SCCM and Bitlocker migration, failing with error code 18

[NSCOTT]

I'm really confused and need some assistance. Long story short, we've been using straight GPO's for bitlocker forever. Management wants some reports that i cannot currently generate without SCCM or MBAM ingesting this service... as MBAM is going away in the future, so i'm just importing it all, or trying, into SCCM. 

- Computer

1. Decrypted the drive

2. Tossed the computer into an OU that has absolutely no bitlocker policies enabled  (verified via RSOP) 

- SCCM / MP 

- setup policies within SCCM 

- setup the web portals (we only wanted helpdesk, which is working) 

---- MPControl.log is showing it's verifying it's installed and running 

- Info

However, on the computer that i'm deploying out to, it's never starting the encryption, but i can get out to HTTPS//fqdn.com as well as HTTPS://FQDN.com/sms_mp_mbam/coreservice.svc 

Tried TPM only and TPM And pin - same thing is happening

 

 

Edited June 19 by NSCOTT
wrong screenshot

[anyweb]

which version of ConfigMgr is this ? and please take a look at my troubleshooting blogs to give you some ideas

 

[NSCOTT]

Crud, so sorry, thought i included that - Version 2403 - the latest release. 

Checking out the blog posts now - appreciate ya! 

[NSCOTT]

Alright, following along with your troubleshooting documentation and doing setup from scratch again 

• MP is EHTTP 
• IIS Site on MP is HTTPS 
• Client is in an OU with no GPO's for BL
• Client is completely decrypted

1. Created Policy
2. Deployed it to my test collection
3. MP created folder G:\SMS_CCM\Microsoft Bitlocker Management Solution 
4. MP created IIS site SMS_MP_MBAM
   1. SSL settings defaulted to "Require SSL" and "client certificates > ignore" (keeping this setup for now)
5. Client received and installed the MDOP MBAM software 
6. Client - Manage-bde -status shows fully decrypted, protection off, bitlocker version 2.0
7. Client - Bitlockermanagementhandler.log gives error "Could not check enrollment URL" 
   1. screenshots below
8. Client - Bitlockermanagement_grouppolicyhandler.log shows the same "could not check enrollment URL" error
9. Client - Policyagentprovider.log does show settings changes right after i created the change
10. Client - Regedit under the FVE group doesn't show "KeyRecoveryServiceEndPoint" 
    1. Screenshots below
11. Event viewer still showing the error "unable to connect to the MBAM recovery and hardware service" 
12. Client - can get to the HTTPS site of the MP via the following 
    1. https://<FQDN>/  
    2. https://<FQDN>/sms_mp_mbam/ (asks for ID and PW) 
    3. https://<FQDN>/sms_mp_mbam/coreservice.svc 
       1. Screenshot below
13. changed SSL settings on SMS_MP_MBAM to accept client certs - same issue 
14. changed SSL settings on the default MP site to accept client certs - same issue

it's somehow unable to communicate but i'm really unsure how if it's able to get to the HTTPS sites without any issue 

[NSCOTT]

for the heck of it, i enabled anonymous access on the SMS_MP_MBAM site and keep hitting a wall with that error 

[NSCOTT]

also, did create the reporting site with no errors (had a few, but realized i needed the URL from the SSRS site, all good now) 

still crapping out with that same error 

[NSCOTT]

bumping back up as i'm trying this again.

Imaged fresh computers and am no longer receiving that error pop up saying bitlocker could not be enabled. it's all silent now... so i've got that going for me. 

I am however still getting the bitlocker "unable to connect to the MBAM recovery and hardware service" under > microsoft windows mbam / admin in event viewer 

Anyone else got any ideas? https is enabled and cert bound on the IIS site on the MP.