Deploy BitLocker via GPO: TPM Enforcement and AD Key Recovery

A lost laptop without disk encryption is not a hardware loss — it is a data breach with a notification obligation. Every file, cached credential, and saved session on an unencrypted disk is readable by anyone who removes the drive or boots from USB, no password required. BitLocker closes this entirely, ships free in Pro and Enterprise editions, and — configured with TPM — runs invisibly: users never see it until the day a device goes missing and the incident report says "encrypted, no data exposure" instead of triggering a GDPR breach process. The only real engineering in a BitLocker rollout is the part teams skip: making sure every recovery key is escrowed before encryption starts.

Policy design — the settings that matter

• All BitLocker policy lives under Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption. Build one GPO for the fleet baseline.
• Cipher: set encryption method to XTS-AES 256 for OS and fixed drives (AES-CBC 256 for removable, which must stay compatible with other systems). This must be set before encryption begins — changing it later requires decrypt/re-encrypt.
• Protector: under Operating System Drives, require TPM. TPM-only is the right fleet default — transparent to users, protects against disk removal and offline attacks. Add TPM + PIN selectively for high-risk devices (executive laptops, devices with regulated data) via a separate GPO, accepting the boot-time PIN friction. Pure password protectors without TPM are a last resort for legacy hardware only.
• Recovery: in "Choose how BitLocker-protected operating system drives can be recovered," enable Save BitLocker recovery information to AD DS, select recovery passwords and key packages, and — critically — check "Do not enable BitLocker until recovery information is stored to AD DS". This one checkbox is the difference between a recovery process and a data-loss lottery: encryption is blocked until the key is safely escrowed.
• Repeat the recovery escrow settings for Fixed Data Drives, and decide your removable drive stance: at minimum, enforce encryption on write ("Deny write access to removable drives not protected by BitLocker") if USB storage is permitted at all.

Rollout sequence

• Prerequisites sweep: inventory TPM presence and version (Get-Tpm fleet-wide via your management tooling), confirm UEFI + Secure Boot — which you likely already enforce if the Credential Guard baseline is deployed, since the hardware requirements overlap almost entirely. Flag legacy BIOS machines for remediation or exception.
• Escrow verification first: before broad enablement, encrypt a pilot group and confirm recovery passwords appear in AD (the BitLocker Recovery tab on computer objects — install the BitLocker Recovery Password Viewer RSAT feature to see it). A policy that encrypts without escrowing is worse than no policy.
• Trigger encryption: GPO configures but does not start encryption on already-deployed machines. Kick it off via a deployment script — Enable-BitLocker -MountPoint C: -TpmProtector followed by BackupToAAD/AD-style escrow verification — through your software deployment tool, or let MBAM successors (Intune, ConfigMgr BitLocker management) handle orchestration if present. Use Used Space Only encryption on fresh deployments for speed; full-disk on machines with data history.
• Rings: IT first, then a pilot department, then the fleet — encryption runs in the background with negligible user impact on SSDs, but the first wave always surfaces the odd TPM firmware issue or third-party disk tool conflict.

Recovery key hygiene

• Recovery passwords in AD are readable by Domain Admins by default — delegate read access to the helpdesk group that actually handles recovery calls, and audit reads: each recovery key disclosure should be attributable, consistent with the event collection baseline in the audit policy item.
• Rotate on use: after a recovery key is given out over the phone, force a new one (manage-bde -protectors -delete/-add or the Intune rotation action) — a spoken key is a leaked key.
• Remember the dependency chain: AD holds the keys, so your domain controller backups now also protect your ability to ever recover encrypted disks. Verify DC backup restores accordingly.

Verify and maintain

• Measure compliance continuously, not once: a scheduled query of encryption status fleet-wide (Get-BitLockerVolume via remoting, or your endpoint management reporting) with two numbers watched — percent encrypted, and percent encrypted with a verified escrowed key. Only the second number counts.
• Alert on protection suspension: manage-bde -status showing protection off, or event 24620-series entries, indicate someone suspended BitLocker (legitimate during firmware updates, suspicious otherwise).
• Handle the lifecycle: decommissioned drives with BitLocker need no wiping ceremony — destroy the key material and the data is cryptographically gone, which simplifies disposal compliance considerably.

BitLocker is the rare control that is simultaneously free, invisible to users, and decisive in an incident: the difference between "we lost a laptop" and "we lost a laptop and 40,000 customer records" is one GPO and the discipline to verify every key landed in AD before the first sector was encrypted.