[sccm 2012] Bitlocker within OSD

[clareq]

I'm attempting to get bitlocker to work within a task sequence. I've tested that the machine will bitlocker manually, and then hit my first issue - once a machine is "bitlockered" how do you rebuild it? I'm getting an error at the beginning of the task sequence, as there is no room for any files to write to the c drive. It's not even hitting my "disable bitlocker" task. I've used diskpart to wipe the drive for my testing, but we can't do that in production. Is there a way of automatically running a diskpart script before the task sequence is started?

[clareq]

OK, I'm putting that aside for the minute. I can bitlocker manually but running it within the task sequence doesn't seem to work. I'm going round in circles now. Does anyone know of a working guide to enabling bitlocker during OSD for any model of laptop (I can see guides which point to a Dell utility for Dell laptops, but we have a mixture of models)

[SYNACK]

Not MDT but close @TheScarfedOne has a series of blog posts which may shed light

SCCM, Windows 7 and Bitlocker - Part 1 - Blogs - EduGeek.net

http://www.edugeek.net/blogs/thescarfedone/621-sccm-windows-7-bitlocker-part-2.html

http://www.edugeek.net/blogs/thescarfedone/630-sccm-windows-7-bitlocker-part-3.html

Edited June 25, 2014 by SYNACK

[clareq]

I've looked at that, but it appears to be for SCCM 2007 - I'm using 2012, and so can't get the task sequence to import, so I can see exactly how he's done it.

[SYNACK]

You can read the XML in the zip from the second blog raw and get a good idea, the sequence does all the formatting then installs the OS and only enables bitlocker just before the first restart.

[clareq]

That's how I set it up the first time. Bitlocker enabled itself, but suspended. When I tried to manually enable I got an error message about not being able to delete all keys. I don't remember it exactly I'm afraid.

[Arthur]

@clareq What make / model are your PCs?

 

I have Bitlocker working in SCCM 2012 with some E-Series Dell Latitude's. Most of the steps use the CCTK to modify the TPM though, so it probably won't be of much help if you do not have Dell's.

[clareq]

We Have Dell, Samsung, Lenovo, Ergo and Toshiba!

[Sam_Brown]

I've set our Stone Laptops to bitlocker through SCCM 2012 at build time.

 

I have a "Set Reg for BitLocker" step in our Task Sequence which runs the command:

 

reg.exe ADD HKLM\Software\Policies\Microsoft\TPM /v RequireActiveDirectoryBackup /t REG_DWORD /d "1" /f

 

Then the next step is the standard "Enable BitLocker" step which we've set to "TMP and PIN" and store the key in "ADDS".

 

We also have it set to wait for it to complete the encryption before finishing.

 

I seem to remember some of our SSDs having issues encrypting and needing to alter the partitioning of the disks slightly to get it working and another case where it wasn't keeping the correct drive letter with some laptops that was causing an issue as well.

[clareq]

Thank you @Sam_Brown. I've shelved bitlocker for the moment - we can run bitlocker manually at deployment if necessary. Once I've finished the rest of my list of jobs I'll revisit it, and certainly take a look at your suggestion. I've also looked at MDOP and MBAM (I'm sure they're on the Flintstones!) and we might try using that to manage bitlocker. I have a little time to sort this out.

[Arthur]

We Have Dell, Samsung, Lenovo, Ergo and Toshiba!

I can post the task sequence steps I use for encrypting our Dell's at some point if you'd find that helpful?

[clareq]

Thank you @Arthur. That would be appreciated.

[TheScarfedOne]

Hi all, sorry, late to this thread. I'm now using SCCM 2012 R2 and still using the same. I will export the ts again tomorrow so that you will be able to use it. Have you got the supporting files...

[clareq]

I believe so.

[Blue_Cookeh]

Sorry for the bump.

 

Just to let you know, I've ended up not bothering with the BitLocker pre-provisioning in SCCM, rather I deployed MBAM today to a couple of test devices (W8.1, one with TPM and one without) and it seems to have been successful. I'll be looking at rolling this out to our staff soon... a bit overkill for the amount of laptops we have but heyho!

[clareq]

I think I got a step nearer today - I managed to start bitlocker entirely from the command line. If I can make the same commands work in a TS I'm laughing.

[TheScarfedOne]

Sorry for the bump.

 

Just to let you know, I've ended up not bothering with the BitLocker pre-provisioning in SCCM, rather I deployed MBAM today to a couple of test devices (W8.1, one with TPM and one without) and it seems to have been successful. I'll be looking at rolling this out to our staff soon... a bit overkill for the amount of laptops we have but heyho!

 

MBAM is supposed to be very good, and actually what I want to move too (and you should be able to integrate with SCCM still to I read somewhere)...