But you could use the Add-BitLockerKeyProtector cmdlet to add more key protectors later on. The Enable-BitLocker cmdlet lets you specify only one combination from the aforementioned key protectors. AD Account: BitLocker uses an AD account to protect the encryption key.If you use this key protector without specifying a password, a random 48-digit recovery password will be generated automatically. To establish this key protector, use the -RecoveryPasswordProtector switch parameter. Recovery Password: BitLocker uses a recovery password to protect the encryption key.The -PasswordProtector switch specifies this key protector, and the -Password parameter passes a secure string. Password: BitLocker uses a password to protect the encryption key.To define this, use the -RecoveryKeyProtector switch along with the -RecoveryKeyPath parameter to specify a folder in which a randomly generated recovery key is stored. When you establish a startup key or a recovery key as a key protector, you must specify a path to store the key. Recovery Key: BitLocker uses a recovery key stored as a file to protect the encryption key.

For this key protector, use the -StartupKeyProtector switch parameter and the -StartupKeyPath parameter to specify the path of the key. Startup Key: BitLocker uses a removable USB storage drive to protect the encryption key.To work with a combination of all these key protectors, use the -TpmAndPinAndStartupKeyProtector switch parameter. TPM + Startup Key + PIN: BitLocker uses TPM, a startup key, and a PIN as key protectors to protect the encryption key.Use the -TpmAndStartupKeyProtector switch parameter to define this key protector. TPM + Startup Key (USB drive): BitLocker uses both TPM and a startup key (a removable USB flash drive containing an external key) as key protectors to protect the encryption key.You could use the ConvertTo-SecureString cmdlet to generate a secure string. Use the -TpmAndPinProtector switch parameter to establish this key protector and specify a PIN as a secure string. TPM + PIN: When TPM and a PIN are specified, BitLocker uses both to protect the encryption key. Check TPM availability on the computer using PowerShell

Online bitlocker recovery key generator