M365 Intune System Bitlocker Recovery After Updates?

[talksr]

Has anyone else had this happen?

 

About 4 weeks ago, I had a furious head stating her computer was not working. She sent me over some images, and the system was trying to boot but needed the Bitlocker recovery key for the OS drive.

I provided the key and she got on with no issues.

 

Of all the people, she really can't not have her computer and despite offers of a backup laptop, she wants her main computer and nothing else.

I took a look on the system when she was not using it which is rare so was last week. All I could see was that it looks as though Dell Command Upate put through a firmware update. I can imagine it perfectly plausible that a firmware update may have triggered a Bitlocker key input request.

 

Has anyone else had this happen? She wouldn't have run Command Update so I am surpised that this was installed, maybe Windows Update picked something up. I can't really think of a way to prevent this other than looking at the update rings in Intune?

 

I have explained that whilst annoying, Bitlocker is there for a very good reason and the head would have been more annoyed if someone had got access to the hard disk and taken files.

[jmak]

Yes. I've seen it happen for users who didn't set up Bitlocker - I didn't believe the user until I read that Microsoft admitted that one of their updates could cause it.

It actually happened on my personal PC which had Windows Home edition installed which in theory doesn't support Bitlocker.

 

Some Dell updates announce that they temporarily disable Bitlocker - it wouldn't surprise me if that triggers a request for the key, even if it's re-enabled successfully.

 

 

Also, Microsoft have admitted that this month's structure updates can cause it:

 

https://www.theregister.com/2024/07/24/windows_update_bitlocker/

 

According to M$ it mostly affects users who've setup device encryption - which implies that sometimes it affects users who haven't....

 

Two takeaways for me:

 

1) Make sure Bitlocker is enabled (so that you don't get caught with no opportunity to know the key

2) Make sure your users have stored their key in their Microsoft account and know how to use it

[talksr]

Yes. I've seen it happen for users who didn't set up Bitlocker - I didn't believe the user until I read that Microsoft admitted that one of their updates could cause it.

It actually happened on my personal PC which had Windows Home edition installed which in theory doesn't support Bitlocker.

 

Some Dell updates announce that they temporarily disable Bitlocker - it wouldn't surprise me if that triggers a request for the key, even if it's re-enabled successfully.

 

 

Also, Microsoft have admitted that this month's structure updates can cause it:

 

https://www.theregister.com/2024/07/24/windows_update_bitlocker/

 

According to M$ it mostly affects users who've setup device encryption - which implies that sometimes it affects users who haven't....

 

Two takeaways for me:

 

1) Make sure Bitlocker is enabled (so that you don't get caught with no opportunity to know the key

2) Make sure your users have stored their key in their Microsoft account and know how to use it

 

 

Glad I am not the only one. All my devices have Bitlocker keys on M365. It wasn't an issue, I just logged in, looked up her system and text her over the recovery key. Just worried if ever I was not around, she would be buggered. So I have printed the revovery key for her and asked her to keep it in the safe so if something similar happens again and I am not around, she can easily get back on! It was a good lesson for her in why things are so secure and although it is annoying, it is there for a very good reason and means we are fully compliant when it comes to E-Safety!

[jmak]

She (and any user) _should_ be able to find the key themself.

 

Log into office.com

Click on your initials/avatar and choose "View account"

Click on "Manage devices"

 

All the devices they've signed in to should be listed and if you select one, you should be able to see the Bitlocker recovery key.

 

(Bizarrely, I have about 20 devices listed which I can see keys for, but not my own work machine despite trying various methods)

[talksr]

She (and any user) _should_ be able to find the key themself.

 

Log into office.com

Click on your initials/avatar and choose "View account"

Click on "Manage devices"

 

All the devices they've signed in to should be listed and if you select one, you should be able to see the Bitlocker recovery key.

 

(Bizarrely, I have about 20 devices listed which I can see keys for, but not my own work machine despite trying various methods)

 

Thanks, very helpful, I never knew you could do that!

[XiJ]

Yep, we’ve recently moved a school from on prem to Intune managed windows devices which included a clean Win11 upgrade. The laptops required a post win11 firmware update which triggered a bitlocker recovery key request.

These were HP 255 models.

[callbe1]

Having similar issues with this problem outside of EDU at the moment. (This is exactly why after leaving the sector I've kept tabs with this forum!)

 

Happening on a random scale with laptops, anyone had any ideas as my initial talk with Dell didn't provide many answers!

[talksr]

Yep, we’ve recently moved a school from on prem to Intune managed windows devices which included a clean Win11 upgrade. The laptops required a post win11 firmware update which triggered a bitlocker recovery key request.

These were HP 255 models.

 

Having similar issues with this problem outside of EDU at the moment. (This is exactly why after leaving the sector I've kept tabs with this forum!)

 

Happening on a random scale with laptops, anyone had any ideas as my initial talk with Dell didn't provide many answers!

 

Ah, I am glad I am not the only one. It is a pain! But so far, it has only happened to me and the head - worst person in the organisation for it to happen to as she has zero confidence in the cloud / One Drive as it is.

[jmak]

Ah, I am glad I am not the only one. It is a pain! But so far, it has only happened to me and the head - worst person in the organisation for it to happen to as she has zero confidence in the cloud / One Drive as it is.

You need to use this as an opportunity to sell "cloud" and OneDrive.

 

What you can never trust is local storage. It's vulnerable to theft, damage, loss, cyber attack. Or accidental encryption!

 

We have documents and desktops synced with OneDrive by group policy (same is possible with Intune). This gives users virtually interrupted access to their data in the event of anything happening to their PC/laptop. Most of our users would be fully up and running in minutes - the exceptions are specialist applications and other complicated custom configurations - but even they would have quick access to their data.

[talksr]

You need to use this as an opportunity to sell "cloud" and OneDrive.

 

What you can never trust is local storage. It's vulnerable to theft, damage, loss, cyber attack. Or accidental encryption!

 

We have documents and desktops synced with OneDrive by group policy (same is possible with Intune). This gives users virtually interrupted access to their data in the event of anything happening to their PC/laptop. Most of our users would be fully up and running in minutes - the exceptions are specialist applications and other complicated custom configurations - but even they would have quick access to their data.

 

Oh I already have and yes, I already have the syncing all set up but she refuses to use any device but her desktop PC. She is very old fashioned and doesn't like technology. She just likes what she likes and that is her desktop system.

From my perspective, I am so glad I have everything in place and set up as if anything happens to her desktop, as you say, within minutes, she could use one of our laptops and everything would be there for her. She refuses to currently, but if push came to shove, it is good to know everything is already in place and I would need to do nothing to get her set up, she just needs to log in to a different device!

[jmak]

Oh I already have and yes, I already have the syncing all set up but she refuses to use any device but her desktop PC. She is very old fashioned and doesn't like technology. She just likes what she likes and that is her desktop system.

From my perspective, I am so glad I have everything in place and set up as if anything happens to her desktop, as you say, within minutes, she could use one of our laptops and everything would be there for her. She refuses to currently, but if push came to shove, it is good to know everything is already in place and I would need to do nothing to get her set up, she just needs to log in to a different device!

Did you mention she's retiring at the end of term?

 

"Doesn't like technology" + can't/won't be trained = not suitable to work in education, especially in a leadership role

 

That's a slightly flippant comment, but effective use of technology is essential to efficient running of an organisation, for the pupils in their future careers and leadership should lead - otherwise everyone can use it as a valid excuse.

[talksr]

Did you mention she's retiring at the end of term?

 

"Doesn't like technology" + can't/won't be trained = not suitable to work in education, especially in a leadership role

 

That's a slightly flippant comment, but effective use of technology is essential to efficient running of an organisation, for the pupils in their future careers and leadership should lead - otherwise everyone can use it as a valid excuse.

 

No, not retiring and you wouldn't be the only person with those views. I have had to work with a number of heads in a past job and some of them, I am genuinely shocked that they got their jobs. I don't know how they get past an interview. Being a technophobe is one thing, but lack of leadership, mismanagement, disorganisation and inability to deal with situations that involve having a serious discussion with members of staff are really concerning...and they are paid all of that money!