Forum Discussion

ViProCon's avatar
ViProCon
Brass Contributor
Jan 26, 2020

Disable BitLocker prompting on boot?

Hi all,    I just enabled and completed Bitlocker encryptoni on C: on a Win 10 Pro machine, remotely.  I saved the bitlocker key file just in case.  In order to maintain remote access over the long...
david kay's avatar
david kay
Copper Contributor
Jan 26, 2020

ViProCon 

 

You can try either suspending or disable then re-enable:

 

Suspend:

  1. Right click Bitlockered Drive (c:) in file explorer
  2. Select Manage Bitlocker (this opens BL Drive Encryption)
  3. Click Suspend
  4. Click Yes
  5. Reboot
  6. Repeat steps 1 & 2
  7. Click Resume Protection
  8. Reboot

 

Or

 

Disable/Enable:

In elevated PoSh window:

<for remote establish a session 1st>

manage-bde -protectors -disable c:

reboot

manage-bde -protectors -enable c:

reboot

  • Ant-1's avatar
    Ant-1
    Copper Contributor
    Nov 15, 2022

    david kay I am facing the problem of a lost recovery key, I am ready to wipe the entire device, however not being able to get through the BitLocker Lock. What can I do?

  • ViProCon's avatar
    ViProCon
    Brass Contributor
    Jul 09, 2020
    Sorry I seemed to have missed the notifications on this thread. I actually completely forget what machine I did this work on that had those options greyed out so I'll just bear it in mind if I stumble into it. I'm curious though, if you Suspend protection, does that not just fully decrypt the drive...which presumably takes a while? Can you Resume Protection when it's not yet finished Suspending it?
  • ViProCon's avatar
    ViProCon
    Brass Contributor
    Jan 27, 2020

    david kay 

     

    Oh so do you mean that suspending or disabling might make those other 2 options available to toggle?  That's logical I agree so I'll test that out, however my goal is to avoid enabling any features that result in users having to interact at boot time to allow booting to occur.  It seems all of these 3 options in some way will ask a user to interact, which means, if I'm using remote access, I'll lock myself out by rebooting.  

     

    All I do know is that after enabling and finishing the Bitlocker encryption, I rebooted once, and did not get locked out so it means by default there are no prompts on boot, so that's good.  

     

    Now I suppose what I need to understand is why Bitlocker would have any reason to prompt a user on boot, be it triggered by an event, or periodic by design like after certain more intrusive Windows Updates perhaps.  *shrug8

Resources