Manage BitLocker From Command Line, Manually Set Key to Same on All Systems

Managing BitLocker from the Command Line


Before you follow any of the steps below, note that you should replace drive letters that I show in the commands, such as C: or D:, with the correct
drive letter for your system.


*****************************
* Working with the OS Drive *
*****************************

   ********************************************
   * Encrypting an OS Drive not Yet Encrypted *
   ********************************************

If the drive is not yet encrypted, you can enable encryption like this:

manage-bde -on C: -rp -used -s -em xts_aes128

NOTE: The above command does not allow you to specify the key to be used. If you want to use a specific key, first encrypt the OS drive using the
command above (or use the GUI). Then use the steps below to change the key to a specific key that you can specify.

   ********************************************
   * Change the Encryption Key on an OS Drive *
   ********************************************

Get the ID of the BitLocker encrypted volume like this:

manage-bde C: -protectors -get -type RecoveryPassword

NOTE: The ID shown in the next command below is only an example. Make sure to replace it with the ID you obtained in the above command.

Delete the current numerical password key:

manage-bde C: protectors -delete -id {48FFDC29-66BA-4C31-974F-407B06A3F7AB}

Create a new numerical password key:

manage-bde C: protectors -add -rp Numerical_Password_Key

IMPORTANT:

1) The Numerical Password Key is a 48-digit key made up of 8 groups of 6 numeric digits each.
2) Each 6-digit group must be evenly divisible by 11.
3) Each group of 6 digits must be less than 720896.
4) You can specify the key as one long string of 48 digits or as 8 groups of 6 digits each with a "-" separating each group.




********************************************
* Working with Data Drives (Non-OS Drives) *
********************************************

   **********************************************
   * Encrypting a Data Drive (NOT the OS Drive) *
   **********************************************

To encrypt a data drive (NOT the OS drive), follow these steps:

manage-bde -on D: -pw -used -em xts_aes128

You will be asked to supply a password and then asked to confirm that password a second time.

   *********************************************
   * To Auto Unlock a Data Disk Once Encrypted *
   *********************************************

manage-bde -autounlock -enable D:

   ******************************
   * How to Disable Auto Unlock *
   ******************************

manage-bde -autounlock -disable D:

   *****************************************************
   * How to Clear BitLocker Auto Unlock for all Drives *
   *****************************************************

NOTE: In the command below, if your Windows drive has a drive letter other than C:, use that drive letter in the command.

manage-bde -autounlock -clearallkeys C:

   ***********************************
   * To Manually Unlock a Data Drive *
   ***********************************

manage-bde -Unlock D: -pw

720896..100000 |
ForEach-Object {
    [uint]$value = $_
    if (($value % 11) -eq 0) { Write-Output $value }
} | Get-Random -Count 8

(1..8 |% { ((Get-Random -Maximum 65536) * 11).ToString('000000') }) -join '-'

071566-304865-167200-086988-424776-099363-241296-266266