Endpoint security - Device encryption policy shows error

[marckuhn]

Hi all

i have around 100 new HP Elitebooks which i want to configure with Bitlocker. We would like to accomplish this in the Endpoint security section and created a Device encryption policy according to this article: Best Practices for Deploying BitLocker with Intune | Petri

I have the issue, that in Intune it shows that the policy has an error. When i click on the error, everything shows successful (see printscreen intune1)

When i check the report, i have as far as i can say everything correct there for my Test Device (see printscrren Intune2).

When i check on the device i see the only the used space is encrypted (see printscreen bitlocker).

Does anybody know how i could correct the error as well is that the recommended configuration to have only the used space encrypted?

Many thanks for your feedback

Best regards,

Marc

[#2]

Hi Marc,

How does your assignment look like? Did you apply this policy on user- or device groups?

[#3]

Hi Bilalel

i assigned it to the device group of all Windows devices. I'm not a 100% sure when to use device and when user policy.

What would you recommend?

Best regards
Marc

[#4]

Hi Marc,

When did you create the endpoint security profile? Sometimes it can take some time before the status changes. I've seen in the past that the status returned, is not always up to date. And indeed, you should apply this policy to device groups.

To give an answer to your question regarding device group assignment of user group assignment, it depends on the configuration, but choose for device group assignment if you want to apply settings on a device, regardless of who's signing in, it will always apply the configuration. Choose a user group assignment if you want to apply profile settings.

Regards, Bilal

[#5]

Hi Bilal

i'm working already with the device a couple of days. In the eventlog i don't see any issues for Bitlocker.

Thanks for your feedback on this. I will keep an eye on it, probably it will solve it one time.

So then probably that isn't an issue, just shows the error there.

Is it normal for the Bitlocker to have the used space encrypted only?

Or shouldn't this be the whole drive?

Many thanks and best regards
Marc

[#6]

Hi Marc,

Are you sure that there are no duplicates within the Bitlocker settings? You don't have any device configuration set that also configures Bitlocker settings?

When I run the command manage-bde -status it shows me that the drive is Fully Encrypted instead of "Used space only". When I have a look at the blogpost you've shared and my own configuration, we have nearly the same settings, nothing special. So it's strange that it behaves differently at your side.

More then welcome and regards, Bilal

[#7]

Hi @BilalelHadd 

thanks for your update. I removed all Configuration Profiles and Compliance Profiles, even all Endpoint Security profiles i had in place and did a fresh start with my Test Device.

I recognized, that the error in the device encryption policy is already there even before the device has finished with the encryption of the drive.

You mentioned that you have almost the same settings for your devices. Can you let me know, which settings are different? I read also somewhere that when the setting "Hide prompt about third-party encryption" is set to yes, this means silent config, which uses "Used space only".

Many thanks for your feedback.

Best regards,

Marc 

[#8 · Accepted solution]

Hi Marc,

Check if you can re-image the Windows 10 client to be sure.

Below the settings that difference from yours:
- BitLocker - Base Settings
Require storage cards to be encrypted (mobile only): Yes
Configure client-driven recovery password rotation: Azure AD-Joined devices only

BitLocker - Fixed Drive Settings
Enable BitLocker after recovery information to store: Not configured

BitLocker - OS Drive Settings
Compatible TPM startup : Allowed
Compatible TPM startup PIN: Blocked
Compatible TPM startup key: Blocked
Compatible TPM startup key and PIN: Blocked
Enable BitLocker after recovery information to store: Not configured
Block the use of certificate-based data recovery agent (DRA): Yes

BitLocker - Removable Drive Settings
Block write access to removable data-drives not protected by BitLocker: Yes

Hope this helps, and keep me posted.

Regards, Bilal

[#9]

Hi Bilal

many thanks for your details, i did a Fresh Start again and see now, that the policy has been successfully applied :-). The status in the cmd is a little slow still showing "Encryption in Progress" but i'm optimistic now, that this is better.

I will play around a little more after i see that everything is okey now to find the setting, which was causing that issue.

Thanks already for your help, much appreciated!

Best regards,

Marc