Sample configurations for Windows Bitlocker policy

With Hexnode UEM, you can set up a BitLocker policy on devices running Windows 10/11 Pro, Enterprise, and Education editions to configure encryption and recovery settings. This document equips Windows admins with a collection of sample policy configurations that they may use for managing BitLocker from the UEM console, like in instances where silently encrypting devices without the use of the Force BitLocker Encryption action, encrypting devices without TPM or ADDS, or encrypting devices while storing recovery information in ADDS is preferred.

1. Enable BitLocker automatically without user interaction on devices with TPM

Windows devices that have a compatible TPM and are Azure AD-joined can be silently encrypted without the use of the Force BitLocker Encryption action by configuring the below-specified list of settings:

2. BitLocker configuration for devices without TPM or Azure ADDS

Here is a list of settings that should be configured in the specified manner to manage BitLocker for Windows devices that neither have a compatible TPM nor are joined to Azure ADDS:

3. BitLocker configuration for devices utilizing Azure ADDS

Configure the following settings if you want to set up a BitLocker policy for Windows devices that are utilizing Azure ADDS: