Bitlocker and MBAM

[Kevin79]

I want to use Stand-alone media to install systems that aren't currently connected to our domain. The computers will eventually be connected and joined to the domain. Is there a way to enable bitlocker and install MBAM during the OS install and have it register in the MBAM database when it joins to the domain?

[SCCMentor]

No. Since the process will need to talk to the MBAM endpoints

[Kevin79]

How do I set up my task sequence and settings so that it prepares the partitions during OSD but doesn't actually bitlocker it until after I join to the domain? 

[keilamym]

you can run the BDEHDCFG.EXE command to prep the partition

 

for example: BDEHDCFG.EXE -QUIET -TARGET DEFAULT

[Config Mangler]

I don't see a problem with this. Install the MBAM client in your build or distribute after build time.

Set up MBAM server and associated group policy.

When it joins the domain you'll get group policy and the MBAM client will kick in and prompt the user for a PIN and encryption will start.

You need to add some REG keys to make this happen quickly

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement]
"ClientWakeupFrequency"=dword:00000001
"StatusReportingFrequency"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MBAM]
"NoStartupDelay"=dword:00000001