How to auto-deploy bitlocker in AD devices wich are in a OU

Question

How to auto-deploy bitlocker in AD devices wich are in a OU

Felipe Perez Villegas 0

I have attempted to deploy BitLocker using a Group Policy Object (GPO) with a startup script; however, I have not been able to get it working as expected.

I require assistance to implement BitLocker drive encryption across all devices within a specific OU in our domain.

The objective is to configure a GPO that enables:

Automatic activation of BitLocker on target devices without any end-user interaction.
Automatic encryption of the operating system volume (C:) once the policy is applied.
Automatic backup of BitLocker recovery keys to Active Directory.

The expected behavior is:

A fully silent and transparent process for end users.
Enforcement of corporate security requirements without manual intervention.
Proper storage and association of recovery keys with computer objects in Active Directory.I have attempted to deploy BitLocker using a Group Policy Object (GPO) with a startup script; however, I have not been able to get it working as expected. I require assistance to implement BitLocker drive encryption across all devices within a specific OU in our domain. The objective is to configure a GPO that enables:
1. Automatic activation of BitLocker on target devices without any end-user interaction.
2. Automatic encryption of the operating system volume (C:) once the policy is applied.
3. Automatic backup of BitLocker recovery keys to Active Directory.
The expected behavior is:
- A fully silent and transparent process for end users.
- Enforcement of corporate security requirements without manual intervention.
- Proper storage and association of recovery keys with computer objects in Active Directory.

There is a official way to make this work?

0 comentarios

2 respuestas

Su respuesta

Answer 1

Jason Nguyen Tran 28,095 Asesor independiente

Hi Felipe Perez Villegas,

I’m following up to check whether the issue has been resolved. Feel free to reply if you need further information. If the information provided was helpful, please click "Accept Answer" to help others in the community. Thank you!

0 comentarios

Answer 2

Jason Nguyen Tran 28,095 Asesor independiente

Hi Felipe Perez Villegas,

The official way to achieve this is through Group Policy combined with enterprise management tools, rather than relying solely on startup scripts.

Here’s the recommended approach: first, configure a GPO linked to the OU that enables BitLocker drive encryption policies. Within the GPO, set the option to store recovery information in Active Directory so that keys are automatically backed up to the computer object. Next, use the policy settings under Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption to enforce encryption of the operating system drive. You can specify that encryption should start automatically and require no user input.

It’s important to note that BitLocker does not enable itself purely from GPO; you typically need to combine the policy with either Intune, SCCM, or a deployment script that calls "manage-bde" or PowerShell cmdlets. The GPO ensures the right configuration and recovery key backup, while the automation script or management tool triggers the actual encryption process. This combination is the supported and “official” way to roll out BitLocker silently across an OU.

I hope the response provided some helpful insight. If it clarified the issue for you, please consider marking it as Accept Answer so others with the same issue can find the solution.

Jason.

Felipe Perez Villegas 0 Puntos de reputación

2026-03-26T09:49:37.34+00:00

Hello, thank you for your response.

I attempted to enable BitLocker using a startup script that invokes manage-bde, but it has not been successful. I am encountering multiple privilege-related errors that I have not been able to resolve.

I would like to know whether this approach is viable and if anyone has successfully implemented BitLocker deployment using a manage-bde script. If so, I would appreciate details on how it was achieved, as I am currently blocked on this issue.

Regards.
Jason Nguyen Tran 28,095 Puntos de reputación Asesor independiente

2026-03-26T10:18:20.13+00:00

The short answer is that while manage-bde can be used in scripts, deploying BitLocker purely through a startup script is not considered a reliable or “official” method. The reason is that BitLocker activation requires elevated privileges, TPM initialization, and sometimes user consent depending on the hardware configuration. Startup scripts often run in a context that doesn’t have the necessary rights to complete those steps, which explains the errors you’re seeing.

The supported approach is to use Group Policy to enforce BitLocker settings (especially recovery key backup to AD) and then trigger encryption through enterprise tools like Intune, SCCM, or a PowerShell deployment run as SYSTEM. These tools handle privilege elevation and TPM requirements correctly. If you want to stick with scripting, you’ll need to run the script in the local system context (for example, via a scheduled task with highest privileges) rather than as a standard startup script. Even then, you may encounter issues if the TPM isn’t initialized or if the device requires a reboot before encryption can start.

I hope this clears up why you’re blocked and points you toward a path that will work more reliably. If you find this answer helpful, please consider clicking Accept Answer so others can benefit too. Feel free to leave a message if you need further information.