How can I edit local Group Policy settings using command line?

Question

I'm attempting to throw together a script for work that allows BitLocker without a compatible TPM. The setting is Configuration \ Administrative Templates \ Windows Components \ Bit Locker Drive Encryption \ Operating System Drives and Require additional authentication at startup under gpedit.

It just needs to be enabled. I used Process Monitor to watch which registry settings are changed when manually Enabling, which on mine is HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{5C0CD1B3-C6CC-448-AFA7-B69059CFF648}Machine\SOFTWARE\Policies\Microsoft\FVE EnableBDEWithNoTPM data is changed to 1.

At first I figured I just somehow need to compensate for the Unique ID in curly brackets, but after looking on another Windows 8.1 Pro machine and "Group Policy Objects" wasn't even in the registry.

So I'm out of ideas. Anyone know how this can be done using a script?

Solution 1

There is no way to automate Group Policy from the command line. That's what domain controllers are for. The only thing you can do is script the registry change that the GPO would have affected. The location you observed from Process Monitor is just the copy of the GPO itself, not the application of it. The actual location in the registry you need to change is in the last part of the string.

To enable this with a script, just use the REG command:

REG ADD HKLM\SOFTWARE\Policies\Microsoft\FVE /v EnableBDEWithNoTPM /t REG_DWORD /d 1

That will enable the value you're looking for.

Solution 2

As I noted at https://superuser.com/a/1140638/459921, you can use the following command line utility to modify local group policy on a non domain-joined machine:

https://blogs.technet.microsoft.com/secguide/2016/01/21/lgpo-exe-local-group-policy-object-utility-v1-0/

Comments

[Julian Knight]

What version of Windows 8 are you using? Is it an enterprise licensed version?

[Sandfrog]

It's licensed 8.1 Pro.