MDT and Bitlocker Offline PC

[EGGLAS]

Hi,

 

I have trouble activating Bitlocker on Offline PC during task sequence in MDT.

We are in the process creating offline PCs that will never speak to AD and we want to enable bitlocker on thoose computers.

 

Does anyone know how to do it?

We are completley stuck when trying to enable it with Customsettings.ini or activiating trough Powershell. When we are using Powershell we can enable bitlocker but not exporting any Recovery key to a file.

 

Does anyone haev any suggestions how to get this to work?

​Kind regards,

EGGLAS

[ITS-Andy]

First of all. For BitLocker to start encrypt, TPM needs to be enabled on the computer you are deploying.

You can read more about the different vendor tools to enable TPM here --> https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker

[d88david]

I'm having the same issue. I do have TPM enable using the HP Tools with my task sequence. TPM  is enabled but bitlocker is not enable. Need Help!

[Damo]

I seem to remember that you need to enable settings in the registry in order to install bitlocker when away from MBAM/AD.  I Use the following reg entries on mine when they are standalone PCs

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE]
"EncryptionMethod"=dword:00000002
"DisallowStandardUserPINReset"=dword:00000000
"OSEnablePrebootInputProtectorsOnSlates"=dword:00000001
"UseAdvancedStartup"=dword:00000001
"EnableBDEWithNoTPM"=dword:00000000
"UseTPM"=dword:00000002
"UseTPMPIN"=dword:00000002
"UseTPMKey"=dword:00000000
"UseTPMKeyPIN"=dword:00000000

[d88david]

@ Damo... Thanks for the respond. Actually my bitlocker will be manage by AD so I don't I will need to make any changes to the registry.

[EGGLAS]

Update on this, we went with a script when the support logged on the PC they activated bitlocker and exported the recovery key. Not the best solution but this worked best in our case since the support anyway need to do some manually work before the user could have the PC. 

And Yes ITS-Andy TPM was activated   That was never an issue. 

 

[d88david]

@ Egglas...  we also have to manually enable bitlocker which encrypt the drive and it export the key to AD.  We are trying to get it automated with the task sequence but it just doesn't seem to work. TPM is enable and bios password is set but bitlocker doesn't get  enable. I'm so fustrated..