Skip to main content
Removed path to root, this is not required, you only have to define target device of the external key file. + Added simulated auto unlock. + Explicit command
Source Link
A71
  • 552
  • 1
  • 6
  • 16

You cannot achieve this without command prompt or powershell.

Open a cmd window with admin rights (winkey + x)

For a new drive:

manage-bde -on D: -RecoveryKey "FF:\" -RecoveryPassword -UsedSpaceOnly

A RecoveryPassword (-rp) consisting of a long numerical code is displayed for you to copy to a safe place and to be used if you loose your USB key. The RecoveryKey (-rk) or StartupKey (-sk) puts an external key file on the USB drive F:. Add -UsedSpaceOnly to speed up encryption.

For an already encrypted drive:

Manage-bde D: -protectors -add -RecoveryKey F:
Manage-bde D: -protectors -add /?

ForThe /? will result in a help overview.

After you have successfully added an external keyfile protector to getthe Data drive, Windows will not automatically unlock the Data drive when the USB key is detected. Bitlockers own autounlock-mechanism will add an external key file into the registry of Windows if you startedenable it, but this is only available if the system drive is encrypted. You cannot 'teach' windows to use the keyfile to autounlock the Data drive. You can add, however, a task in task scheduler, resulting in this behaviour.

manage-bde -unlock D: -RecoveryKey "F:\00000-...-.bek"

This time you do need to be specific in pointing to the file on the USB key (whereas saving the key to the USB-drive does not require you to be specific folder/filename).

As stated in the comments below, you can also unlock the drive with the mouse using the blue links in the bitlocker-corner-popup.

You cannot achieve this without command prompt or powershell.

Open a cmd window with admin rights (winkey + x)

For a new drive:

manage-bde -on D: -RecoveryKey "F:\" -RecoveryPassword -UsedSpaceOnly

A RecoveryPassword (-rp) consisting of a long numerical code is displayed for you to copy to a safe place and to be used if you loose your USB key. The RecoveryKey (-rk) puts an external key file on the USB drive F:. Add -UsedSpaceOnly to speed up encryption.

For an already encrypted drive:

Manage-bde D: -protectors -add /?

For help overview to get you started.

You cannot achieve this without command prompt or powershell.

Open a cmd window with admin rights (winkey + x)

For a new drive:

manage-bde -on D: -RecoveryKey F: -RecoveryPassword -UsedSpaceOnly

A RecoveryPassword (-rp) consisting of a long numerical code is displayed for you to copy to a safe place and to be used if you loose your USB key. The RecoveryKey (-rk) or StartupKey (-sk) puts an external key file on the USB drive F:. Add -UsedSpaceOnly to speed up encryption.

For an already encrypted drive:

Manage-bde D: -protectors -add -RecoveryKey F:
Manage-bde D: -protectors -add /?

The /? will result in a help overview.

After you have successfully added an external keyfile protector to the Data drive, Windows will not automatically unlock the Data drive when the USB key is detected. Bitlockers own autounlock-mechanism will add an external key file into the registry of Windows if you enable it, but this is only available if the system drive is encrypted. You cannot 'teach' windows to use the keyfile to autounlock the Data drive. You can add, however, a task in task scheduler, resulting in this behaviour.

manage-bde -unlock D: -RecoveryKey "F:\00000-...-.bek"

This time you do need to be specific in pointing to the file on the USB key (whereas saving the key to the USB-drive does not require you to be specific folder/filename).

As stated in the comments below, you can also unlock the drive with the mouse using the blue links in the bitlocker-corner-popup.

Source Link
A71
  • 552
  • 1
  • 6
  • 16

You cannot achieve this without command prompt or powershell.

Open a cmd window with admin rights (winkey + x)

For a new drive:

manage-bde -on D: -RecoveryKey "F:\" -RecoveryPassword -UsedSpaceOnly

A RecoveryPassword (-rp) consisting of a long numerical code is displayed for you to copy to a safe place and to be used if you loose your USB key. The RecoveryKey (-rk) puts an external key file on the USB drive F:. Add -UsedSpaceOnly to speed up encryption.

For an already encrypted drive:

Manage-bde D: -protectors -add /?

For help overview to get you started.