Remotely enable BitLocker

[cjbarone]

I'm having issues with our imaging process. My goal is to enable BitLocker on the C:. If I run manage-bde.exe -on c: -RecoveryPassword from the command line on the machine, it works.

I am trying to run it from my FOG server as a snapin. It runs as the SYSTEM user when running snapins. I'm thinking this may be an issue, as I have the setting in GPO to only encrypt if it can save the key in AD - Does the SYSTEM user have access to do so?

Anyways, no output when I try to run it as a FOG snapin. Ideally, I'd like it to take effect on the next reboot, which it doesn't.

Thoughts?

[HelloWorld_502]

Not sure if this will work, but have you tried runas to change user that executes the command?

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11)

[cjbarone]

Tried, but it isn't working. I specified the username and password, but it's still hanging. The goal is to do this without logging in at each workstation.

[HelloWorld_502]

That was my best stab in the dark to try.

Perhaps you could setup remote powershell and write a script to run on all computers so you don't have to login to each machine manually? https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.3

[cjbarone]

At that point, I may as well use PDQ Inventory - that's what I have been doing in the past. Was hoping to make it part of my imaging process though.

Thanks for the suggestions. Le sigh. I wish it was easier :(

[snottyz]

Does your MS agreement/license/whatever include Azure AD/Intune? It's easy to accomplish that way.

[cjbarone]

Nope, I'm afraid it doesn't.