How to Configure Windows Server BitLocker Network Unlock using PowerShell

The Pre-Boot Authentication Challenge

BitLocker Drive Encryption is mandatory in modern enterprise environments to protect data at rest. If a thief steals a corporate laptop or physically rips a hard drive out of a server rack, they cannot read the data without the cryptographic key. However, this high security creates a massive operational headache for system administrators: how do you patch and reboot a rack of 50 physical Windows Servers at 2:00 AM?

By default, BitLocker requires pre-boot authentication. When the server restarts, it stops at a black screen and waits for a human to physically type in a PIN or insert a USB key before it will load the Windows kernel. You cannot RDP (Remote Desktop) into the server because the networking stack hasn’t loaded yet. An administrator is forced to use an out-of-band management tool (like iLO or iDRAC) to manually enter 50 passwords.

To solve this, Microsoft developed BitLocker Network Unlock. When a server reboots, the UEFI firmware sends a cryptographic DHCP request over the network. A dedicated Windows Deployment Services (WDS) server intercepts the request, verifies the server’s identity against an imported certificate, and securely transmits the BitLocker unlock key over the network. The server unlocks itself and boots to the Windows login screen automatically, completely eliminating the need for human intervention.

Step 1: Installing the Network Unlock Feature

You must designate a central Windows Server to act as the Network Unlock provider. This server must have the WDS role installed (even if you don’t use WDS for imaging) and the specific BitLocker Network Unlock feature.

Open an elevated PowerShell session on the provider server (e.g., WDS-01) and execute:

Install-WindowsFeature -Name BitLocker-NetworkUnlock -IncludeAllSubFeature -IncludeManagementTools

Step 2: Generating the Cryptographic Certificate

The security of Network Unlock relies entirely on a Public Key Infrastructure (PKI). The client servers encrypt their unlock request using a public certificate, and only the WDS server holds the private key required to read it.

If you have an Active Directory Certificate Services (AD CS) infrastructure, you can request a Network Unlock certificate. If you do not, you must generate a self-signed certificate specifically for this purpose.

Execute the following to generate the required 2048-bit RSA certificate:

$Cert = New-SelfSignedCertificate -CertStoreLocation "cert:\LocalMachine\My" -Subject "CN=BitLocker Network Unlock Certificate" -KeyExportPolicy Exportable -KeyUsage KeyEncipherment -Type DocumentEncryptionCert

Step 3: Exporting the Public Certificate

You must export the public half (.cer) of the certificate so you can distribute it to your client servers via Group Policy.

Export-Certificate -Cert $Cert -FilePath "C:\BitLockerNetworkUnlock.cer"

Step 4: Distributing the Certificate via GPO

You cannot configure the client side entirely with a single PowerShell cmdlet; you must use Active Directory Group Policy to deploy the certificate.

1. Open the Group Policy Management Console (gpmc.msc).
2. Create a GPO named BitLocker-NetworkUnlock-Clients and link it to the OU containing your servers.
3. Navigate to: Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > BitLocker Drive Encryption Network Unlock Certificate.
4. Right-click, select Add Network Unlock Certificate, and import the C:\BitLockerNetworkUnlock.cer file you generated in Step 3.

Step 5: Enabling the Network Protector on the Client

Once the Group Policy applies to the client server (e.g., SQL-01), the server now trusts the WDS provider. However, the C: drive is still likely using a TPM+PIN protector.

You must log into the client server (SQL-01) and add the Network Unlock protector to the C: drive using PowerShell.

# Add the Network Protector using the thumbprint of the deployed certificate
Add-BitLockerKeyProtector -MountPoint "C:" -NetworkKeyProtector -CertificateThumbprint "YOUR_CERT_THUMBPRINT_HERE"

The configuration is now complete. The next time SQL-01 is rebooted for a Windows Update, its UEFI firmware will pause, request the unlock key from WDS-01, receive it cryptographically, and silently boot into the operating system without requiring an administrator to type a PIN.