1. Check encryption status
Laptop · Admin CMDStatus of all drives
manage-bde -statusLook for: Percentage Encrypted 100%, Protection Status: Protection On.
Laptop · Admin CMDKey protectors on C: (shows Recovery Key ID)
manage-bde -protectors -get C:Expected on C:: TPM And PIN + Numerical Password.
Laptop · Admin PowerShellStatus in PowerShell
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus, EncryptionPercentage, EncryptionMethod, KeyProtectorLaptop · Admin PowerShellCheck TPM is present and ready
Get-TpmLaptop · PowerShellCheck Windows edition (Home is not supported)
(Get-CimInstance Win32_OperatingSystem).Caption2. Suspend / Resume (remote reboots & updates)
Laptop · Admin PowerShellSkip PIN for the next 1 reboot only
Suspend-BitLocker -MountPoint C: -RebootCount 1Use before planned remote reboots (PDQ, updates, Dameware). Protection resumes automatically after the reboot.
Laptop · Admin PowerShellResume protection manually
Resume-BitLocker -MountPoint C:Use if the console or manage-bde shows C: as "Suspended" / "Protection Off".
Laptop · Admin CMDSame using manage-bde
manage-bde -protectors -disable C: -RebootCount 1
manage-bde -protectors -enable C:While suspended, the disk key is stored in the clear on the drive. C: is NOT protected. Always confirm it shows Protection On again.
3. Forgotten PIN – Recovery
| Where | Step |
|---|---|
| Laptop | At the blue BitLocker PIN screen, press Esc. Note the Recovery Key ID shown. |
| GZ Console | Network page → Recovery manager button (left pane toolbar). |
| GZ Console | Enter the Recovery Key ID + your GravityZone account password → copy the 48-digit key. |
| Laptop | User types the 48-digit key → Windows starts. |
| GZ Console | Open the laptop details → Encryption → Change password so the user sets a new PIN. |
Laptop · Admin CMDShow the recovery password locally (laptop must be unlocked)
manage-bde -protectors -get C: -Type RecoveryPassword4. PIN
GZ ConsolePreferred: change PIN from console
Network → select laptop → details → Encryption → Change passwordThe user is prompted on the laptop to set a new PIN.
Laptop · CMDChange PIN locally (user knows old PIN)
manage-bde -changepin C:BitLocker PIN is separate from the AD password and Windows Hello PIN. Numbers only, 6–20 digits (or as per GPO minimum).
5. Data drives (D:, E:)
Laptop · Admin CMDUnlock a locked data drive with recovery key
manage-bde -unlock D: -RecoveryPassword 111111-222222-333333-444444-555555-666666-777777-888888Laptop · Admin CMDTurn on auto-unlock for a data drive
manage-bde -autounlock -enable D:Removable drives (USB, SD, DVD) are not encrypted by GravityZone FDE.
6. Group Policy
Laptop · CMDApply GPO now
gpupdate /forceLaptop · Admin CMDCheck which GPOs applied (HTML report)
gpresult /h C:\Temp\gpresult.html /fDomain Controller Path: Computer Configuration › Policies › Administrative Templates › Windows Components › BitLocker Drive Encryption
| Setting | Value |
|---|---|
| Choose drive encryption method and cipher strength (Win 10 1511+) | Enabled · XTS-AES 256 (OS + fixed drives) |
| OS Drives › Require additional authentication at startup | Enabled · Require startup PIN with TPM |
| OS Drives › Configure minimum PIN length for startup | Enabled · 8 |
| OS Drives › Enforce drive encryption type on OS drives | Enabled · Full encryption |
| Fixed Data Drives › Enforce drive encryption type | Enabled · Full encryption |
| OS Drives › Enable preboot keyboard input on slates | Enabled (Surface / tablets only) |
Cipher and full-encryption settings apply only to laptops that encrypt after the GPO is applied.
7. GravityZone Console tasks
| Task | Where |
|---|---|
| Install Encryption module on a laptop | GZ Console Network → select laptop → Tasks → Reconfigure Agent → tick Encryption |
| Encrypt / Decrypt | GZ Console Policies → Encryption → General → Encrypt or Decrypt |
| Force pre-boot PIN | GZ Console Keep "If TPM is active, do not ask for pre-boot password" unchecked |
| Assign policy | GZ Console Network → select laptop/group → Assign Policy |
| Recovery key | GZ Console Network → Recovery manager |
| Status of one laptop | GZ Console Network → laptop details → Modules → Encryption |
| Compliance report | GZ Console Reports → Add → Endpoint Encryption Status |
8. Bitdefender agent CLI (product.console)
Laptop · Admin CMDGo to agent folder
cd "C:\Program Files\Bitdefender\Endpoint Security"Laptop · Admin CMDAgent and signature versions
product.console.exe /c GetVersion product
product.console.exe /c GetVersion antivirusLaptop · Admin CMDUpdate now / check update status
product.console.exe /c StartUpdate
product.console.exe /c GetUpdateStatus product
product.console.exe /c IsUpdateInProgress
product.console.exe /c IsUpdateRestartNeededResult "error 0" means the command ran successfully.
Quick troubleshooting
| Symptom | Fix |
|---|---|
| Console shows C: "Suspended" | Laptop Resume-BitLocker -MountPoint C: |
| No PIN popup on laptop | Check Encryption module installed (Reconfigure Agent) and policy assigned |
| Encrypted without PIN | TPM checkbox in policy is ticked – untick it |
| PIN popup keeps repeating (Surface) | Enable "preboot keyboard input on slates" GPO |
| Laptop pre-encrypted by Windows (no PIN) | Check manage-bde -status before assigning policy |
| Remote reboot stuck at PIN | Use Suspend-BitLocker -RebootCount 1 before rebooting |