You have a Windows Server 2022 failover cluster named Cluster that contains the Cluster Shared Volumes (CSV) shown in the following table. Name | Owner Volume1 | Node1 Volume2 | Node2 All the nodes…

Question

Explanation

This question tests knowledge of the correct PowerShell sequence to enable BitLocker on a Cluster Shared Volume (CSV) in a Windows Server 2022 failover cluster without disrupting cluster integrity.

Approach. The correct order is: (1) Suspend-ClusterResource 'Volume1' - puts the CSV into maintenance mode so the cluster does not interfere during encryption setup; (2) Enable-BitLocker - enables BitLocker on the underlying volume with an initial key protector (e.g., -RecoveryPasswordProtector); (3) Add-BitLockerKeyProtector - adds an Active Directory-based protector tied to the Cluster Name Object (CNO) using -ADAccountOrGroupProtector, which allows all cluster nodes to unlock the volume automatically; (4) Resume-ClusterResource 'Volume1' - brings the CSV back under active cluster management. Suspending first is critical because the cluster must not attempt failover or redirection while BitLocker is being configured on the disk.

Concept tested. Enabling BitLocker Drive Encryption on a Cluster Shared Volume (CSV) in a Windows Server failover cluster using PowerShell, specifically the required sequence of suspending the cluster resource, enabling BitLocker, adding an AD-based key protector for cluster-wide access, and then resuming the resource.

Reference. Microsoft Docs: 'BitLocker: How to deploy on Windows Server' and 'Failover Clustering with Cluster Shared Volumes' - docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server

No community discussion yet for this question.