New-CMTSStepEnableBitLocker
Create an Enable BitLocker step, which you can add to a task sequence.
Syntax
New-CMTSStepEnableBitLocker
[-CreateKeyOption <CreateKeyType>]
[-Drive <String>]
[-EnableSkipWhenNoValidTpm <Boolean>]
[-EncryptFullDisk]
[-EncryptionMethod <DiskEncryptionMethod>]
[-Pin <SecureString>]
[-TpmAndPin]
[-TpmAndUsb]
[-TpmOnly]
[-UsbOnly]
[-WaitForBitLockerComplete]
[-Condition <IResultObject[]>]
[-ContinueOnError]
[-Description <String>]
[-Disable]
-Name <String>
[-DisableWildcardHandling]
[-ForceWildcardHandling]
[-WhatIf]
[-Confirm]
[<CommonParameters>] Description
This cmdlet creates a new Enable BitLocker step object. Then use the Add-CMTaskSequenceStep cmdlet to add the step to a task sequence. For more information on this step, see About task sequence steps: Enable BitLocker.
Note
Run Configuration Manager cmdlets from the Configuration Manager site drive, for example PS XYZ:\>. For more information, see getting started.
Examples
Example 1
This example creates an object for the Enable BitLocker step for TPM only with several other options.
It then gets a task sequence object, and adds this new step to the task sequence at index 11.
$step = New-CMTSStepEnableBitLocker -Name "Enable BitLocker" -TpmOnly -CreateKeyOption ActiveDirectoryDomainServices -EncryptionMethod AES_256 -EnableSkipWhenNoValidTpm $false -EncryptFullDisk $false -WaitForBitLockerComplete $false
$tsNameOsd = "Default OS deployment"
$tsOsd = Get-CMTaskSequence -Name $tsNameOsd -Fast
$tsOsd | Add-CMTaskSequenceStep -Step $step -InsertStepStartIndex 11Parameters
-Condition
Specify a condition object to use with this step. To get this object, use one of the task sequence condition cmdlets. For example, Get-CMTSStepConditionVariable.
| Type: | IResultObject[] |
| Aliases: | Conditions |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Confirm
Prompts you for confirmation before running the cmdlet.
| Type: | SwitchParameter |
| Aliases: | cf |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ContinueOnError
Add this parameter to enable the step option Continue on error. When you enable this option, if the step fails, the task sequence continues.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-CreateKeyOption
Use one of the following values to specify where to create the recovery key:
ActiveDirectoryDomainServices: Create the recovery password and escrow it in Active Directory (recommended)DoNotCreateRecoveryKey: Encrypt the drive, but don't create a recovery password.
| Type: | CreateKeyType |
| Accepted values: | ActiveDirectoryDomainServices, DoNotCreateRecoveryKey |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Description
Specify an optional description for this task sequence step.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Disable
Add this parameter to disable this task sequence step.
| Type: | SwitchParameter |
| Aliases: | DisableThisStep |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DisableWildcardHandling
This parameter treats wildcard characters as literal character values. You can't combine it with ForceWildcardHandling.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Drive
Specify the drive to encrypt. If you don't specify this parameter, the step encrypts the current OS drive.
| Type: | String |
| Aliases: | SpecificDrive |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EnableSkipWhenNoValidTpm
Applies to version 2006 and later. Set this parameter to true to skip this step for computers that don't have a TPM or when the TPM isn't enabled.
| Type: | Boolean |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EncryptFullDisk
Add this parameter to use full disk encryption. By default, the Enable BitLocker step only encrypts used space on the drive.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EncryptionMethod
Applies to version 2006 and later. Use this parameter to specify the disk encryption mode. By default or if not specified, the step continues to use the default encryption method for the OS version.
| Type: | DiskEncryptionMethod |
| Aliases: | DiskEncryptionMethod |
| Accepted values: | DoNotSpecify, AES_128, AES_256, XTS_AES128, XTS_AES256, TotalCount |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ForceWildcardHandling
This parameter processes wildcard characters and may lead to unexpected behavior (not recommended). You can't combine it with DisableWildcardHandling.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Name
Specify a name for this step to identify it in the task sequence.
| Type: | String |
| Aliases: | StepName |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Pin
If you use the parameter TpmAndPin, use this parameter to specify the PIN value. Specify 4-20 integers as a secure string.
| Type: | SecureString |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-TpmAndPin
Add this parameter to configure key management for the OS drive to use a TPM and a personal identification number (PIN). When you specify this option, BitLocker locks the normal boot process until the user provides the PIN. If you use this parameter, use Pin to specify the PIN value. You can't combine this parameter with TpmAndUsb, TpmOnly, or UsbOnly.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-TpmAndUsb
Add this parameter to configure key management for the OS drive to use a TPM and a startup key stored on a USB flash drive. When you select this option, BitLocker locks the normal boot process until a USB device that contains a BitLocker startup key is attached to the computer. You can't combine this parameter with TpmAndPin, TpmOnly, or UsbOnly.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-TpmOnly
Add this parameter to configure key management for the OS drive to only use a TPM. You can't combine this parameter with TpmAndPin, TpmAndUsb, or UsbOnly.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-UsbOnly
Add this parameter to configure key management for the OS drive to only use a startup key stored on a USB flash drive. When you select this option, BitLocker locks the normal boot process until a USB device that contains a BitLocker startup key is attached to the computer. You can't combine this parameter with TpmAndPin, TpmAndUsb, or TpmOnly.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-WaitForBitLockerComplete
Add this parameter to configure the step to wait for BitLocker to complete the drive encryption process on all drives before continuing task sequence execution.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-WhatIf
Shows what would happen if the cmdlet runs. It doesn't run the cmdlet.
| Type: | SwitchParameter |
| Aliases: | wi |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Inputs
None
Outputs
IResultObject
Notes
For more information on this return object and its properties, see SMS_TaskSequence_EnableBitLockerAction server WMI class.
Related Links
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for