[1709, fcu] trying to encrypt

[sted]

im trying to encrypt a laptop here but all i get after it asks me for the pin is

 

the group policy setting requiring FIPS compliance prevents the recovery password from being saved to active directory. When operating in FIPS-Compliant mode bitlocker recovery options can be either a recovery key stored on a usb drive or recovery through a data agent check your group policy settings configuration

 

thats a new one on me its the same settings i always use any ideas as im stumped

[sted]

looks like it was a remnant of it failing to bitlocker via MDT my policy for machines with tpm was slightly wrong (required tpm and required tpm+pin) after a lot of manage-bde fiddling its now working all be it without a tpm but i can live with that