Configure BitLocker
Enables and configures BitLocker on a selected volume, including encryption method, protectors, recovery information handling and optional auto unlock for data volumes.
Parameters
Section titled “Parameters”Mount Point
Section titled “Mount Point”Required — Default: OS
Drive letter of the volume to protect, for example C: or D:. You can also use OS or SystemDrive to target the operating system drive automatically.
Encryption Method
Section titled “Encryption Method”Optional — Default: XTS-AES 256
Selects the cipher used when BitLocker is enabled on the volume. Allowed values: XTS-AES 128, XTS-AES 256, AES 128, AES 256.
Used Space Only
Section titled “Used Space Only”Optional — Default: True
Encrypts only used sectors for a faster initial rollout. Disable to encrypt the full volume.
Skip Hardware Test
Section titled “Skip Hardware Test”Optional — Default: False
Skips the BitLocker hardware validation reboot test before encryption starts.
Wait For Encryption Completion
Section titled “Wait For Encryption Completion”Optional — Default: False
Waits for BitLocker encryption to reach FullyEncrypted before the brick continues. Disable to continue immediately after encryption starts.
Use TPM Protector
Section titled “Use TPM Protector”Optional — Default: True
Adds a TPM-based protector when supported. Commonly used for operating system volumes.
Startup Key Path
Section titled “Startup Key Path”Optional
Optional folder path used for a startup key protector. Leave empty when not used.
Add Recovery Password Protector
Section titled “Add Recovery Password Protector”Optional — Default: True
Creates a BitLocker recovery password protector so the volume can be recovered if normal protectors fail.
Recovery Key Path
Section titled “Recovery Key Path”Optional
Optional folder path where a .BEK recovery key protector should be created. Leave empty when not used.
Enable Auto Unlock
Section titled “Enable Auto Unlock”Optional — Default: True
Enables auto unlock for fixed data volumes. Ignored for the operating system volume.
Write Recovery Key To Active Directory
Section titled “Write Recovery Key To Active Directory”Optional — Default: False
Backs up the BitLocker recovery password to on-premises Active Directory. This requires AD DS permissions to create recovery information objects and can fail if the computer account lacks rights. Guidance: https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview
Write Recovery Key To Log
Section titled “Write Recovery Key To Log”Optional — Default: True
Writes the BitLocker recovery password to the PowerBrick log. Enabled by default; disable when operational staff must not see the secret in logs.
Details
Section titled “Details”- Category: Provisioning
- Brick ID:
BitLocker-Configure
Raw JSON definition
Section titled “Raw JSON definition”{ "category": "provisioning", "description": "Enables and configures BitLocker on a selected volume, including encryption method, protectors, recovery information handling and optional auto unlock for data volumes.", "developerVendor": "CapaSystems A/S", "displayName": null, "id": "BitLocker-Configure", "name": "Configure BitLocker", "parameters": [ { "allowManualInput": false, "defaultValue": "OS", "defaultValueObject": null, "description": "Drive letter of the volume to protect, for example C: or D:. You can also use OS or SystemDrive to target the operating system drive automatically.", "id": "MountPoint", "name": "Mount Point", "regExValidation": "", "required": true, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": null, "defaultValueObject": { "id": "XtsAes256", "name": "XTS-AES 256" }, "description": "Selects the cipher used when BitLocker is enabled on the volume.", "id": "EncryptionMethod", "name": "Encryption Method", "regExValidation": "", "required": false, "type": "ComboBox", "value": null, "values": [], "valuesObject": [ { "id": "XtsAes128", "name": "XTS-AES 128" }, { "id": "XtsAes256", "name": "XTS-AES 256" }, { "id": "Aes128", "name": "AES 128" }, { "id": "Aes256", "name": "AES 256" } ] }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Encrypts only used sectors for a faster initial rollout. Disable to encrypt the full volume.", "id": "UsedSpaceOnly", "name": "Used Space Only", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "False", "defaultValueObject": null, "description": "Skips the BitLocker hardware validation reboot test before encryption starts.", "id": "SkipHardwareTest", "name": "Skip Hardware Test", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "False", "defaultValueObject": null, "description": "Waits for BitLocker encryption to reach FullyEncrypted before the brick continues. Disable to continue immediately after encryption starts.", "id": "WaitForEncryptionCompletion", "name": "Wait For Encryption Completion", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Adds a TPM-based protector when supported. Commonly used for operating system volumes.", "id": "TpmProtector", "name": "Use TPM Protector", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "", "defaultValueObject": null, "description": "Optional folder path used for a startup key protector. Leave empty when not used.", "id": "StartupKeyPath", "name": "Startup Key Path", "regExValidation": "", "required": false, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Creates a BitLocker recovery password protector so the volume can be recovered if normal protectors fail.", "id": "RecoveryPasswordProtector", "name": "Add Recovery Password Protector", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "", "defaultValueObject": null, "description": "Optional folder path where a .BEK recovery key protector should be created. Leave empty when not used.", "id": "RecoveryKeyPath", "name": "Recovery Key Path", "regExValidation": "", "required": false, "type": "TextBox", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Enables auto unlock for fixed data volumes. Ignored for the operating system volume.", "id": "AutoUnlock", "name": "Enable Auto Unlock", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "False", "defaultValueObject": null, "description": "Backs up the BitLocker recovery password to on-premises Active Directory. This requires AD DS permissions to create recovery information objects and can fail if the computer account lacks rights. Guidance: https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview", "id": "WriteRecoveryKeyToActiveDirectory", "name": "Write Recovery Key To Active Directory", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null }, { "allowManualInput": false, "defaultValue": "True", "defaultValueObject": null, "description": "Writes the BitLocker recovery password to the PowerBrick log. Enabled by default; disable when operational staff must not see the secret in logs.", "id": "WriteRecoveryKeyToLog", "name": "Write Recovery Key To Log", "regExValidation": "", "required": false, "type": "Boolean", "value": null, "values": [], "valuesObject": null } ], "powershell": { "base64Encoded": true, "function": "ZnVuY3Rpb2..." }, "type": "powerbrick", "version": "2026.9.1.1"}