BitLocker Encryption Pre-requisites

The successful deployment of BitLocker encryption hinges on meeting specific system requirements and configurations. These conditions ensure that BitLocker can function optimally and provide the desired level of protection. BitLocker pre-requisites are a set of criteria a computer must adhere to before deploying a BitLocker policy to initiate encryption. In this article, we will delve into the essential criteria that a computer must fulfill before implementing a BitLocker policy. Below are the various criteria:

1. Operating System Compatibility
2. BitLocker Availability
   • BitLocker Status
   • WMI Functionality
3. TPM Ownership
4. BIOS Mode Compatibility
5. GPO Configuration

Operating System Compatibility

BitLocker encryption might not be available in all Windows versions which are being used in your organizational setup. Here's a list of Windows operating systems that support BitLocker:

• Windows 11 Pro, Enterprise, and Education editions
• Windows 10 Pro, Enterprise, and Education editions
• Windows 8.1 Pro and Enterprise editions
• Windows 8 Pro and Enterprise editions
• Windows 7 Ultimate and Enterprise editions
• Windows 7 Vista Ultimate and Enterprise editions
• Windows Server 2008 and above

BitLocker Availability

BitLocker feature is not automatically enabled on servers. However, you can manually enable BitLocker to initiate encryption. The subsequently mentioned are a few issues you might encounter while enabling BitLocker on a Windows Server machine.

BitLocker Status

BitLocker is disabled in Server OS computers by default. Perform the following steps to enable the BitLocker feature and utilize the BitLocker Recovery Key storing feature.

1. On the Windows taskbar, select Server Manager and choose Add Roles and Features to open the wizard.



2. Follow the wizard installation steps. On reaching the Features pane of the Add Role and Features, select the BitLocker Drive Encryption Administration Utilities checkbox along with the underlying checkboxes, BitLocker Drive Encryption Tools & BitLocker Recovery Password Viewer.



3. Select Next to proceed in the installation wizard. Later, select Install on the Confirmation pane to initiate BitLocker feature installation on your computer. Turning on the BitLocker feature might require enabling additional features, so follow the Confirmation pane to enable these features.



4. Restart your computer to complete the BitLocker installation process. To confirm the installation of the BitLocker feature, navigate to the Active Directory Users and Computers of computer objects, if the BitLocker Recovery tab is present, then installation has been successful.

WMI Functionality

Windows Management Instrumentation (WMI) is Microsoft's remote protocol for performing management tasks and obtaining instant information. A few commo errors might occur while enabling BitLocker. Perform the following steps to troubleshoot these errors:

1. Open the Command Prompt with Administrator rights and execute the command mofcomp.exe C:\Windows\System32\wbem\win32_encryptablevolume.mof
2. If BitLocker WMI registration has been done successfully, you will get the below notification.

TPM Ownership

Trusted Platform Module (TPM) is a microchip that encrypts computer drives using cryptographic keys to mitigate dictionary attacks. You have partial ownership of TPM. Therefore, BitLocker is unable to use cryptographic keys. Full ownership is mandatory to carry out TPM-based encryption.

To get full ownership clear the TPM as explained here. Clearing TPM will trigger the OS to automatically re-initialize and acquire full TPM ownership.

NOTE - Clear TPM can cause loss of stored cryptographic keys. Refer to this link for precautionary measures before clearing TPM to safeguard your data.

BIOS Mode Compatibility

Trusted Platform Module aided BitLocker encryption is supported only for the Unified Extensible Firmware Interface (UEFI) mode of the BIOS. If you are using Legacy or CSM (Compatibility Support Mode) modes of BIOS switch to UEFI mode to facilitate TPM-based encryption as explained here.

GPO Configuration

Group Policy (GPO) settings can control the preliminary actions of Microsoft BitLocker. In certain cases, the existing GPO settings of your computer can counteract