I have configured BitLocker and TPM settings in Group Policy such that all the options are set and the recovery keys stored in Active Directory. All our machines are running Windows 7 with a standard corporate image and have their TPM chips enabled and active in the BIOS.
My goal is to make it so that all the user must to do is click Enable BitLocker and away it goes. Microsoft even provides automation samples that can be deployed via script. But there is one small hiccup to making this a smooth process.
In the GUI, when the user enables BitLocker, it must initialize the TPM with an owner password which gets generated automatically. However, the recovery password is displayed to the user and they are prompted to save it to a text file. I can't seem to suppress this dialog and the step cannot be skipped. This is an unwanted (and unnecessary) prompt as the key is backed up to AD successfully.
If I script the deployment, I must supply the owner password in the script when I initialize the TPM and I want it to be randomly generated the way the GUI does.
Is there any way to make a BitLocker deployment truly zero-touch the way I want it?