a BitLocker recovery password protector so the volume can be recovered if normal protectors fail.", "id": "RecoveryPasswordProtector", "name": "Add Recovery Password Protector", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "", "defaultValueObject": null, "description": "Optional folder path where a .BEK recovery key protector should be created. Leave empty when not used.", "id": "RecoveryKeyPath", "name": "Recovery Key Path", "regExValidation": "", "required": false, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Enables auto unlock for fixed data volumes. Ignored for the operating system volume.", "id": "AutoUnlock", "name": "Enable Auto Unlock", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "False", "defaultValueObject": null, "description": "Backs up the BitLocker recovery password to on-premises Active Directory. This requires AD DS permissions to create recovery information objects and can fail if the computer account lacks rights. Guidance: https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview", "id": "WriteRecoveryKeyToActiveDirectory", "name": "Write Recovery Key To Active Directory", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Writes the BitLocker recovery password to the PowerBrick log. Enabled by default; disable when operational staff must not see the secret in logs.", "id": "WriteRecoveryKeyToLog", "name": "Write Recovery Key To Log", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null } ], "powershell": { "base64Encoded": true, "function": "ZnVuY3Rpb2..." }, "type": "powerbrick", "version": "2026.9.15.1"}