BitLocker recovery and key control

DriveStrike / MDM / BitLocker

What you can do from the device page

• Select Encrypt on the device. If that PC supports BitLocker, encryption starts. The setup screen is documented on remote encryption.
• Read the stored recovery key when an administrator needs to unlock the drive.
• Rotate keys. DriveStrike creates new BitLocker keys, deletes the previous keys it stored, and reboots the PC.
• Persist BitLocker. If an administrator disables it, DriveStrike can turn it back on.

Which PCs qualify

The encryption guide lists Windows 8 or Windows 10 with a valid BitLocker license. BitLocker is available on Windows Pro, Ultimate, Enterprise, and Education.

DriveStrike supports BitLocker on PCs with a TPM security chip and on older PCs without one. DriveStrike checks BitLocker availability when the device registers.

FileVault is a separate control

DriveStrike also manages FileVault on Mac from the same console. Do not assume FileVault key escrow, key rotation, or automatic re-enable. Those actions are documented for Windows BitLocker. The platform page is mobile device management.

Related reading on this site: Windows update triggering BitLocker recovery, a wrong BitLocker recovery key id, and BitLocker TPM errors.

Questions

Does DriveStrike store BitLocker recovery keys?

Yes. DriveStrike keeps a copy of the recovery key for machines that have BitLocker enabled through DriveStrike.

What happens when a BitLocker key rotates?

DriveStrike creates new BitLocker keys, deletes the previous keys it stored, and reboots the PC.

Is FileVault key escrow the same as BitLocker?

No. DriveStrike manages FileVault on Mac. This page documents Windows BitLocker key storage and rotation only. FileVault key escrow and FileVault key rotation are not documented.