Deploying Bitlocker via Unattended OS Installation?

Question

Is there a way to enable Bitlocker during Windows setup?

Answer 1

There is a post on minasi.com giving an option. I'm not in a position to try it until Monday but it sounds okay.

I'm assuming your attended install currently logs into the "created" user at least once. So, write a batch file that calls manage-bde, enables TPM then encrypts then drive. Finally the batch file should delete itself (or the shortcut to it) from the All User's Start Up folder, meaning it won't re-run after that first automated log in.

The batch file should enable the TMP chip (and set the password):

manage-bde –tpm –t –o <password> 

Then encrypt the drive, we'll assume c: and since you aren't at the machine you'll need to get the output of the command written somewhere so you have the Recovery Password. In the example it's going to e:

manage-bde –on c: -rp > e:\bitlocker.txt

Finally delete the batch file or the shortcut to it and restart the PC.