Enable BitLocker

What the Enable BitLocker action does to the Windows system drive, what it needs and when the step fails.

Use this action to turn on BitLocker for the Windows system drive, with a TPM protector and a recovery password. The device's own policy sets the encryption method. The device must be online.

Prerequisites

A Windows edition with BitLocker. Windows Home doesn't support it, and Windows Server needs the BitLocker feature installed.
A TPM that is present and ready. The step unlocks the drive only through the TPM and doesn't ask for a PIN.

Configuration fields

This action has no fields of its own. Only the common step settings apply, such as the condition, On failure and If device is offline.

Platform support

Platform	Supported
Windows	Yes
Linux	No
macOS	No

Outputs

Output	Description
`enabled`	Enabled: `true` when BitLocker protection is on for the system drive.
`action`	Action: `enabled` when the step turned BitLocker on. `alreadyEnabled` when protection was already on. `pendingRestart` when BitLocker is already set up and waiting for a restart.
`rebootRequired`	Restart required: `true` when encryption only starts after the next restart.

Result behaviour

The step only touches the system drive. Other drives stay as they are.

Situation on the device	Result
BitLocker protection already on	Succeeded, `action` = `alreadyEnabled`, `enabled` = `true`. Nothing changes.
BitLocker already set up with a TPM protector but not active yet	Succeeded, `action` = `pendingRestart`, `rebootRequired` = `true`. BitLocker isn't set up a second time.
BitLocker can be enabled	Succeeded, `action` = `enabled`. The TPM protector and a recovery password are added. If protection isn't on yet, `rebootRequired` = `true`.
TPM missing or not ready	Failed. Nothing changes.
BitLocker not available (Windows Home, or Windows Server without the BitLocker feature)	Failed.
Not a Windows device	Failed with Enabling BitLocker is only supported on Windows devices.
Device offline when the step starts	Device offline. Depending on If device is offline, the run ends with this status or the step is skipped.

You can safely run the step again.

Encryption usually starts only after the next restart, once Windows' hardware test has passed. So add a Restart device step afterwards, for example with the condition rebootRequired equal to true. The recovery key shows up on the device page after the next inventory run.

See also: Create an automation · BitLocker Encryption

Was this helpful?

Still need help? Ask the team