Remove-BitLockerKeyProtector

Remove a key protector for a BitLocker volume.

Syntax
      Remove-BitLockerKeyProtector [-MountPoint] String[] [-KeyProtectorId] String
         [-WhatIf] [-Confirm]  [CommonParameters]

Key
   -Confirm  Prompt for confirmation before running the cmdlet.

   -KeyProtectorId
      Specifies the ID for a key protector.
      A BitLocker volume object includes a KeyProtector object. You have to specify the key protector ID.
      See the Examples section. To obtain a BitLocker volume object, use the Get-BitLockerVolume cmdlet.

   -MountPoint String[]
       An array of drive letters or BitLocker volume objects. The cmdlet removes key protectors for the
       volumes specified. To obtain a BitLocker volume object, use the Get-BitLockerVolume cmdlet.
       
   -WhatIf
      Shows what would happen if the cmdlet runs. The cmdlet is not run.

Standard Aliases for Get-BitLockerVolume: none, but if you want to add a short alias like gbl, set it with set-alias

The Remove-BitLockerKeyProtector cmdlet removes a key protector for a volume protected by BitLocker Drive Encryption.

You can specify a key protector to remove by using an ID.

To add a protector, use the Add-BitLockerKeyProtector cmdlet.

If you remove all the key protectors for a BitLocker volume, BitLocker stores the data encryption key for the volume without using encryption. This means that any user that can access the volume can read the encrypted data on the volume unless you add a key protector. Any encrypted data on the drive remains encrypted.

We recommend you have at least one recovery password as key protector to a volume in case you need to recover a system.

An overview of BitLocker Drive Encryption.

This cmdlet was introduced in Windows PowerShell 5.0.

Examples

Remove the second key protector for a volume:

PS C:\> $BLV = Get-BitLockerVolume -MountPoint "C:"
PS C:\> Remove-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[1].KeyProtectorId

Remove TpmPin key protector for a volume:

PS C:\> $BLV = Get-BitlockerVolume -MountPoint "C:"
PS C:\> $TpmPinKeyProtector = $BLV.KeyProtector | Where-Object {$PSItem.KeyProtectorType -eq "TpmPin"} PS C:\> Remove-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $TpmPinKeyProtector.KeyProtectorId

“Never organise what you can remove” ~ anon

Related PowerShell Cmdlets

Add-BitLockerKeyProtector - Add a key protector for a BitLocker volume.
Backup-BitLockerKeyProtector - Save a key protector for a BitLocker volume in AD DS.
Enable-BitLocker - Enable encryption for a BitLocker volume.
Enable-BitLockerAutoUnlock - Enable automatic unlocking for a BitLocker volume.
Get-BitLockerVolume - Get information about volumes that BitLocker can protect.
Suspend-BitLocker - Suspend Bitlocker encryption for the specified volume.
Manage-BDE - Manage BitLocker Drive Encryption.
BitLocker Drive Encryption Service - Services