[1903, au] MBAM 2.5 SP1 - Unable to encrypt

[CHiLL]

I'm currently testing 1903 and found that I'm unable to encrypt a laptop using MBAM 2.5 SP1. I encrypted another device that was running 1709 this morning, so I know it's not an issue with my implementation. Other's have also reported the issue on TechNet: https://social.technet.microsoft.com/Forums/en-US/21e57d95-1f5e-4681-834b-f0a5c2dd0141/1903-mbam-failing-to-encrypt?forum=mdopmbam

 

The encryption is meant to start automatically once the machine is in the correct OU and the MBAM GPO kicks in. Both the automatic attempt and the manual execution of MBAMClientUI.exe report the following error in the event log:

 

Event Viewer > Application and Services > Windows > MBAM > Admin

 

An error occurred while applying MBAM policies.

Volume ID:\\?\Volume{xxxxxxxxxxxxxxxxxxxxx}\

 

Error code:

-2147217402

 

Details:

NULL

 

Can anyone else try and confirm this for me?

Edited June 6, 2019 by CHiLL

[rosslaing]

I have literally just encrypted two brand new HP laptops running 1903, using MBAM, and they both worked fine.

[CHiLL]

Strange. I just cannot get it to do anything than produce that error. Google seems to be very short on information regarding that error too.

[rosslaing]

What happens if you just try to Bitlock the drive without MBAM policies?

[CHiLL]

What happens if you just try to Bitlock the drive without MBAM policies?

Hmm. Removing the laptop into the Computers OU (therefore no GPOs) allows it to encrypt manually using BitLocker from the Control Panel. So it is an issue with the MBAM aspect of BitLocker.

 

Edit 1: When I insert a removable drive, it BitLocker pops up and asks to encrypt the drive. I complete the wizard and put a password in and the drive encrypts successfully.

 

Edit 2: If the device is in the OU as normal and the MBAM policies are applied - the encryption won't work. However if I manually enabled BitLocker from the Control Panel applet, it does encrypt the drive, like it doesn't without any policies applied, but it still doesn't add the key to SQL.

 

I've raised it on Microsoft's feedback hub here: https://aka.ms/AA5916k.

Edited June 7, 2019 by CHiLL

[Arthur]

I'm currently testing 1903 and found that I'm unable to encrypt a laptop using MBAM 2.5 SP1.

Do you have the May 2019 update for MBAM 2.5 SP1 installed? This was released 03/06/2019 and adds official support for 1903.

 

https://twitter.com/WZorNET/status/1137216939267432448

 

[CHiLL]

Do you have the May 2019 update for MBAM 2.5 SP1 installed? This was released 03/06/2019 and adds official support for 1903.

 

https://twitter.com/WZorNET/status/1137216939267432448

 

Cheers for that. I do not have that update, I've been using the version from MDOP from VLSC that I downloaded, which according to SCCM is v2.5.1100.0 and the original release of 2.5 SP1. I will upgrade the server to July 2018 and also update the clients to May 2019.

[CHiLL]

I'm having difficulty deploying the May 19 update, specifically deploying the MSI and MSP via SCCM. I want two scenarios for the deployment, one to deploy the main MSI client with the patch also applied and one to just update existing clients.

 

If a machine doesn't have MBAM installed at all and I run this command:

msiexec /i "\\\MBAMClientSetup-2.5.1100.0.msi" /qb /update "\\\MBAM2._Client_x64_KB505175.msp"

I get the following Windows Installer error:

Windows Installer does not permit patching of managed advertised products. At least one feature of the product must be installed before applying the patch.

 

Ideally I'd prefer to have one deployment that can both update existing clients and also deploy to new clients.