Forum Discussion
Puzzling BitLocker Status
- Mmm, I would start to make sure those other compatible tpm startup are blocked as shown here
https://call4cloud.nl/2021/02/b-for-bitlocker/
I spent a lot of time looking at logs, especially the Device Management logs in Event Viewer. In those logs I see a series of 3 events happening on the configured devices. I've included those events in the order they happen. I've also attached screenshots of the BitLocker settings.
Event Type: Warning
Event ID: 2900
Source: DeviceManagement-Enterprise-Diagnostics-Provider
Description:
BitLocker CSP: GetDeviceEncryptionComplianceStatus indicates OSV is not compliant with returned status 0x80
Event Type: Error
Event ID: 810
Source: DeviceManagement-Enterprise-Diagnostics-Provider
Description:
MDM PolicyManager: Set policy string, Policy: (SystemDrivesRequireStartupAuthentication), Area: (BitLocker), EnrollmentID requesting set: (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx), Current User: (Device), String: (<enabled/><data id="ConfigureNonTPMStartupKeyUsage_Name" value="false"/><data id="ConfigureTPMStartupKeyUsageDropDown_Name" value="0"/><data id="ConfigurePINUsageDropDown_Name" value="3"/><data id="ConfigureTPMPINKeyUsageDropDown_Name" value="3"/><data id="ConfigureTPMUsageDropDown_Name" value="1"/>), Enrollment Type: (0x6), Scope: (0x0), Result:(0x8000FFFF) Catastrophic failure.
Event Type: Error
Event ID: 404
Source: DeviceManagement-Enterprise-Diagnostics-Provider
Description:
MDM ConfigurationManager: Command failure status. Configuration Source ID: (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx), Enrollment Name: (MDMDeviceWithAAD), Provider Name: (BitLocker), Command Type: (Add: from Replace or Add), CSP URI: (./Device/Vendor/MSFT/BitLocker/SystemDrivesRequireStartupAuthentication), Result: (Catastrophic failure).
https://call4cloud.nl/2021/02/b-for-bitlocker/
Once againRudy_Ooms_MVP to the rescue! I changed the 3 settings that you pointed out and the devices all changed to "Succeeded" after a bit. Thank you!!
- 🙂 nice to hear!! Glad its working! Those 3 settings are easily forgotten… not configured doesnt mean its disabled 🙂
I guess i need to add a button to my website: “buy me a beer” 😛- I expect that you'd have to buy a bigger fridge first. 🙂
Thanks again!
- What, if any, impact will there be to the devices that already have the policy if I change it from 'Not Configured' to 'Blocked'?