> For the complete documentation index, see [llms.txt](https://documentation.2pintsoftware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.2pintsoftware.com/deployr/reference/step-definitions/unlock-bitlocker.md).
# Unlock BitLocker
Run this step in WinPE when you need to access the file system to make changes and cannot suspend BitLocker from the full OS.
This step is available only in DeployR Enterprise. It is hidden in DeployR Community, along with the other step definitions tagged `Enterprise`.
Once the required permissions are configured, this step retrieves the BitLocker recovery key for the device from Active Directory or Entra ID and unlocks the drive, allowing you to modify it in WinPE.
### Devices with Keys in Entra
For devices in Entra ID, the `BitlockerKey.Read.All` permission is required. You can add the permission to your existing app registration, or follow the [Microsoft Graph API access](/deployr/integrations/microsoft-graph-api-access.md) instructions to create an app registration in your Azure tenant and include the BitlockerKey.Read.All permission.
### Devices with Keys in Active Directory
On the DeployR server, which is joined to the domain that keys will be recovered from, navigate to: C:\Program Files\2Pint Software\DeployR\WebServer\Scripts, where the script "RecoveryPasswordAccess.ps1" is located.
From an elevated PowerShell 7 console, run that script. The script is shown below for reference.
### Task Sequence Editor
There are no options to configure on the step itself; just add it to the task sequence. An example task sequence might look like this: boot into DeployR WinPE from USB or PXE, unlock the BitLocker-encrypted drive, then make modifications to resolve an issue.
### Task Sequence Running
When the task sequence runs in WinPE, the drive is unreadable before this step, and DiskPart shows "C" as unknown. After the Unlock BitLocker step, the drive is readable, and DiskPart shows the volume as NTFS because the recovery password was retrieved from Active Directory.
#### Pulling Recovery Key from Active Directory
#### Pulling Recovery Key from Entra
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://documentation.2pintsoftware.com/deployr/reference/step-definitions/unlock-bitlocker.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
