Forum Discussion

ScottA000's avatar
ScottA000
Copper Contributor
Jul 21, 2026

Enabling bitlocker encryption via group policy

Hopefull that someone might be able to offer some guidance here, I'm attempting to deploy bitlocker to a fleet of windows 11 25H2 machines using legacy Active Directory group policy. 

I just can't seem to get this to work, the scripts I have tried worked just fine when run from a command line, even tried using PSexec to run as the system user, but whenever I try via group policy it pops up an error -

 

"Bitlocker could not be enabled" "The bitlocker key cannot be obtained"

 

I have run get-tpm and confirmed everything is as it should be

 

Any help would be greatly appreciated, after many hours spent without progress I'm starting to wonder if this is even still possible. Unfortunately we don't have SCCM or Entra join so I can't leverage any of these technologies.

1 Reply

  • Jamony's avatar
    Jamony
    MCT
    Jul 24, 2026

    Your tests show that the TPM and BitLocker stack work when encryption is started locally as SYSTEM, so the failure is more likely in the domain-policy path than in the hardware. The recovery-key error is especially important: if Group Policy requires recovery information to be stored in Active Directory before BitLocker starts, Windows blocks encryption when it cannot reach a writable domain controller or cannot write the recovery object. Generate a gpresult report and confirm that only the intended BitLocker policies apply. Then check the BitLocker-API event log at the failed time, verify domain-controller connectivity, and confirm that the computer account can back up recovery information in AD DS. Also compare startup-authentication and recovery settings for conflicts. After correcting the policy or directory issue, refresh policy, restart, and test on one device before wider deployment. Do not bypass escrow unless your organization explicitly accepts losing centralized recovery.