Windows 10: Can the bitlocker key be rotated on server 2016?

Hello,We have a number of Server 2016 systems. Since it was available, we encrypted the data drives on each using the bitlocker that came with the server. When an IT worker leaves, we change all the passwords including bitlocker on each server as standard procedure. I was just looking at some best practice guides and they mention you should rotate encryption keys every 2 years. Is that even possible in this setup without decrypting and re-encrypting the data drive?I googled around and found some mention of intune managed devices but I thought of that as more a laptop thing than a server thing.

:)

 

BitLocker Key

There may be a software that triggered the BitLocker in your Windows 10 PC. To assist you better, we suggest that you check these articles for further information:

• Find my BitLocker recovery key.
• BitLocker recovery keys: Frequently asked questions.

• BitLocker

Let us know if you need further assistance.

 

Bitlocker GPO Server 2016

Windows 10 - 1809

Server 2016

I have installed the latest ADMX from microsoft.com to my server 2016 "policydefinitions" folder.

All settings have been enabled for bitlocker to auto-encrypt by GPO yet it does not work. This was working with previous builds of Windows however it seems with the new build it is not.

I have also enabled for software encryption to be allowed incase of hardware encryption not being possible.

When doing RSOP it displays all settings are being applied on the laptop.

Any pointers?

 

Bitlocker Key

Hi,

Thank you for posting your concern. It is good that you know the Bitlocker key to properly get into the computer. To help you turn off the Bitlocker key, you can follow the steps below:

Please make sure you are signed as the Administrator of the computer.

To suspend BitLocker Drive Encryption on an operating system drive

• 
  Click Start, click Control Panel, click
  System and Security, and then click BitLocker Drive Encryption.
  
• 
  Click Suspend Protection for the operating system drive.
  
• 
  A message is displayed, informing you that your data will not be protected while BitLocker is suspended and asking if you want to suspend BitLocker Drive Encryption. Click
  Yes to continue and suspend BitLocker on the drive.
  

To turn off BitLocker Drive Encryption

• 
  Click Start, click Control Panel, click
  System and Security, and then click BitLocker Drive Encryption.
  
• 
  Find the drive on which you want BitLocker Drive Encryption turned off, and click
  Turn Off BitLocker.
  
• 
  A message is displayed, informing you that the drive will be decrypted and that decryption may take some time. Click
  Decrypt the drive to continue and turn off BitLocker on the drive.
  

Let us know if this resolves your concern.