Essentially, there are 2 registry values that need to be set before Bitlocker will allow a USB drive to be used to hold the startup/recovery keys. You don't need to edit a GPO via a GUI.
This is how I protected my c: drive with Bitlocker, storing my keys on a USB drive mounted as the k: drive. Step #3 is the part that replaces the need for using gpedit.msc.
- From PowerShell:
From PowerShell: (the "FVE" key/folder doesn't exist initially)
Set-ItemProperty FVE -Name UseAdvancedStartup -Value 1
Set-ItemProperty FVE -Name EnableBDEWithNoTPM -Value 1
manage-bde -protectors -add c: -startupkey k:\ -recoverykey k:\
- From cmd.exe:
manage-bde -on c: -usedspaceonly
- From cmd.exe (to confirm things are working):
FYI: I did all of this via an RDP session, including using diskpart to set the USB drive letter. The only physical access to the machine was to plug in the USB drive.
EDIT: I took some time and confirmed that the USB drive's letter and label are irrelevant at boot time. You can put the key file(s) on a replacement drive and connect it to a different USB port. Windows finds it just fine and boots. (If only Windows was this nice with USB printers.)