# Configure BitLocker

> Enables and configures BitLocker on a selected volume, including encryption method, protectors, recovery information handling and optional auto unlock for data volumes.

Source: https://docs.capaone.com/capaone/application-manager/powerbricks/configure-bitlocker/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

Enables and configures BitLocker on a selected volume, including encryption method, protectors, recovery information handling and optional auto unlock for data volumes.

## Parameters

#### Mount Point
*Required* — Default: `OS`

Drive letter of the volume to protect, for example C: or D:. You can also use OS or SystemDrive to target the operating system drive automatically.

#### Encryption Method
*Optional* — Default: `XTS-AES 256`

Selects the cipher used when BitLocker is enabled on the volume. Allowed values: `XTS-AES 128`, `XTS-AES 256`, `AES 128`, `AES 256`.

#### Used Space Only
*Optional* — Default: `True`

Encrypts only used sectors for a faster initial rollout. Disable to encrypt the full volume.

#### Skip Hardware Test
*Optional* — Default: `False`

Skips the BitLocker hardware validation reboot test before encryption starts.

#### Wait For Encryption Completion
*Optional* — Default: `False`

Waits for BitLocker encryption to reach FullyEncrypted before the brick continues. Disable to continue immediately after encryption starts.

#### Use TPM Protector
*Optional* — Default: `True`

Adds a TPM-based protector when supported. Commonly used for operating system volumes.

#### Startup Key Path
*Optional*

Optional folder path used for a startup key protector. Leave empty when not used.

#### Add Recovery Password Protector
*Optional* — Default: `True`

Creates a BitLocker recovery password protector so the volume can be recovered if normal protectors fail.

#### Recovery Key Path
*Optional*

Optional folder path where a .BEK recovery key protector should be created. Leave empty when not used.

#### Enable Auto Unlock
*Optional* — Default: `True`

Enables auto unlock for fixed data volumes. Ignored for the operating system volume.

#### Write Recovery Key To Active Directory
*Optional* — Default: `False`

Backs up the BitLocker recovery password to on-premises Active Directory. This requires AD DS permissions to create recovery information objects and can fail if the computer account lacks rights. Guidance: https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview

#### Write Recovery Key To Log
*Optional* — Default: `True`

Writes the BitLocker recovery password to the PowerBrick log. Enabled by default; disable when operational staff must not see the secret in logs.

## Details

- **Category:** Provisioning
- **Brick ID:** `BitLocker-Configure`

## Raw JSON definition

**JSON**

```json
{
  "category": "provisioning",
  "description": "Enables and configures BitLocker on a selected volume, including encryption method, protectors, recovery information handling and optional auto unlock for data volumes.",
  "developerVendor": "CapaSystems A/S",
  "displayName": null,
  "id": "BitLocker-Configure",
  "name": "Configure BitLocker",
  "parameters": [
    {
      "allowManualInput": false,
      "defaultValue": "OS",
      "defaultValueObject": null,
      "description": "Drive letter of the volume to protect, for example C: or D:. You can also use OS or SystemDrive to target the operating system drive automatically.",
      "id": "MountPoint",
      "name": "Mount Point",
      "regExValidation": "",
      "required": true,
      "type": "TextBox",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": null,
      "defaultValueObject": {
        "id": "XtsAes256",
        "name": "XTS-AES 256"
      },
      "description": "Selects the cipher used when BitLocker is enabled on the volume.",
      "id": "EncryptionMethod",
      "name": "Encryption Method",
      "regExValidation": "",
      "required": false,
      "type": "ComboBox",
      "value": null,
      "values": [],
      "valuesObject": [
        {
          "id": "XtsAes128",
          "name": "XTS-AES 128"
        },
        {
          "id": "XtsAes256",
          "name": "XTS-AES 256"
        },
        {
          "id": "Aes128",
          "name": "AES 128"
        },
        {
          "id": "Aes256",
          "name": "AES 256"
        }
      ]
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Encrypts only used sectors for a faster initial rollout. Disable to encrypt the full volume.",
      "id": "UsedSpaceOnly",
      "name": "Used Space Only",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "False",
      "defaultValueObject": null,
      "description": "Skips the BitLocker hardware validation reboot test before encryption starts.",
      "id": "SkipHardwareTest",
      "name": "Skip Hardware Test",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "False",
      "defaultValueObject": null,
      "description": "Waits for BitLocker encryption to reach FullyEncrypted before the brick continues. Disable to continue immediately after encryption starts.",
      "id": "WaitForEncryptionCompletion",
      "name": "Wait For Encryption Completion",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Adds a TPM-based protector when supported. Commonly used for operating system volumes.",
      "id": "TpmProtector",
      "name": "Use TPM Protector",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "",
      "defaultValueObject": null,
      "description": "Optional folder path used for a startup key protector. Leave empty when not used.",
      "id": "StartupKeyPath",
      "name": "Startup Key Path",
      "regExValidation": "",
      "required": false,
      "type": "TextBox",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Creates a BitLocker recovery password protector so the volume can be recovered if normal protectors fail.",
      "id": "RecoveryPasswordProtector",
      "name": "Add Recovery Password Protector",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "",
      "defaultValueObject": null,
      "description": "Optional folder path where a .BEK recovery key protector should be created. Leave empty when not used.",
      "id": "RecoveryKeyPath",
      "name": "Recovery Key Path",
      "regExValidation": "",
      "required": false,
      "type": "TextBox",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Enables auto unlock for fixed data volumes. Ignored for the operating system volume.",
      "id": "AutoUnlock",
      "name": "Enable Auto Unlock",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "False",
      "defaultValueObject": null,
      "description": "Backs up the BitLocker recovery password to on-premises Active Directory. This requires AD DS permissions to create recovery information objects and can fail if the computer account lacks rights. Guidance: https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview",
      "id": "WriteRecoveryKeyToActiveDirectory",
      "name": "Write Recovery Key To Active Directory",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Writes the BitLocker recovery password to the PowerBrick log. Enabled by default; disable when operational staff must not see the secret in logs.",
      "id": "WriteRecoveryKeyToLog",
      "name": "Write Recovery Key To Log",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    }
  ],
  "powershell": {
    "base64Encoded": true,
    "function": "ZnVuY3Rpb2..."
  },
  "type": "powerbrick",
  "version": "2026.9.1.1"
}
```