%3CLINGO-SUB%20id%3D%22lingo-sub-280008%22%20slang%3D%22en-US%22%3ESupport%20Tip%3A%20Steps%20to%20Decrypt%20and%20Reencrypt%20a%20BitLockered%20Device%20%26amp%3B%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-280008%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSTRONG%3EFirst%20published%20on%20TechNet%20on%20Aug%2018%2C%202017%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%20In%20this%20post%2C%20we're%20sharing%20where%20to%20find%20a%20list%20of%20BitLockered%20devices%20in%20the%20Intune%20console%20and%20pulling%20together%26nbsp%3Btwo%20different%20ways%20to%26nbsp%3Bdecrypt%20and%20reencrypt%20a%20BitLockered%20device.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20First%20off%2C%20to%20find%20which%20devices%20are%20BitLockered%20in%20console%2C%20just%20go%20to%20Device%20configuration-Profiles%2C%20select%20your%20Endpoint%20protection%20profile%2C%20then%20in%20the%20blade%20that%20extends%20out%2C%20select%20device%20status%20and%20you%20can%20see%20deployment%20status%20of%20the%20devices.%20You%20can%20read%20more%20about%20configuring%20Windows%2010%20endpoint%20protection%20in%20the%20documentation%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fintune%2Fendpoint-protection-windows-10%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20https%3A%2F%2Fdocs.microsoft.com%2Fintune%2Fendpoint-protection-windows-10%20%3C%2FA%3E%20.%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Now%2C%20for%20those%20devices%20that%20you%20are%20going%20to%20decrypt%20and%20reencrypt%2C%20you'll%20want%20to%20make%20sure%20that%20you%20or%20your%20end%20user%20can%20provide%20administrative%20credentials%20to%20take%20the%20following%20steps.%20In%20addition%2C%20the%20drive%20must%20be%20BitLocker-protected.%20%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EOn%20the%20BitLockered%20device%2C%20Click%20%3CSTRONG%3E%20Windows%20Start%20%3C%2FSTRONG%3E%20%2C%20click%20%3CSTRONG%3E%20Control%20Panel%20%3C%2FSTRONG%3E%20%2C%20click%20%3CSTRONG%3E%20System%20and%20Security%20%3C%2FSTRONG%3E%20%2C%20and%20then%20click%20%3CSTRONG%3E%20BitLocker%20Drive%20Encryption%20%3C%2FSTRONG%3E%20.%20Click%20the%20%3CSTRONG%3E%20Turn%20off%20BitLocker%20%3C%2FSTRONG%3E%20.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EFollow%20the%20steps%20here%20to%20sync%20your%20device%20to%20get%20the%20latest%20settings%20from%20Intune%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune-user-help%2Fsync-your-device-manually-windows%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune-user-help%2Fsync-your-device-manually-windows%20%3C%2FA%3E%20.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EAfter%20sync%2C%20your%20end%20user%20will%20receive%20a%20notification%20to%20encrypt%20provided%20you%E2%80%99ve%20set%20the%20%E2%80%9CRequire%20bitlocker%E2%80%9D%20setting%20as%20shown%20in%20the%20Intune%20on%20Azure%20console%26nbsp%3Bin%20the%20screen%20shot%20below%26nbsp%3B(credit%20to%20%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fcbernier%2F2017%2F07%2F11%2Fwindows-10-intune-windows-bitlocker-management-yes%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20Courtenay%20Bernier%20%3C%2FA%3E%20%E2%80%99s%20detailed%20blog%20on%20BitLocker%20for%20this%20screen%20shot).%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CUL%3E%0A%3CLI%3EFinally%2C%20if%20you%20prefer%2C%20you%20can%20also%20use%20PowerShell%20to%20disable%26nbsp%3BBitLocker%20as%20shown%20in%20the%20steps%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Ftechnet.microsoft.com%2Fitpro%2Fpowershell%2Fwindows%2Fbitlocker%2Fdisable-bitlocker%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%20https%3A%2F%2Ftechnet.microsoft.com%2Fitpro%2Fpowershell%2Fwindows%2Fbitlocker%2Fdisable-bitlocker%20%3C%2FA%3E%20.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%20%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20300px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F58610iACF7291766BF02F6%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20%2F%3E%3C%2FSPAN%3E%20%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Let%20us%20know%20if%20you%20have%20any%20questions%20on%20this%20Support%20Tip!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-280008%22%20slang%3D%22en-US%22%3E%3CP%3EFirst%20published%20on%20TechNet%20on%20Aug%2018%2C%202017%20In%20this%20post%2C%20we're%20sharing%20where%20to%20find%20a%20list%20of%20BitLockered%20devices%20in%20the%20Intune%20console%20and%20pulling%20together%26nbsp%3Btwo%20different%20ways%20to%26nbsp%3Bdecrypt%20and%20reencrypt%20a%20BitLockered%20device.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-280008%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Ebitlocker%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-829139%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%3A%20Steps%20to%20Decrypt%20and%20Reencrypt%20a%20BitLockered%20Device%20%26amp%3B%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-829139%22%20slang%3D%22en-US%22%3E%3CP%3ESeems%20like%20a%20bit%20of%20an%20oversight%20here.%20I'm%20not%20sure%20if%20there's%20any%20updated%20documentation%20but%20a%20number%20of%20Surface%20Pro%20tablets%20or%20even%20Dell%20Latitude%20tablets%20come%20encrypted%20already%20(from%20my%20observations%2C%20usually%20Used-Space%20Only%20and%20AES128).%20Since%20the%20majority%20of%20organizations%20don't%20allow%20users%20to%20have%20administrative%20rights%2C%20it%20would%20make%20more%20sense%20for%20Intune%20to%20handle%20the%20decryption%20as%20a%20system%20account%20or%20another%20way%20that%20doesn't%20require%20administrative%20credentials.%20Also%2C%20it%20sounds%20like%20if%20the%20Intune%20BitLocker%20policy%20detects%20a%20lower%20level%20of%20decryption%2C%20it%20simply%20does%20nothing.%20What%20I'd%20ultimately%20like%20to%20see%20is%20the%20following%20--%3C%2FP%3E%3CUL%3E%3CLI%3EIntune%20BitLocker%20Policy%20is%20applied%3C%2FLI%3E%3CLI%3EPolicy%20sees%20device%20is%20currently%20encrypted.%26nbsp%3B%3C%2FLI%3E%3CLI%3ECheck%20-%20Higher%20level%20of%20encryption%3F%20Decision%20-%26gt%3B%20either%20decrypt%20and%20encrypt%20with%20what%20is%20defined%20in%20policy%3C%2FLI%3E%3CLI%3ECheck%20-%20Lower%20level%20of%20encryption%3F%20Decrypt%20the%20machine%20and%20encrypt%20with%20what%20is%20defined%20in%20polic%3C%2FLI%3E%3C%2FUL%3E%3CP%3EMaybe%20I%20just%20missed%20it%20in%20the%20documentation%20but%20I've%20waited%20at%20least%20two%20days%20for%20BitLocker%20to%20kick%20in%20and%20enforce%20Full%20Disk%20Encryption%20with%20XTS-AES256%20over%20simply%20AES256%20and%20Used-Space%20Only.%3C%2FP%3E%3C%2FLINGO-BODY%3E

First published on TechNet on Aug 18, 2017
In this post, we're sharing where to find a list of BitLockered devices in the Intune console and pulling together two different ways to decrypt and reencrypt a BitLockered device.

First off, to find which devices are BitLockered in console, just go to Device configuration-Profiles, select your Endpoint protection profile, then in the blade that extends out, select device status and you can see deployment status of the devices. You can read more about configuring Windows 10 endpoint protection in the documentation here: https://docs.microsoft.com/intune/endpoint-protection-windows-10 .

Now, for those devices that you are going to decrypt and reencrypt, you'll want to make sure that you or your end user can provide administrative credentials to take the following steps. In addition, the drive must be BitLocker-protected.

    • On the BitLockered device, Click Windows Start , click Control Panel , click System and Security , and then click BitLocker Drive Encryption . Click the Turn off BitLocker .

 

 

    • After sync, your end user will receive a notification to encrypt provided you’ve set the “Require bitlocker” setting as shown in the Intune on Azure console in the screen shot below (credit to Courtenay Bernier ’s detailed blog on BitLocker for this screen shot).

 





Let us know if you have any questions on this Support Tip!

1 Comment
Occasional Contributor

Seems like a bit of an oversight here. I'm not sure if there's any updated documentation but a number of Surface Pro tablets or even Dell Latitude tablets come encrypted already (from my observations, usually Used-Space Only and AES128). Since the majority of organizations don't allow users to have administrative rights, it would make more sense for Intune to handle the decryption as a system account or another way that doesn't require administrative credentials. Also, it sounds like if the Intune BitLocker policy detects a lower level of decryption, it simply does nothing. What I'd ultimately like to see is the following --

  • Intune BitLocker Policy is applied
  • Policy sees device is currently encrypted. 
  • Check - Higher level of encryption? Decision -> either decrypt and encrypt with what is defined in policy
  • Check - Lower level of encryption? Decrypt the machine and encrypt with what is defined in polic

Maybe I just missed it in the documentation but I've waited at least two days for BitLocker to kick in and enforce Full Disk Encryption with XTS-AES256 over simply AES256 and Used-Space Only.