BitLocker management - Part 4 Force encryption with no user action

[@imranawan9341]

Great video.. I watched all your MBAM videos... Thanks for sharing....

[@imranawan9341]

Looking forward to your next videos

[@megaperycles]

Great job guy, thx a lot.

[@mohamedgamal-xn6gx]

When I evaluate MBAM policy it delete the 2 registry key and the enforce deployment don't work, I need to know why the MBAM policy delete the registry keys I created

[@EvansCon40]

I followed your CI/Baseline configuration but I can not get my non encrypted system to encrypt without the user popup. We are using 2309, is any of this still valid for this version?

[@yannara]

I hope MS will improve this MBAM Service to have the enforcement as a built in. Old MBAM 2.5 had more features than this has in 1910.

[@yannara]

And hit it some votes :D configurationmanager.uservoice.com/forums/300492-ideas/suggestions/39327013-mbam-fully-integrated-in-1910-does-not-have-enforc

thx niall, this is very usefull :)

[@khanhvan2000]

What about removable drive like USB? How do you enforce the encryption automatically?

[@leanalighieri6586]

I love you man!

[@uvu3nvy]

Your resources have been incredibly helpful! Do you know if there's a way to hide the "MBAM System Check" screen? If end users are on battery power, they're being prompted that MBAM system check failed and to plug their device into power.

[@ncbrady]

thanks ! I don't think it's possible as it's native to the MDOP agent itself, the notification is there for a reason as encryption can take time and you don't want it failing because the laptop ran out of power, you could however get creative and create collections that identify which devices are connected to power and which are not and target policy accordingly (and of course, update membership fairly often), you only need to do this during the initial encryption phase, after they are encrypted being on battery is no problem at all.

[@Est0qu3]

Hi Niall, I have a problem with encryption enforcement.. Generaly all looks good except Baseline evaluation. It`s not start automatically. I need to click Evaluate button in Configuration Manger Client properties. "Specify the compliance evaluation schedule for this configuration baseline" is set to Simple Schedule Run Every 5 minutes. "Enable compliance evaluation on clients" is set to Yes, Occurs every 5 minutes in the clients settings. I`ve spent much timetoday on this problem and can`t resolve it... Do you have any ideas? On the Configurations Tab Baseline has Last Evaluation set to N/A and Compliance status is Unknown...

[@Est0qu3]

If somebody will have the same issue, in this article is described why it`s hapenned. social.technet.microsoft.com/Forums/en-US/1bc375aa-5991-4c28-8977-a9e41c894553/configuration-baselines-not-evaluating-as-per-schedule?forum=ConfigMgrCBGeneral

[@deepsardana2421]

Hello Niall.. Thanks for the information... but we do not want user to see that Bitlocker popup at all.... How to hide that.... so that it never comes up for the client and encryption happens completely happen in the background with no notification at all

[@ncbrady]

simple, On the BitLocker policy, select the Operating System Drive, scroll down to Encryption Policy Enforcement Settings, set it to Enabled, and set the noncompliance grace period to (days) 0

[@lucasfonquernie3572]

Hi Niall, first thanks for the video. I've done all of what you say on my infra. But the MBAM wizard for the user never shows up on my clients computer. When I trigger it manually, it works, if I do the manipulation on your video it works. Do you know what I could be missing? Thanks!

[@ncbrady]

what version of ConfigMgr are you using ? these registry key hacks were only needed for CM1910

[@lucasfonquernie3572]

@@ncbrady I'm using the 2103 but still no MBAM ui showing up even if I try to launch it manually, but your method work for enforcing

[@ncbrady]

@@lucasfonquernie3572 the keys are not needed for CM2103, you just need to set the Encryption Policy Enforcement settings to Enabled, and set the non compliance grace period to 0 on the operating system drive tab of your configured policy

[@lucasfonquernie3572]

@@ncbrady Yep but doing just that doesn't work for me. But when I setup the reg keys like you do with the compliance baseline it does work. That is weird.

[@klausvaldek]

Great !!

[@mattcarlin2873]

Hi Niall, What happens if the BitLocker policy was already applied before these registries? I haven't had any luck with the encryption starting automatically yet, but I followed this video after your part 1 video before seeing the note in the description saying to do this registry stuff first... I'll probably just try removing the policies and registries and then redeploy, but I just wondered if you had any pointers for this scenario? Thanks.

[@ncbrady]

hi Matt, are you using 1910 or 2002 ? if 1910 then you'll see the popup, if 2002 then there is no need for this workaround, you can configure the setttings in the policy

[@mattcarlin2873]

@@ncbrady Hey Niall. 1910 here. Is there a step that I missed to initiate the popup? Because the popup isn't appearing. Cheers.

[@ncbrady]

@@mattcarlin2873 the popup won't appear if you've set the delay period to 0 days as per my registry hack (this video). And it should just go ahead and encrypt, it won't encrypt if there's no TPM enabled or in a RDP session. So are either true ?

[@mattcarlin2873]

@@ncbrady Hey Niall, Yeah I found your guide which said that it doesn't work via RDP, so I made sure not to use that when testing. Anyway, it turns out I was getting "VolumeEnactmentFailed" in Event Viewer for my OS drive, and a Redditor who experienced the same issue narrowed his issue down to improper SQL permissions. I'm not sure if my issue is the same, so I ran a query to check for the SQL Server BitLocker certificate and it returned 0, so I figured my policy wasn't working due to the absence of the certificate. I redeployed the BitLocker policy with the plain text option selected for the recovery key, and then it all just worked...encryption started and I'm now compliant. I suppose this is what I get for not checking everything was set up correctly! (Note to self: don't trust colleagues who leave a project unfinished!)

[@ncbrady]

@@mattcarlin2873 ah, well spotted, i'm glad it's working now :)

[@neznakomets007]

Hello Niall, thanks for the video! I did exactly the same step-by-step but still getting pop-up mbam prompt on TEST-VM: YOUR GRACE PERIOD HAS EXPIRED AND YOU MUST NOW ENCRYPT YOUR C: DRIVE. PLEASE PROVIDE A PASSWORD. Do you have any idea why? sccm 1910. Deploying on win10 vm.

[@ncbrady]

hi Roman are the two registry settings in place as per my guide ? can you share screenshots of what you see and send me your bitlocker logs to [e-mail]

[@neznakomets007]

@@ncbrady thank you I sent!

[@freshnerfresnido9413]

Hi Niall, Do we really need to click the evaluate button for the policy to be compliant?

[@ncbrady]

hi Freshner, good question, and no, you do not need to do so it will happen automatically when the client checks for policy as defined in client settings. I did it as I wanted to show the 'change' quickly.

[@freshnerfresnido9413]

@@ncbrady seems like I did something wrong because it is not evaluating this policy for 18hours now. Thanks for the reply I'll look into it and if I have an answer or maybe you have can we reply it here :)

[@ncbrady]

@@freshnerfresnido9413 verify that its in the collection that you've deployed the policy to

[@freshnerfresnido9413]

@@ncbrady yeah its the correct collection and I can see it in configuration manager properties its just not evaluated yet

[@ncbrady]

@@freshnerfresnido9413 how are your client settings configured ? by default they should check for (machine) policy every 60 minutes or so, what is yours set to ?

I suppose this is not compatible with PIN ?

[@ncbrady]

good point, i haven't tested that, have you ?

@@ncbrady I will tomorrow, I'll let you know

@@ncbrady Unfortunately it doesn't work when user has to enter info

[@ncbrady]

@ have you tried setting the graceperiod to 1 or greater, currently it's at 0 so the user will never see anything

@@ncbrady It's working now thank you Niall, I just add the reg value NoStartupDelay