Edit

manage-bde on

  • Article

Encrypts the drive and turns on BitLocker.

Syntax

manage-bde –on <drive> {[-recoverypassword <numericalpassword>]|[-recoverykey <pathtoexternaldirectory>]|[-startupkey <pathtoexternalkeydirectory>]|[-certificate]|
[-tpmandpin]|[-tpmandpinandstartupkey <pathtoexternalkeydirectory>]|[-tpmandstartupkey <pathtoexternalkeydirectory>]|[-password]|[-ADaccountorgroup <domain\account>]}
[-usedspaceonly][-encryptionmethod {aes128_diffuser|aes256_diffuser|aes128|aes256}] [-skiphardwaretest] [-discoveryvolumetype <filesystemtype>] [-forceencryptiontype <type>] [-removevolumeshadowcopies][-computername <name>]
[{-?|/?}] [{-help|-h}]

Parameters

Parameter Description
<drive> Represents a drive letter followed by a colon.
-recoverypassword Adds a numerical password protector. You can also use -rp as an abbreviated version of this command.
<numericalpassword> Represents the recovery password.
-recoverykey Adds an external key protector for recovery. You can also use -rk as an abbreviated version of this command.
<pathtoexternaldirectory> Represents the directory path to the recovery key.
-startupkey Adds an external key protector for startup. You can also use -sk as an abbreviated version of this command.
<pathtoexternalkeydirectory> Represents the directory path to the startup key.
-certificate Adds a public key protector for a data drive. You can also use -cert as an abbreviated version of this command.
-tpmandpin Adds a Trusted Platform Module (TPM) and personal identification number (PIN) protector for the operating system drive. You can also use -tp as an abbreviated version of this command.
-tpmandstartupkey Adds a TPM and startup key protector for the operating system drive. You can also use -tsk as an abbreviated version of this command.
-tpmandpinandstartupkey Adds a TPM, PIN, and startup key protector for the operating system drive. You can also use -tpsk as an abbreviated version of this command.
-password Adds a password key protector for the data drive. You can also use -pw as an abbreviated version of this command.
-ADaccountorgroup Adds a SID-based identity protector for the volume. The volume will automatically unlock if the user or computer has the proper credentials. When specifying a computer account, append a $ to the computer name and specify –service to indicate that the unlock should happen in the content of the BitLocker server instead of the user. You can also use -sid as an abbreviated version of this command.
-usedspaceonly Sets the encryption mode to Used Space Only encryption. The sections of the volume containing used space will be encrypted but the free space will not. If this option is not specified, all used space and free space on the volume will be encrypted. You can also use -used as an abbreviated version of this command.
-encryptionMethod Configures the encryption algorithm and key size. You can also use -em as an abbreviated version of this command.
-skiphardwaretest Begins encryption without a hardware test. You can also use -s as an abbreviated version of this command.
-discoveryvolumetype Specifies the file system to use for the discovery data drive. The discovery data drive is a hidden drive added to a FAT-formatted, BitLocker-protected removable data drive that contains the BitLocker To Go Reader.
-forceencryptiontype Forces BitLocker to use either software or hardware encryption. You can specify either Hardware or Software as the encryption type. If the hardware parameter is selected, but the drive doesn't support hardware encryption, manage-bde returns an error. If Group Policy settings forbids the specified encryption type, manage-bde returns an error. You can also use -fet as an abbreviated version of this command.
-removevolumeshadowcopies Force deletion of Volume Shadow Copies for the volume. You won't be able to restore this volume using previous system restore points after running this command. You can also use -rvsc as an abbreviated version of this command.
<filesystemtype> Specifies which file systems can be used with discovery data drives: FAT32, default, or none.
-computername Specifies that manage-bde is being used to modify BitLocker protection on a different computer. You can also use -cn as an abbreviated version of this command.
<name> Represents the name of the computer on which to modify BitLocker protection. Accepted values include the computer's NetBIOS name and the computer's IP address.
-? or /? Displays brief Help at the command prompt.
-help or -h Displays complete Help at the command prompt.

Examples

To turn on BitLocker for drive C, and to add a recovery password to the drive, type:

manage-bde –on C: -recoverypassword

To turn on BitLocker for drive C, add a recovery password to the drive, and to save a recovery key to drive E, type:

manage-bde –on C: -recoverykey E:\ -recoverypassword

To turn on BitLocker for drive C, using an external key protector (such as a USB key) to unlock the operating system drive, type:

manage-bde -on C: -startupkey E:\

Important

This method is required if you are using BitLocker with computers that don't have a TPM.

To turn on BitLocker for data drive E, and to add a password key protector, type:

manage-bde –on E: -pw

To turn on BitLocker for operating system drive C, and to use hardware-based encryption, type:

manage-bde –on C: -fet hardware