how can I Pre-Provision BitLocker in WinPE for Windows 8 deployments using Configuration Manager 2012 SP1 ?

[Config Mangler]

Got you now. You could try adding a prompt for OSDComputer name in the TS then it might get the correct computer name earlier.

 

It removes the zero touch element though.

 

We use the asset sticker as the computer name so it's not such a big deal in practice. I'll live with it for the benefits.

[Peter33]

All right,

 

mission impossible to get a proper name for this string since this is hard coded and not configurable by any command line options.

[Aurock]

With MDT integration enabled, the task sequence looks a bit different. The enable bitlocker step, in particular, doesn't offer the same options. If I create an MDT task sequence, does the pre-provisioning still work the same? Do I just need to pre-set variables for the bitlocker settings, such as BDEInstall, BDEPin, BDERecoveryKey, BDEKeyLocation, etc?

 

I ended up disabling the MDT 'enable bitlocker' step and adding a new 'enable bitlocker' step to the task sequence. That gave me the SC version of the step, and seems to be working properly.

 

Well, mostly. I can't get that step to take an enhanced bitlocker pin, but with a numeric pin it works. I wonder if it can't do it because enhanced pin has to be enabled by GPO, and SC doesn't seem to boot into the OS and run the later TS steps like MDT does... One of these days I'll get around to finding a way to set the enhanced pin automatically.

[rustychuck]

I just wanted to say that I have followed the post (which has been a great help thank you), however, I was experiencing great problems with the TPM Activation step on a Dell Latitude E6410 in the task sequence and it failing every time. Obviously without this step succeeding, the whole Pre-Provisioning feature doesn't work! After days of trying to resolve the issue it appears the problem is with the '=' after 'valsetuppwd'. If you remove the '=' the tpmactivation step works! Here's how it should be entered:

 

x:\CCTK\X86\cctk.exe --tpmactivation=activate valsetuppwd [bIOS Password]

 

I just wanted to share it so no one else goes pulls their hair out trying to get this to work. Obviously this may be different for different Dell models and BIOS versions.

[anyweb]

can you post a screenshot of where you had the issue please and i'll check it against mine

[rustychuck]

Here is a screen shot of my task sequence and the TPM Activation step. Let me know if you need a different screenshot...

 

[rustychuck]

Even though I have now got my TPM Activation sorted, when it gets to the Enable Bitlocker step it then fails the task sequence altogether. My Enable BitLocker step is currently about half way through my task sequence - do I need to move it towards the end of the sequence like it needed to be in SCCM 2007? When I go in to Windows after it fails, it says BitLocker is suspended and you cannot resume it due to it not having any keys.

[anyweb]

my step looks like so, and it works just fine, your logs should reveal what your issue really is, have you tried a bios upgrade on the dell ?

 

 

 

[rustychuck]

It is strange - I have done a BIOS upgrade to the latest version. It does work without the '=' so I will stick with that. The problem I am having at the moment is it fails on the Enable BitLocker step, however, I believe this may be to do with the fact that we have no Group Policy entry for 'Choose how BitLocker-protected operating system drives can be recovered'. I'm assuming without this Group Policy step configured the computer has no idea what to do with the recover keys?

[anyweb]

well the logs should reveal why it's failing to enable bitlocker so what does the smsts.log file say ?

also, please re-review the guide here as it explains what you need setup in AD prior to starting the deployment.