Why Use BitLocker?

BitLocker encrypts entire drives, protecting data if a laptop is lost or stolen. Deploy it company-wide using Group Policy for compliance and security.

Prerequisites

  • Windows 10 Pro/Enterprise or Windows 11 Pro/Enterprise
  • TPM 1.2 or higher (most modern computers have this)
  • Active Directory domain

Step 1: Configure GPO for BitLocker

Open Group Policy Management and create a new GPO:

Navigate to: Computer Configuration ? Policies ? Administrative Templates ? Windows Components ? BitLocker Drive Encryption

Step 2: Enable Required Policies

Configure these settings:

  • Store BitLocker recovery information in AD DS: Enabled
  • Choose how BitLocker-protected operating system drives can be recovered: Enabled
  • Require additional authentication at startup: Enabled (Allow BitLocker without a compatible TPM)

Step 3: Force Encryption

Enable: Operating System Drives ? Require additional authentication at startup

Step 4: Deploy to Computers

  1. Link GPO to target OU
  2. Run gpupdate /force on client computers
  3. Users will be prompted to enable BitLocker on next restart

Verify Encryption Status

manage-bde -status

Recovery Keys

BitLocker recovery keys are automatically backed up to Active Directory. View them in AD Users and Computers ? User Properties ? BitLocker Recovery tab.