On-premises BitLocker management using System Center Configuration Manager

[Mripra]

6 minutes ago, anyweb said:

and once again it's complaining that what's in FVE is not compliant,

so what are the registry keys you have listed in FVE ?

this path..

 

sry.. I posted in my edited reply...one above.

https://prnt.sc/sjx7f3

 

[anyweb]

ok well there's nothing there at all so this is not working, pm me your teamviewer details if you want me to connect and take a look

[Mripra]

So after doing more testing found out that its the VPN issue. My test machine even the laptops when they go to office network the keys get populates and encryption starts Silently.

Now the question is why it don't get populated when its connected to VPN even after it try check in with SCCM server once connected?

[anyweb]

I've asked a PM in Microsoft for comment on this, it could be that your vpn solution is blocking some communication between the clients and the MP, but let's see what he says

[Hectaaaa]

Hi Niall, 

 

I'm currently running MECM 2002 and I have followed your guides but I want to use the bitlocker encryption certificate  so I have followed the Microsoft documentation. I have created the cert but I get and error when trying to produce the policy in MECM. The error is Plain text storage of recovery information required when the Bitlocker Management encryption certificate has not been deployed. Where do I have to deploy it too? I have two management points both on prem one is an IBCM both using HTTPS. Thank you

EDIT: I had the policy open while I created the cert. Closing the policy window and relaunching fixed the issue. Thank you

Edited June 11, 2020 by Hectaaaa
Fixed it.

[anyweb]

thanks for posting the solution so others will find it !

 

[Hectaaaa]

Quick Question, 

Currently we are in the process of switching to co management but still pilot testing. I just found out that Intune has it's own Bitlocker management tools so did I waist all my time setting up on-prem MBAM? or can I still use it to access and manage key information? If I can still use it, is it possible to setup the Self service portal on an IBCM point? It is currently setup on the primary management point that is setup for Intranet clients only. 

 

Also sorry if I am posting this in the wrong area still learning how to navigate the site. 

Thank you,

[anyweb]

Having your Bitlocker Management keys stored on your on premise database (ConfigMgr) is an asset to many customers, and also gives you time to migrate to Intune and see the different ways it can manage your recovery keys,

you could create an Azure web app proxy to connect back to the on-premise  server handling the requests.

[zophar]

Hello Windows-Noob

I have implemented already 2 years ago IBCM - PKI infrastructure - however when I try to execute Bitlocker I 'm still getting following error

Unable to find suitable Recovery Service MP. Forcing policy non-compliant.

I always thought everything was going well   - no issues with deploying software - no issues with policies/ configuration baseline - no issues with windows updates BUT we have a SCCM HTTP (lab) and there I saw that the client indicates his 'Assigned Management Point' and that is not the case with our non domain/workgroup machines. In LocationServices LOG there is the following error  1 internet MP errors in the last 10 minutes, threshold is 5.

So my guess is there is something wrong !! I saw blogs on the internet for IBCM PKI enabled where Assigned Management Point entry is filled in.

Anyone ?

[anyweb]

hiya and welcome,

can you look at the network tab of your IBCM client ? my (co managed, forced internet client) looks like this