Drive

Represents a drive letter followed by a colon.

-ProtectionAsErrorLevel

Specifies use for batch scripts. You can also use -p as an abbreviated version of this command.

- ComputerName

Specifies that Manage-bde.exe will be used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

-RecoveryPassword

Adds a numerical password protector. You can also use -rp as an abbreviated version of this command.

NumericalPassword

Represents the recovery password.

-RecoveryKey

Adds an external key protector for recovery. You can also use -rk as an abbreviated version of this command.

PathToExternalDirectory

Represents the directory path to the recovery key.

-StartupKey

Adds an external key protector for startup. You can also use -sk as an abbreviated version of this command.

-TPMandPIN

Adds a Trusted Platform Module (TPM) and personal identification number (PIN) protector for the operating system drive. You can also use -tp as an abbreviated version of this command. This is now a secure prompt.

-TPMandStartupKey

Adds a TPM and startup key protector for the operating system drive. You can also use -tsk as an abbreviated version of this command.

-TPMandPINandStartupKey

Adds a TPM, PIN, and startup key protector for the operating system drive.

-Password

Adds a password key protector for the data drive.

-EncryptionMethod

Configures the encryption algorithm for the key size. You can also use -em as an abbreviated version of this command.

-SkipHardwareTest

Begins encryption without a hardware test. You can also use -s as an abbreviated version of this command.

-DiscoveryVolumeType

Specifies the file system to use for the discovery data drive. The discovery data drive is a hidden drive added to a FAT-formatted, BitLocker-protected removable data drive that contains the BitLocker To Go Reader so that Windows Vista or Windows XP operating systems can be used to view BitLocker-protected drives.

FileSystemType

Specifies which file systems can be used with data drives, either exFAT, FAT16, FAT32, or NTFS.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

-ForceDismount

Attempts to lock the drive even if it is in use. This allows the drive to be locked when applications have non-exclusive access to the drive. You can also use -fd as an abbreviated version of this command.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

-RecoveryPassword

Specifies a valid recovery password that can be used to unlock the drive.

Password

Represents the recovery password that can be used to unlock the drive.

-RecoveryKey

Specifies a valid external recovery key file that can be used to unlock the drive.

PathToExternalKeyFile

Represents the external recovery key file that can be used to unlock the drive.

Volume

Represents a drive letter followed by a colon.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

-enable

Enables automatic unlocking for a data drive.

-disable

Disables automatic unlocking for a data drive.

-ClearAllKeys

Removes all stored external keys on the operating system drive.

Volume

Represents a drive letter followed by a colon.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

-get

Displays key protection methods.

-add

Adds key protection methods as specified by using the following parameters:

Volume

Represents a drive letter followed by a colon.

-ForceUpgrade

Forces the BitLocker version to be upgraded.

-RecoveryPassword

Adds a numerical password protector. You can also use -rp as an abbreviated version of this command.

-RecoveryKey

Adds an external key protector for recovery. You can also use-rk as an abbreviated version of this command.

-StartupKey

Adds an external key protector for startup. You can also use -sk as an abbreviated version of this command.

-Certificate

Adds a public key protector for a data drive. You can also use –cert as an abbreviated version of this command. When using this parameter, you must identify the certificate file that contains the public key you want to use by appending either –cf and then providing the path to the certificate file or –ct and then typing the certificate thumbprint.

-TPMandPIN

Adds a TPM and PIN protector for the operating system drive. You can also use -tp as an abbreviated version of this command.

-TPMandStartupKey

Adds a TPM and startup key protector for the operating system drive. You can also use -tsk as an abbreviated version of this command.

-TPMandPINandStartupKey

Adds a TPM and PIN and startup key protector for the operating system drive.

-tpm

Adds a TPM protector for the operating system drive.

-password

Adds a password key protector for the data drive. You can also use -pw as an abbreviated version of this command.

-delete

Deletes key protection methods. To allow continued access to BitLocker-encrypted drives, deleting the last key protector disables all key protectors. All key protectors are removed by this command unless a parameter is used to define which key protector to delete. The following list defines the optional parameters that can be used with this command:

Volume

Represents a drive letter followed by a colon.

-type

Identifies the key protector to delete (for example, TPMAndStartupKey).

-id

Identifies the key protector to delete by ID value.

-disable

Disables protection, which will allow anyone to access encrypted data by making the encryption key available unsecured on drive. No key protectors are removed.

-enable

Enables protection by removing the unsecured encryption key from the drive. All configured key protectors on the drive will be enforced.

-adbackup

Backs up all recovery information for the drive specified to Active Directory Domain Services. To back up only a single recovery key, append the –id parameter and specify the ID of the recovery key to back up.

Volume

Represents a drive letter followed by a colon.

-ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

-TurnOn

Enables and activates the TPM, allowing the TPM owner password to be set. You can also use -t as an abbreviated version of this command.

-TakeOwnership

Takes ownership of the TPM by setting an owner password. You can also use -o as an abbreviated version of this command.

OwnerPassword

Represents the owner password that you specify for the TPM.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

PathToExternalKeyDrectory

Represents the directory location to save the external recovery key file that can be used to unlock the drive.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.

Volume

Represents a drive letter followed by a colon.

- ComputerName

Specifies that Manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.

Name

Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.