Prevent Administrators From Turning Off BitLocker

If you’re an IT administrator and want to prevent your clients from turning off BitLocker encryption or decrypting their drives, this article is for you. Note that if the client’s account is a standard account, it can’t turn off BitLocker as the decrypting process requires administrative privileges. So if you change user account type to standard user, you can prevent turning off BiLocker from your clients.

However, if client’s account have admin privileges, they can simply turn off BitLocker and decrypt their drive. To prevent this, you can create an AppLocker rule and deploy it to client’s machine. Here is the how-to part:

How To Prevent Administrators From Turning Off BitLocker In Windows 10/8.1/7

1. Open Services snap-in by running services.msc command.

2. In Services snap-in, make sure Application Identity service is running. You can right click on this service and select Start, if it isn’t running.

3. Then press  + R and put secpol.msc in Run dialog box to open Security Policy snap-in. Click OK.

4. Next, in the Security Policy snap-in window, navigate here:

Security Settings > Application Control Policies > AppLocker > Executable Rules

5. Right click on Executable Rules, select Create New Rule.

6. Under Create Executable Rules, on Permissions tab, select Action Deny. Then select the administrator accounts or users which you want to prevent turning off BitLocker. Click Next.

7. On the next section, select Publisher and click Next.

8. Under Publisher, browse to C:\Windows\System32 and select manage-bde.exe file. Click Next.

9. Under Name, provide a justified description and click Create.

10. Then for AppLocker warning prompt, click Yes.

11. Finally, we’ve created the rule to prevent administrators from turning off BitLocker.

12. Close Security Policy snap-in and run gpupdate /force command to update machine policies on client system.

Now when administrators or users try to turn off BitLocker, they should get Access denied error as the policy is controlled by Group Policy. However, clients can still turn on BitLocker as usual, but can’t turn it off.

Check this video to illustrate above steps:

That’s it!