SCCM 2012 R2 Win 10 Bitlockering

[DalekSec]

I have got up and running a windows 10 task sequence, all works fine bar the bitlocker (works fine on the windows 7 TS).

 

It looks like it does encrypt the drive but once logged in you have to activate it, in explorer the HDD has a warning symbol on it.

 

Once activated it does switch on encryption, trouble being is it saves it to a file and not to AD.

 

I know I can do a powershell script to put it in AD but I would prefer not to do this every time I build a laptop.

 

Thanks

 

Dalek

[clareq]

I found it easier in Win 10 - the only fiddly bit was were to put the tasks so it doesn't reboot before it writes back to AD:

[DalekSec]

I found it easier in Win 10 - the only fiddly bit was were to put the tasks so it doesn't reboot before it writes back to AD:

 

Looks very close to my setup, only difference I see is that the Pre-Provision is after you setup windows, where as mine is before. I've now changed it to after and giving it another go!

[clareq]

When I had it before I'd be locked out of the machine once it rebooted after installing Windows. Took me a while moving around tasks until I got it to work.

[DalekSec]

I've moved it to after, but now it's not bitlockering at all!

 

On pre-provision I have tried both targeting the C: and OS logical disk drive

[DalekSec]

Still no luck with this, keeps failing on 'Enable Bitlocker' no what I change the settings to on each of the bitlocker steps! Have tried most scenarios.

[markwilfan]

I do this post deploy. Collection that looks for tpm module and compatible operating system. Simple enable bit locker task sequence deployed to this collection

[DalekSec]

I do this post deploy. Collection that looks for tpm module and compatible operating system. Simple enable bit locker task sequence deployed to this collection

 

Sounds like a good plan B, is this done on PXE or done automatically by sccm when it finds a suitable machine?

[SuperduperPackager]

Try like this:

 

[markwilfan]

Sounds like a good plan B, is this done on PXE or done automatically by sccm when it finds a suitable machine?

The collection auto populates using a query rule so after a machine does a hardware inv and it finds a tpm module and win 7 ent it deploys a bit locker enable ts. Will post it here tomorrow if you like. Never got it to do it during deploy reliabily

[DalekSec]

The collection auto populates using a query rule so after a machine does a hardware inv and it finds a tpm module and win 7 ent it deploys a bit locker enable ts. Will post it here tomorrow if you like. Never got it to do it during deploy reliabily

 

Thanks, I gave this way a try yesterday and found out what the real problem is. The laptop is not picking up a right IP address and the DNS is going all funky. Hopefully if I sort this problem out the normal bitlocker way will work *crosses tentacles*

[DalekSec]

Thanks @markwilfan , Once I sorted the DNS problem it still didn't do it in the TS but once I had setup the separate one to run in software centre after the original TS had finished. It worked!!! And it populated AD!!!!!!!!!!!!!

[SuperduperPackager]

If I may, you guys are not using the pre-provisionning correctly.

 

The pre-provisionning should be done right after the formatting and before applying the operating system for maximum efficiency. It needs to run in WinPE. The whole point of pre-provisionning is to save time when encrypting the disk. What it does is encrypt the disk when it's empty so it goes really fast.

 

See: https://technet.microsoft.com/en-ca/library/dn456883.aspx?f=255&MSPPError=-2147217396

and: https://technet.microsoft.com/en-ca/library/hh846237.aspx?f=255&MSPPError=-2147217396#BKMK_PreProvisionBitLocker

 

Done this way, the combined steps of pre-provisionning and enabling bitlocker takes only a couple of seconds compared to 15 or 20 minutes if done after the operating system has been installed. That's from my tests on Win10 with standard laptop without ssd.

[markwilfan]

If I may, you guys are not using the pre-provisionning correctly.

 

The pre-provisionning should be done right after the formatting and before applying the operating system for maximum efficiency. It needs to run in WinPE. The whole point of pre-provisionning is to save time when encrypting the disk. What it does is encrypt the disk when it's empty so it goes really fast.

 

See: https://technet.microsoft.com/en-ca/library/dn456883.aspx?f=255&MSPPError=-2147217396

and: https://technet.microsoft.com/en-ca/library/hh846237.aspx?f=255&MSPPError=-2147217396#BKMK_PreProvisionBitLocker

 

Done this way, the combined steps of pre-provisionning and enabling bitlocker takes only a couple of seconds compared to 15 or 20 minutes if done after the operating system has been installed. That's from my tests on Win10 with standard laptop without ssd.

Correct me if I'm wrong but using this method wouldn't save the bit locker stuff back to ad would it? I see the logic but not really bothered about the extra time to encrypt.

[SuperduperPackager]

Correct me if I'm wrong but using this method wouldn't save the bit locker stuff back to ad would it? I see the logic but not really bothered about the extra time to encrypt.

 

Sure it does, there's an option for it right in the Enable BitLocker step. Don't forget to set your GPOs for BitLocker settings.

 

By the way, the Pre-provision BitLocker step only runs in WinPE, which means before the Setup Windows and ConfigMgr step. Once Setup Windows and ConfigMgr has run, you are not in WinPE anymore, you are in the deployed OS. If you put the Pre-provision BitLocker step anywhere after Setup Windows and ConfigMgr, it doesn't do anything so why even have it in there?

 

The whole point of the Pre-provision BitLocker step is to encrypt the disk in WinPE when it's still empty (after you format and before you apply the OS) so it takes a couple of seconds instead of several minutes. If you like your deployment time to be longer for whatever reason, just don't use the Pre-provision BitLocker step et voilà!