Hi all,
i'm configuring a bitlocker drive encryption on my corporate networks. All Notebook have TMP 1.2 with Windows 10 PRO.
I configured a gpo with basic setting to store recovery key to Active Directory.
To enable Bitlocker at Windows Startutp i make a simple powershell script:
$ErrorActionPreference="SilentlyContinue"
Stop-Transcript | out-null
$ErrorActionPreference = "Continue"
Start-Transcript -path C:\bitlocker.txt -append
$CdriveStatus = Get-BitLockerVolume -MountPoint 'C:'
if ($CdriveStatus.volumeStatus -eq 'FullyDecrypted') {
Enable-Bitlocker -MountPoint "C:" -RecoveryPasswordProtector -SkipHardwareTest
}
Stop-Transcript
The script also log in c:\bitlocker.txt the debug information.
When a computer restart, the file contain this error:
Add-TpmProtectorInternal : The requested privilege does not belong to the client. (Exception HRESULT: 0x80070522)
In C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psm1:2095 car:31+ ... $Result = Add-TpmProtectorInternal $BitLockerVolumeInternal.MountPo ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo : NotSpecified: (:) [Write-Error], COMException+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException,Add-TpmProtectorInternal
Add-TpmProtectorInternal : The requested privilege does not belong to the client. (Exception HRESULT: 0x80070522)
In C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psm1:2095 car:31+ ... $Result = Add-TpmProtectorInternal $BitLockerVolumeInternal.MountPo ...+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+ CategoryInfo : NotSpecified: (:) [Write-Error], COMException+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException,Add-TpmProtectorInternal
If manually execute the script from elevated powershell sessions, all works fine.
How can execute the script with Highest privilege at startup pc (not logon user)
This is the GPO setting:
![]()