bitlockerwdswindowswindows 7
Let's say I have a notebook without anything, no software, no operating system. Now I want to install Windows (with some programs) from my WDS. Which works just fine, but how do I tell Windows to autmomatically encrypt the hard drive via Bitlocker within that process?
OS is Windows 7 + Server 2012 R2.
A streamline was of managing bitlocker in your environment would be to consider a multi discipline approach.
Set your group policy to automatically backup the recovery key to active directory, and to not encrypt the computer if the recovery key isn't stored in AD. Also, if the users will be encrypting their own machines, disable prompting for PINs and Passwords, unless you use them in your environment.
Create a plan for encrypting machines that are already in the environment, vs. newly built workstations. New workstations are easier typically, as bitlocker requires a system partition to exist on the workstation, for storing its bootloader. Depending on your imaging process this may or may not exist on your current workstations, and if not a separate step would have to be run to prepare the hard drive for bitlocker, but the command escapes me at the moment. The GUI will do it automatically and requires a reboot before continuing, I have to assume the command line is the same way. manage-bde can also be used to backup the recovery of machines that have already been encrypted, as in before your group policy was implemented, to active directory. Of course, you also have to take into account TPM chip enabling and activation when talking about an automated bitlocker deployment.
Backing up recovery keys to Active Directory is okay, but it's gone when the computer account is blown away. No big deal if the machine has been disposed of, but could be a major issue if this was just a laptop that was off the network for a while, and got subject to an AD cleanup script. Powershell can be used to retrieve backup keys from active directory, if this is something you want to think about.
Best Answer
You just need to add the BitLocker package in the Image Builder Wizard and then make sure that you check the
Create separate system partitioncheckbox in the wizard so that BitLocker can function correctly.You can find more info about this at an MSDN blog post, here.