BitLocker: Basics

BitLocker encrypts the disk so a stolen drive, or one pulled from a machine and mounted elsewhere, is unreadable without the key. It's the answer to physical theft.

On a VM

Competition images run in VMware without a TPM, so you usually can't turn encryption on. What you can do is make sure the service is ready.

Get-Service BDESVC | Select Status, StartType
Set-Service BDESVC -StartupType Automatic

If the README describes encrypted drives, or the VM has a virtual TPM, the rest applies.

On Server 2022

BitLocker isn't installed on a server by default. The Server 2022 STIG treats disk encryption for data at rest as a CAT I item (WN22-00-000250), so a server that holds anything the README calls sensitive should have it. Install the feature, restart, and then the four BitLocker pages apply exactly as on Windows 11, policy settings included.

Get-WindowsFeature BitLocker
Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -Restart

After the restart, manage-bde -status works, the BitLocker policies appear in gpedit.msc, and Control Panel gains the BitLocker Drive Encryption item. Without a TPM in the VM the same limits as above apply: set the policies and the service, and turn on encryption only if the VM can hold a key.

Turn it on

Control Panel → System and Security → BitLocker Drive Encryption → Turn on BitLocker for the system drive. Save the recovery key somewhere off the machine.

PowerShell:

Enable-BitLocker -MountPoint C: -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector

Verify

Get-BitLockerVolume | Select MountPoint, ProtectionStatus, EncryptionPercentage

Try it

1. Check manage-bde -status and Get-Service BDESVC on a practice image. If the VM has a virtual TPM, turn BitLocker on and watch the status change.
2. Find the BitLocker policy folder in gpedit.msc and count the settings.

Build it

A bitlocker.ps1 that prints Get-BitLockerVolume and the service state, and warns if the service isn't Automatic.

Next

BitLocker: Operating System Drive