Bitlocker

Updated Bitlocker Experience with Windows 10 Insider and Intune

Standard

This blogpost describes the current Bitlocker experience on Windows 10 1709 and the experience with the Windows 10 1803 Insider Build release (Build number: 17101 and 17107). In this blogpost I’m using Microsoft Intune to configure the Bitlocker settings on the client. Within Microsoft Intune a setting is added to improve the Bitlocker experience. Since this setting only has a different behavior on Windows 10 1803 Insider builds don’t expect any improvements on Windows 10 1709. To be complete in this post I will also describe the experience with Windows 10 1709.

This blog post uses the AllowWarningForOtherDiskEncryption setting of the Bitlocker configuration service provider (CSP), to silently enable Bitlocker on Windows 10 1803 devices. Windows 10 1803 is currently available as Insider Preview build.
Continue reading

Backup Bitlocker Recovery Key with Intune PowerShell

Standard

This weeks blogpost is about the new PowerShell capabilities we get through the Intune Management Extension. This new capability is released in the latest Intune release from 2 weeks ago. With the ability to run PowerShell on MDM managed devices many scenarios are possible. The scenario I wanted to test is to add an additional Bitlocker Recovery key to the Bitlocker configuration. If you’ve applied an Intune Endpoint Protection policy this key is automatically saved into AzureAD. From the past I know that this is not easy because we need to run the scripts in an elevated PowerShell user session. But I accepted the challenge and I got it working. Credits also to my colleague David Omisi since he helped me developing the PowerShell script.
Continue reading

Configure Endpoint Protection (Bitlocker) with Intune on Windows 10

Standard

In this blogpost I want show you how to use the Endpoint Protection (Bitlocker) policy within Intune to configure Bitlocker on Windows 10. With Endpoint Protection policies you can configure and enforce Bitlocker on your Windows 10 devices. With the old policies we could already enforce Bitlocker but not enforce the settings of Bitlocker. With Windows 10 1703 the user interface for the end user was already improved but still the user needs to select the Bitlocker settings themselves. There are some settings where the user need to make the right decision and probably not all users know the consequences of some of the settings. The setting about saving the recovery key is for me to most important one. In a MDM scenario I want to enforce that the key will be saved in AzureAD an not locally on a USB drive. So most of the time I want to enforce this setting and more ideal I just want to enable it for the user without disturbing the user.
Continue reading