On-premises BitLocker management using System Center Configuration Manager

[Mujja]

Hi Niall

Thanks for the great video tutorials and past SCCM guides.

This is my first experience of MBAM and I've managed to follow your guides to deploy MBAM polices and portals in SCCM 1910 and MECM 2002. I now want to move on to including MBAM in the OSD task sequence. There are a few posts on various forums with conflicting information but no complete guide and mostly written for standalone MBAM or Windows 7.

If you have time please create a new step\video to show how it's done by the professionals

[Mripra]

On 5/6/2020 at 1:46 PM, anyweb said:

yes its possible, if you are using SCCM 1910 follow my video

if you are using MEM 2002 then set the corresponding settings in the wizard to have no delay

Hi Niall,

Thank you, I deployed it to 10 test units over the VPN.

Only 1 so far worked as intended.

Few Question.

- I can see in my BitlockerMangaement GroupPolicyHandler that its trying to enforce keys into registry. But I am not seeing them other then those 2 custom one enforce using baselines. Is there way for it get force more frequently?  

Screen Shot

I will be updating SCCM to 2002 soon too.

[anyweb]

is your mdop client agent installed ? what's present in the FVE reg key ?

[Mripra]

13 minutes ago, anyweb said:

is your mdop client agent installed ? what's present in the FVE reg key ?

Yes it is. 
agent: http://prntscr.com/sjqbkx

FVE Key: only sccm enfore baseline from the Part 4. : http://prntscr.com/sjqee1

 

[anyweb]

that's the MDOPBitLockerManagent key, what's the parent FVE key? also is your configmgr client agent the correct version ? is the computer in a collection targeted with the bitlocker management policy ?

[Mripra]

FVE only has MDOP folder. I have the latest ConfigMagr Client. Also my laptop is in the correct collection.

 

 

[anyweb]

ok you don't understand what i'm saying, do you have teamviewer so i can take a look ?

[Mripra]

19 hours ago, anyweb said:

that's the MDOPBitLockerManagent key, what's the parent FVE key? also is your configmgr client agent the correct version ? is the computer in a collection targeted with the bitlocker management policy ?

May be is this what you mean? : http://prntscr.com/sjx7f3

17 hours ago, anyweb said:

ok you don't understand what i'm saying, do you have teamviewer so i can take a look ?

Yes I do.

 

 

[Mripra]

5-20-20

So after looking at the log BitlockerManagement_GroupPolicyHandler I saw its try to inject registry keys. See the screen shot below.

http://prntscr.com/skckgu

But when I check registry are not there. Any idea? Hope I am making sense.

[anyweb]

and once again it's complaining that what's in FVE is not compliant,

so what are the registry keys you have listed in FVE ?

this path..