Deploy bitlocker in all windows devices

Ed7 96 Reputation points
2022-01-07T12:51:24.847+00:00

Hi,

I am in process of planning a BitLocker deployment in our environment.

As a small company, we do not have SCCM but our devices are all in our doamin.

This is the first time I am doing this and I would few suggestions on how to deploy and what we need to provide bitlocker key whenever we need so then it unlocks the device.

What type of server do we need? What steps do I need to take? Is it possible to deploy via group policy? Or can I deploy using powershell script?

Thanks in advance.

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,770 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,733 questions
Windows Hardware Performance
Windows Hardware Performance
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Hardware Performance: Delivering / providing hardware or hardware systems or adjusting / adapting hardware or hardware systems.
1,552 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Lee Fitches 26 Reputation points
    2022-01-07T16:38:54.35+00:00

    Hi,

    Firstly you will need to make sure your devices are able to be encrypted, this requires them having a TPM (Trusted Platform Module) and it being activated. You could send out a powershell script with Get-tpm and this will return whether or not the tpm is ready and the device can be encrypted.

    Both options work but i would suggest group policy as your main way to deploy this as it would be alot more reliable. If your in group policy, you need to browse to Computer Configuration > Administrative Templates > Windows Components > Bitlocker Drive Encryption. Once your there it will give you three different sub folders of OS drives, removable drives and fixed data drives, its entirely upto you which settings you want enforced but within there you can choose which drives you can encrypt and you can also choose to backup the recovery key to your activ directory for when it is needed. Hope this helps!

    1 person found this answer helpful.
    0 comments
  2. Bagitman 581 Reputation points
    2022-01-21T10:47:12.333+00:00

    If you don't have contracts with Microsoft that let you use MBAM, please read https://www.experts-exchange.com/articles/33771/We-have-bitlocker-so-we-need-MBAM-too.html?preview=hG26jVC1xow%3D to see a scripted solution for deployment.

    0 comments