How to disable Bitlocker via Group Policies

Step 1: Update the Group Policy (GPO)

First, you must ensure the policy is not actively forcing encryption or requiring specific protectors.

1. Open the Group Policy Management Console (GPMC).

2. Create a new GPO (e.g., "BitLocker Deactivation Policy") and link it to the target Organizational Unit (OU).

3. Navigate to:

   Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Fixed Data Drives (and Operating System Drives).

4. Set "Choose how BitLocker-protected drives can be recovered" to Disabled or Not Configured.

5. Specifically, ensure any policy that says "Enforce drive encryption type" is set to Disabled.

Step 2: Push a Decryption Script

Group Policy defines the "law," but it doesn't execute the "action" of decrypting a drive. You will need to deploy a startup script or use a management tool (like Intune or SCCM) to run a PowerShell command.

The PowerShell Command:

You can deploy a script that checks for encryption and disables it:

PowerShell

$BLV = Get-BitLockerVolume
foreach ($volume in $BLV) {
    if ($volume.VolumeStatus -eq 'FullyEncrypted') {
        Disable-BitLocker -MountPoint $volume.MountPoint
    }
}

Step 3: Monitoring the Progress

Decryption is a resource-heavy process that can take hours depending on drive size and speed (HDD vs. SSD). You can monitor the status across the network using the following command in your management console: