BitLocker without TPM - domain joined devices

[Ertech]

is there a Zero-Touch BitLocker Deployment for domain joined devices (no TPM)?

 

Thanks

[DavR]

Not that I've found, using vanilla deployment with group policy.

 

Without a TPM, you need to either stick a pin code or password in there, I found no way to automate that.

[Ertech]

Is there a way to automatically backup the key for devices without TPM?

[DavR]

You can still back the recovery key for devices without TPM, just enable the backup to Active Directory options in group policy.

 

You will still need to manually run through the BitLocker encryption wizard though.

[sted]

everything that works with a tpm works without gpo wise so backing up keys is the same as if it had a tpm. to the best of my knowledge there is no gpo way of automatically actually encrypting the disk you could probably use a script to do it or (for pcs with tpm) make it part of your mdt setup

[mavhc]

Zero touch to encrypt? decrypt? More details needed.

[Ertech]

Zero touch to encrypt with out TPM

[mavhc]

Yeah, just use a script, modify this one

 

http://www.edugeek.net/forums/windows-10/192536-rolling-out-bitlocker-mbam-needed-yes-no-tpm-owner-password.html#post1648918

[Ertech]

I was looking online and come across BitLocker changing the recovery key randomly - anyone experienced this issue?

https://community.spiceworks.com/topic/2062878-why-does-bitlocker-change-the-recovery-key

 

Thanks

Edited December 2, 2019 by Ertech