BitLocker - how to change startup key?

[groffg]

I have a machine w/ TPM-less BitLocker. I'd like to change the startup key (stored on USB, of course) to something else. I thought disabling (but not decrypting) BitLocker & then re-enabling it would do the trick. Alas, that does not work. Re-enabling BitLocker just produces the same startup key.

Is there a way to do this that doesn't involve decrypting & then re-encrypting the drive? Seems like such a common task (like doing a "change password"), but I'm not seeing a way to do it in the GUI or using the manage-bde.wsf script.

You have to recreate the startup key for BitLocker. Assuming you encrypted
the C-drive, these two commands should do the job:
manage-bde -protectors -delete C: -Type ExternalKey
manage-bde -protectors -add C: -StartupKey <USBDrive>:

Regards,

Ray
Author of Vista for XP Professionals (www.vistaforxpprofessionals.com)


"groffg" <groffg.3ivy4h@no-mx.forums.vistaheads.com> wrote in message
news:groffg.3ivy4h@no-mx.forums.vistaheads.com...
>
> I have a machine w/ TPM-less BitLocker. I'd like to change the startup
> key (stored on USB, of course) to something else. I thought disabling
> (but not decrypting) BitLocker & then re-enabling it would do the trick.
> Alas, that does not work. Re-enabling BitLocker just produces the same
> startup key.
>
> Is there a way to do this that doesn't involve decrypting & then
> re-encrypting the drive? Seems like such a common task (like doing a
> "change password"), but I'm not seeing a way to do it in the GUI or
> using the manage-bde.wsf script.
>
>
> --
> groffg
> Posted via http://www.vistaheads.com
>

[groffg]

Great info! I look forward to trying that out. Much appreciated.

Quote:

Originally Posted by VistaGuy

You have to recreate the startup key for BitLocker. Assuming you encrypted
the C-drive, these two commands should do the job:
manage-bde -protectors -delete C: -Type ExternalKey
manage-bde -protectors -add C: -StartupKey <USBDrive>:

Regards,

Ray
Author of Vista for XP Professionals (vistaforxpprofessionals.com)


"groffg" <groffg.3ivy4h@no-mx.forums.vistaheads.com> wrote in message
news:groffg.3ivy4h@no-mx.forums.vistaheads.com...
>
> I have a machine w/ TPM-less BitLocker. I'd like to change the startup
> key (stored on USB, of course) to something else. I thought disabling
> (but not decrypting) BitLocker & then re-enabling it would do the trick.
> Alas, that does not work. Re-enabling BitLocker just produces the same
> startup key.
>
> Is there a way to do this that doesn't involve decrypting & then
> re-encrypting the drive? Seems like such a common task (like doing a
> "change password"), but I'm not seeing a way to do it in the GUI or
> using the manage-bde.wsf script.
>
>
> --
> groffg
> Posted via http://www.vistaheads.com
>