NOTE: If the -on switch has failed to add key protectors or start encryption, you may need to call "manage-bde -off" before ...