Forum Discussion

marckuhn's avatar
marckuhn
Brass Contributor
Aug 12, 2021

Endpoint security - Device encryption policy shows error

Hi all   i have around 100 new HP Elitebooks which i want to configure with Bitlocker. We would like to accomplish this in the Endpoint security section and created a Device encryption policy accor...
Bitlocker Encryption
device encryption
Endpoint Security
  • BilalelHadd's avatar
    BilalelHadd
    Aug 13, 2021

    Hi Marc,

     

    Check if you can re-image the Windows 10 client to be sure.


    Below the settings that difference from yours:
    - BitLocker - Base Settings
    Require storage cards to be encrypted (mobile only): Yes
    Configure client-driven recovery password rotation: Azure AD-Joined devices only

    BitLocker - Fixed Drive Settings
    Enable BitLocker after recovery information to store: Not configured

    BitLocker - OS Drive Settings
    Compatible TPM startup : Allowed
    Compatible TPM startup PIN: Blocked
    Compatible TPM startup key: Blocked
    Compatible TPM startup key and PIN: Blocked
    Enable BitLocker after recovery information to store: Not configured
    Block the use of certificate-based data recovery agent (DRA): Yes

    BitLocker - Removable Drive Settings
    Block write access to removable data-drives not protected by BitLocker: Yes

    Hope this helps, and keep me posted.

    Regards, Bilal

BilalelHadd's avatar
BilalelHadd
Iron Contributor
Aug 13, 2021

Hi Marc,

 

Check if you can re-image the Windows 10 client to be sure.


Below the settings that difference from yours:
- BitLocker - Base Settings
Require storage cards to be encrypted (mobile only): Yes
Configure client-driven recovery password rotation: Azure AD-Joined devices only

BitLocker - Fixed Drive Settings
Enable BitLocker after recovery information to store: Not configured

BitLocker - OS Drive Settings
Compatible TPM startup : Allowed
Compatible TPM startup PIN: Blocked
Compatible TPM startup key: Blocked
Compatible TPM startup key and PIN: Blocked
Enable BitLocker after recovery information to store: Not configured
Block the use of certificate-based data recovery agent (DRA): Yes

BitLocker - Removable Drive Settings
Block write access to removable data-drives not protected by BitLocker: Yes

Hope this helps, and keep me posted.

Regards, Bilal

marckuhn's avatar
marckuhn
Brass Contributor
Aug 13, 2021

Hi Bilal

many thanks for your details, i did a Fresh Start again and see now, that the policy has been successfully applied :-). The status in the cmd is a little slow still showing "Encryption in Progress" but i'm optimistic now, that this is better.

 

I will play around a little more after i see that everything is okey now to find the setting, which was causing that issue.

 

Thanks already for your help, much appreciated!

 

Best regards,

Marc

Resources