Manage BitLocker with PowerShell on Windows

BitLocker is Windows' full-volume encryption. Turning it on for one laptop is a Control Panel wizard; turning it on for forty servers, checking that it stayed on, and making sure every recovery key is escrowed somewhere you can find at 2 a.m. is a PowerShell job. The BitLocker module ships with Windows 10/11 and Windows Server and exposes everything the GUI does, plus a few things it does not.

This guide covers the cmdlets in the order you use them: inspect, enable with the right protector for the machine, add and back up recovery keys, handle data drives, suspend for firmware updates, run it remotely, and fix the errors that stop Enable-BitLocker from running.

All commands need an elevated PowerShell session (Run as administrator). On Windows Server, BitLocker is a feature that must be installed first — see the next section.

Prerequisites

Windows Server: install the feature

Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -Restart

Client editions (Pro, Enterprise, Education) have it built in. Windows Home has device encryption only, not the full module.

Check the TPM

Most protectors rely on a TPM 1.2/2.0:

Get-Tpm | Select-Object TpmPresent, TpmReady, TpmEnabled, ManufacturerVersion

TpmPresent and TpmReady should both be True. If the TPM is present but not ready, Initialize-Tpm prepares it (it may require a reboot and a firmware confirmation). On a VM, enable the virtual TPM in the hypervisor (Hyper-V: Enable-VMTPM -VMName <name> from the host; VMware/Proxmox/cloud: an option on the VM's security settings).

List what the module offers

Get-Command -Module BitLocker

Inspect volumes

Get-BitLockerVolume
Get-BitLockerVolume -MountPoint "C:" | Format-List *

The fields that matter:

A one-liner for a fleet report:

Get-BitLockerVolume | Select-Object MountPoint, VolumeType, VolumeStatus, ProtectionStatus, EncryptionMethod, EncryptionPercentage |
  Format-Table -AutoSize

Enable BitLocker on the OS drive

TPM only (unattended servers and most desktops)

Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector -SkipHardwareTest
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

• -UsedSpaceOnly encrypts only the blocks in use — minutes instead of hours on a fresh install. Omit it for a drive that has held sensitive data before (deleted blocks would stay in the clear).
• -SkipHardwareTest skips the reboot-and-verify step; leave it out on hardware you have not encrypted before.
• The second command adds a recovery password (the 48-digit key). Without it, a TPM measurement change (firmware update, board swap) locks you out permanently. Always add it, then back it up (next section).

TPM + PIN (laptops, anything that leaves the building)

$pin = Read-Host -AsSecureString "Enter the BitLocker PIN"
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmAndPinProtector -Pin $pin
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

Group Policy must allow enhanced startup PINs for alphanumeric PINs; numeric 6–20 digits works by default. Never put a real PIN as a literal string in a script — read it securely or provision it at first logon.

Password protector (no TPM, data drives)

$pw = Read-Host -AsSecureString "Volume password"
Enable-BitLocker -MountPoint "D:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -PasswordProtector -Password $pw
Add-BitLockerKeyProtector -MountPoint "D:" -RecoveryPasswordProtector

Startup key on USB (no TPM, OS drive)

Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -StartupKeyProtector -StartupKeyPath "E:\"

Requires the policy Require additional authentication at startup → Allow BitLocker without a compatible TPM.

Watch progress

while ((Get-BitLockerVolume -MountPoint "C:").VolumeStatus -eq "EncryptionInProgress") {
    (Get-BitLockerVolume -MountPoint "C:").EncryptionPercentage
    Start-Sleep 30
}

Recovery keys: read them and back them up

Print the recovery password for a volume:

(Get-BitLockerVolume -MountPoint "C:").KeyProtector |
  Where-Object KeyProtectorType -eq "RecoveryPassword" |
  Select-Object KeyProtectorId, RecoveryPassword

Escrow it somewhere other than the encrypted disk:

$rp = (Get-BitLockerVolume -MountPoint "C:").KeyProtector | Where-Object KeyProtectorType -eq "RecoveryPassword"

# Active Directory (domain-joined; schema stores it on the computer object)
Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $rp.KeyProtectorId

# Microsoft Entra ID (Entra-joined or hybrid)
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $rp.KeyProtectorId

Or save a file to a network share that is not on the same machine:

$rp.RecoveryPassword | Out-File "\\fileserver\bitlocker-keys\$env:COMPUTERNAME-C.txt"

A recovery password you cannot retrieve is a wiped disk. Treat the escrow step as part of enabling, not as an afterthought — put it in the same script.

Data drives and auto-unlock

A data drive protected with a password would prompt on every boot. Auto-unlock stores its key on the (already encrypted) OS drive instead:

Enable-BitLockerAutoUnlock -MountPoint "D:"
Disable-BitLockerAutoUnlock -MountPoint "D:"

Auto-unlock requires the OS drive to be encrypted first. For removable drives, use a password or recovery-password protector; Unlock-BitLocker opens them in a script:

Unlock-BitLocker -MountPoint "E:" -Password $pw
Unlock-BitLocker -MountPoint "E:" -RecoveryPassword "123456-654321-..."
Lock-BitLocker   -MountPoint "E:" -ForceDismount

Manage protectors

# List
(Get-BitLockerVolume -MountPoint "C:").KeyProtector

# Add a second recovery password (e.g. before replacing the escrowed one)
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector

# Add a recovery *key file* to a USB stick
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryKeyProtector -RecoveryKeyPath "E:\"

# Remove by ID (never remove the last one)
$old = ((Get-BitLockerVolume -MountPoint "C:").KeyProtector | Where-Object KeyProtectorType -eq "RecoveryPassword")[0]
Remove-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $old.KeyProtectorId

Rotate recovery passwords after one has been used — anyone who saw it can use it again.

Suspend and resume (firmware updates, board swaps)

TPM-sealed keys are tied to boot measurements. A BIOS/UEFI update, Secure Boot change or motherboard replacement changes those measurements and triggers recovery at next boot. Suspend first:

Suspend-BitLocker -MountPoint "C:" -RebootCount 1   # protection off for exactly one reboot
# ...apply the update, reboot...
Resume-BitLocker  -MountPoint "C:"                  # or it resumes automatically after the count

-RebootCount 0 suspends indefinitely — avoid it; a suspended volume stores its key unprotected on disk. Use the fleet report above to find volumes stuck in ProtectionStatus Off.

Decrypt

Disable-BitLocker -MountPoint "D:"

Decryption runs in the background; VolumeStatus shows DecryptionInProgress until done. Remove auto-unlock on data drives first, and never decrypt the OS drive while data drives still auto-unlock against it.

Remote and bulk management

The module works over PowerShell Remoting:

$servers = "web01","web02","db01"
Invoke-Command -ComputerName $servers -ScriptBlock {
    Get-BitLockerVolume | Select-Object PSComputerName, MountPoint, VolumeStatus, ProtectionStatus
} | Format-Table -AutoSize

Enabling remotely works the same way, with one caveat: adding a TPM protector over a plain remoting session fails on some builds with a TPM is not available error; in that case run the enablement through a scheduled task or configuration management agent on the machine itself. manage-bde.exe is the older command-line tool and still works where the module does not (manage-bde -status, manage-bde -on C: -RecoveryPassword -UsedSpaceOnly).

Troubleshooting

• Enable-BitLocker : The TPM is not ready for use — Get-Tpm → Initialize-Tpm, enable it in firmware, or add a virtual TPM to the VM. For a machine with no TPM, use a password/startup-key protector with the policy noted above.
• A compatible TPM Security Device cannot be found on this computer — same cause; or Secure Boot/TPM is disabled in UEFI.
• Group Policy settings do not permit the creation of a recovery password / …require a recovery password — policy Choose how BitLocker-protected operating system drives can be recovered mandates or forbids specific protectors. Add the required protector type before Enable-BitLocker, e.g. Add-BitLockerKeyProtector -RecoveryPasswordProtector on a volume with no protectors yet, then Enable-BitLocker -TpmProtector.
• The volume cannot be encrypted because the drive letter is not valid — the volume is unformatted, a dynamic disk, or not NTFS/FAT/exFAT/ReFS.
• Recovery prompt on every boot after a firmware update — the TPM measurements changed. Enter the recovery password once, then Suspend-BitLocker -RebootCount 1, reboot, and BitLocker reseals to the new measurements.
• BackupToAAD-BitLockerKeyProtector fails — the device is not Entra-joined/registered, or the signed-in account lacks permission; dsregcmd /status shows the join state.
• EncryptionPercentage stuck — the drive is in use heavily, or the machine sleeps; encryption pauses on battery by default. manage-bde -status shows the same state with conversion details.
• Encrypted volume, ProtectionStatus Off — suspended. Resume-BitLocker. Schedule a report that alerts on this state.

Summary

1. Get-Tpm, then Get-BitLockerVolume to see where you are.
2. Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector (+ -Pin for mobile devices).
3. Immediately Add-BitLockerKeyProtector -RecoveryPasswordProtector and back it up to AD, Entra ID or an off-box share.
4. Enable-BitLockerAutoUnlock for data drives.
5. Suspend-BitLocker -RebootCount 1 before firmware changes; audit for ProtectionStatus Off.
6. Invoke-Command for fleets; manage-bde when the module is not available.

Related Resources

• How to install Wireshark on Windows Server — another admin task that is better scripted than clicked on Server Core
• Using the Windows ipconfig command — the networking side of the Windows command-line toolkit
• Windows Server monitoring — a service and event-log watch that notices a server stuck at the BitLocker recovery screen after a reboot