How to Enable BitLocker Auto-Unlock for a Data Drive Using a Run Script Job in SureMDM

Overview

This article explains how to enable BitLocker Auto-Unlock for a fixed data drive (for example, D:) on Windows devices managed through SureMDM. By enabling Auto-Unlock, the data drive is automatically unlocked during system startup once the operating system drive has been unlocked.

Purpose

Enabling BitLocker Auto-Unlock helps administrators:

• Automatically unlock encrypted fixed data drives after system startup.
• Eliminate the need for users to manually unlock secondary drives after every reboot.
• Ensure seamless access to encrypted data volumes.
• Simplify BitLocker management across managed Windows devices.

Scope

Platform: Windows 10 / Windows 11

Feature: BitLocker Management

Deployment Method: SureMDM BitLocker Management Jobs and Run Script Job

Applies To: Fixed data drives protected by BitLocker (e.g., D:)

Prerequisites

Before enabling Auto-Unlock, ensure:

• The Windows device is enrolled in SureMDM.
• BitLocker is enabled on both the operating system drive and the fixed data drive.
• The operating system drive is unlocked.
• The data drive has been unlocked at least once.
• Administrative privileges are available to execute BitLocker commands.

Script Used

Execute the following command to enable Auto-Unlock for the data drive:

manage-bde -autounlock -enable D:

Note: Replace D: with the appropriate drive letter if configuring a different data drive.

Steps

Step 1: Configure BitLocker Management

Create and deploy the required BitLocker Management jobs to encrypt the operating system drive and the fixed data drive.

Ensure both jobs are successfully applied before proceeding.

Step 2: Verify the Data Drive State

Restart the device.

After reboot:

• Verify whether the D: drive is locked.
• If the drive is locked, it must be manually unlocked before enabling Auto-Unlock.

Step 3: Deploy the Run Script Job

Create a Run Script Job in SureMDM with the following command:

manage-bde -autounlock -enable D:

Deploy the job to the target Windows device.

Step 4: Execute the Script

If the data drive is locked when the script runs, the command fails.

Example behavior:

• Drive Locked: Script returns an error indicating the drive must first be unlocked.
• Drive Unlocked: Script executes successfully and enables Auto-Unlock.

Step 5: Validate Auto-Unlock

After the script executes successfully:

1. Restart the device multiple times.
2. Verify that the D: drive is automatically unlocked after each reboot.
3. Confirm that no manual intervention is required to access the drive.

Validation Steps

After deployment:

1. Restart the device.
2. Open File Explorer or Disk Management.
3. Verify that the data drive is accessible immediately after login.
4. Repeat the reboot process multiple times to confirm Auto-Unlock continues to function.

Notes

• The manage-bde -autounlock -enable command can only be executed when the target data drive is already unlocked.
• If the drive is locked, manually unlock it before running the command.
• Auto-Unlock applies only to fixed data drives and relies on the operating system drive being successfully unlocked during startup.
• Ensure BitLocker protection is enabled on the operating system drive before configuring Auto-Unlock for secondary drives.

Conclusion

Enabling BitLocker Auto-Unlock through a SureMDM Run Script Job provides an effective way to automatically unlock encrypted fixed data drives after system startup. Once the data drive is unlocked and the manage-bde -autounlock -enable command is executed successfully, the drive remains configured for automatic unlocking across subsequent device reboots, improving usability while maintaining BitLocker encryption.

Need more help? Here’s how to get help from our experts.

CONTACT US