Windows 10 BitLocker Management Options
Introduction : Starting in version 1910, use Configuration Manager to manage BitLocker Drive Encryption (BDE) for on-premises Windows clients, which are joined to Active Directory. It provides full BitLocker lifecycle management that can replace the use of Microsoft BitLocker Administration and Monitoring (MBAM). Configuration Manager doesn't enable this optional feature by default. You must enable this feature before using it. Configuration Manager provides the following management capabilities for BitLocker Drive Encryption: •Deploy the BitLocker client to managed Windows devices running Windows 10 or Windows 8.1 •Manage BitLocker policies and escrow recovery keys for on-premises and Internet-based clients (Internet-based clients requires version 2010) •Compliance reports •Administration and Monitoring web site: allows other roles in your organization (for example Help Desk) outside of the Configuration Manager console to help with key recovery, including key rotation and other BitLocker-related support •User self-service portal: lets users help themselves with a single-use key for unlocking a BitLocker encrypted device. Once this key is used, it generates a new key for the device Basic requirements : The general requirements for Configuration Manager to manage BitLocker are: •Reporting Services Point (for reports) •HTTPS on the Management Point (for key recovery) •Self-service portal or the administration and monitoring website require an IIS server, this can be a site system or a dedicated server •BitLocker management isn't supported on virtual machines (VMs) or on server editions •Azure Active Directory (Azure AD)-joined, workgroup clients, or clients in untrusted domains aren't supported. BitLocker management in Configuration Manager only supports devices that are joined to on-premises Active Directory. Hybrid Azure AD-joined devices are also supported. Best practice: Encryption: Encrypt recovery data on the network: Required for recovery key escrow Uses https to the Management Point Different procedures to enable this capability depending on the CM build Encrypt recovery data in the database: Requires a SQL Server certificate (the certificate must then be managed) Option to encrypt only recovery data (recommended) vs the entire site database (may reduce performance by 25%) Recovery keys are never deleted – allows recovery of data from a device that was stolen and later retrieved. Each encrypted volume adds up to 9 KB to the site database. Best practice: Deployment BitLocker management in Configuration Manager includes the following components: BitLocker management agent: enabled when you create a policy and deploy it to a collection Recovery service: The server component that receives BitLocker recovery data from clients Before deploying BitLocker management policies, enable network encryption (required) and data encryption (recommended). Also, make sure that the partitions on the clients are ready to support BitLocker (see slide Best practice: General Deployment) To create a BitLocker management policy: The Full Administrator role in Configuration Manager is needed Operating System Drive, Fixed Drive, Removable Drive, and Client Management options are available When you create more than one policy, you can configure their relative priority. If you deploy multiple policies to a client, it uses the priority value to determine its settings. Starting in version 2006, you can also use Windows PowerShell cmdlets for this task. Monitoring BitLocker deployment: Basic compliance statistics about the policy deployment are shown in the details pane of the BitLocker Management node: •Compliance count •Failure count •Non-compliance count To understand why clients are reporting not compliant with the BitLocker management policy, non-compliance codes are used Dedicated client logs can also be retrieved for additional troubleshooting Group Policy: It is recommended to not use any BitLocker Group Policy settings along with Configuration Manager, as the GPOs will override the CM settings and result in unpredictable behavior Re-encryption If a drive is already encrypted with BitLocker, the CM agent will not re-encrypt the drive, but will evaluate the CM policy against the current settings – if these don’t match (for example because of different encryption algorithms), CM will report the device as non-compliant (but the device is still protected) To work around this issue, it is necessary to decrypt the volumes first, then re-encrypt them TPM password hash: Windows 10 does not save the TPM password – this applied to previous versions of Windows Co-management: The Configuration Manager client handler for BitLocker is co-management aware. If the device is co-managed, and you switch the Endpoint Protection workload to Intune, then the Configuration Manager client ignores its BitLocker policy. The device gets Windows encryption policy from Intune Switching encryption management authorities while maintaining the desired encryption algorithm doesn't require any additional actions on the client. However, if you switch encryption management authorities and the desired encryption algorithm also changes, you will need to plan for re-encryption. Best practice: BitLocker portals The BitLocker CM portals must be installed separately: User self-service portal Administration and monitoring portal (for help desk and admins) Starting in version 2006, you can install the BitLocker self-service portal and the administration and monitoring website at the central administration site. In version 2002 and earlier, only install the self-service portal and the administration and monitoring website with a primary site database. In a hierarchy, install these websites for each primary site HTTPS for these portals is not mandatory, but highly recommended You can install the portals on an existing site server or site system server with IIS installed, or use a standalone web server to host them. Their usage is typically low, so the additional load they generate is negligible, so there is typically no need to use a dedicated web server, unless this is to honor network segmentation policies Portal customizations: The self-service portal can be customized with a custom notice, your organization name, and other organization-specific information Roadmap: On-prem management BitLocker Management + CAS/Hierarchy support (2006 release) BitLocker Management support over CMG (2010 release) Listing on-prem stored BitLocker recovery key for ConfigMgr tenant attach in the Microsoft Endpoint Management cloud console (CY 2021)