BitLocker refuses to enable via RDP on data drive but Ok on the OS drive

Question

I've recently installed Windows 10 Enterprise on an old AMD-based machine without a TPM. I use it mostly via Remote Desktop, due to lack of monitors and keyboards.

While connected via RDP, I then:

• enabled the local policy that allows BitLocker without a TPM.

• attempted then to switch on BitLocker on the D drive, which is a separate physical 3TB drive freshly formatted as 2TB a separate NTFS partition on the OS HDD.

Edit: my apologies. The D: drive isn't a separate physical drive, it's a separate NTFS partition on the same physical drive as the OS.

All I got was an error message saying Access is Denied:

Didn't have much luck Googling, but discovered that if I connected directly to the computer (ie not RDP, but separate monitor, keyboard and mouse), BitLocker would enable straightaway, prompting for a password and recovery file location as you'd expect.

Edit: The behaviour on the E: Drive (which is the separate physical 3TB drive freshly formatted as 2TB), is the same. BitLocker enables when connected directly, but not over RDP.

Once reconnected to the computer via RDP, I found that it would let me manage BitLocker on the D Drive (or the E: Drive), including switching it off and changing the password.

It would also let me switch BitLocker on, on the C Drive - the OS drive, all via RDP.

This wasn't just a glitch - I was able to switch off BitLocker, thus decrypting the drive (which was empty), and then get the Access is Denied message again as before.

Again, once enabled via a direct connection, all was well over RDP again.

Why would it be different on the two discs?

Edit: I don't think any of the drives are being recognised as removable media:

Although weirdly, they both appear as portable further down the Device Manager list.

Answer 1

Try enabling this group policy (using run / windowskey+r, "gpedit.msc"):

Computer Configuration > Administrative Templates > System > Removable Storage Access > All Removable Storage > Allow direct access in remote sessions

(described here: http://www.yellow-bricks.com/2010/11/06/access-denied-when-encrypting-a-memory-stick-with-bitlocker/ )

It may be that "removable drive" for bitlocker purposes is slightly different from "removable drive" for "how stuff looks in device manager" purposes, and enabling that policy may help. Also try a USB stick (or some other genuinely removable drive) after enabling that policy, and see whether you can use bitlocker on that.

Answer 2

rdp protocol treats external usb drives as mapped network drives and not as external usb devices which bitlocker handles. There is no resolution to this