How to enable BitLocker autounlock on USB device from Powershell

Question

Hello, I created a script to enable bitlocker on a USB storage device. In the same script after I wait for the encrypt status to reach 100% I tried to enable autounlock with the following line:

Enable-BitLockerAutoUnlock -MountPoint "D:"

Once the script finished I could see that from the Bitlocker status the AutoUnlock Enabled is set to True, but in the Bitlocker screen in the control panel I still see the option to Turn on AutoUnlock.

Indeed if I reinsert the USB in the computer is still asking for a password.

I tried to run these lines outside of the script and/or after I turned on manually the encryption, but none of these worked:

Enable-BitLockerAutoUnlock -MountPoint D:

manage-bde -autounlock -enable D: (this one answer with an error: autounlock is already enabled on this volume)

If I enable manually from control panel the Autounlock it works.

How can I enable it from powershell? What I am doing wrong?

Answer 1

Hello，

Ideally, the drive should be locked (i.e. removed/reinserted or after a reboot) so that Windows applies the auto‐unlock setting. In your script you may be testing on a volume that is “already unlocked.”

So, to get auto‐unlock working using PowerShell you should do the following:

A. Confirm Your OS Drive Is Encrypted

  • For auto‐unlock of removable drives to work, first ensure the system (boot) drive is encrypted by BitLocker (and ideally auto‐unlock is enabled on it).

  • If you have not set up BitLocker on your OS drive, enable it and then try to enable removable auto‐unlock.

B. Ensure the Volume Is in the Correct (Locked) State

  • Once your USB drive encryption reaches 100%, eject (or lock) the USB drive so that Windows “forgets” the current unlock state.

  • Reinsert it to test whether it auto-unlocks.

C. Use the Command After OS and Volume Conditions Are Right

  • Although your script uses:

   Enable-BitLockerAutoUnlock -MountPoint "D:"

   verify that this command is issued only after (a) the encryption is complete, (b) the OS drive is encrypted, and (c) any necessary waiting period has elapsed.

  • You might even consider forcing a “lock” (using Lock-BitLocker –MountPoint "D:") and then issuing Enable-BitLockerAutoUnlock in your script.

An example “after the fact” script workflow might be:

  # 1. Check that the OS drive (assumed C:) is encrypted

  if (!(Get-BitLockerVolume -MountPoint "C:").VolumeStatus -eq 'FullyEncrypted') {

    Write-Error "The OS drive must be encrypted with BitLocker first."

    return

  }

  # 2. Wait/poll until the encryption on D: is 100%

  while ((Get-BitLockerVolume -MountPoint "D:").EncryptionPercentage -lt 100) {

    Start-Sleep -Seconds 5

  }

  # 3. (Optionally) Lock the drive so that autounlock can be proved

  Lock-BitLocker -MountPoint "D:"

  # 4. Enable auto-unlock

  Enable-BitLockerAutoUnlock -MountPoint "D:"

After doing these steps, eject the USB drive and reinsert it (or reboot) and Windows should auto-unlock it. If you still have problems—and you note that the Control Panel shows the option “Turn on auto-unlock” instead of “Turn off auto-unlock”—double‑check that the OS drive’s BitLocker protection is active and that the key protectors have been written to disk. One way to verify this is to run:

  manage-bde -autounlock -status

If it reports that auto‑unlock is enabled on your USB volume, then it’s likely a timing (or state) issue .

---

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Thanks for you reply.

Unfortunately all the things suggested didn't work.

The C: drive is already encrypted, and when I tried the following

# 3. (Optionally) Lock the drive so that autounlock can be proved

  Lock-BitLocker -MountPoint "D:"

  # 4. Enable auto-unlock

  Enable-BitLockerAutoUnlock -MountPoint "D:"

I couldn't enable the AutoUnlock when the device was locked, I had to unlock it first.

As you can see AutoUnlock appears Enabled

but in the Control Panel the Enable AutoUnlock option is still present

If I enable it from here it just works as intended