Silently enable BitLocker using a Disk Encryption Policy with Microsoft Endpoint Manager Intune

How to silently enable BitLocker encryption and backup BitLocker keys to Azure AD using an Endpoint Manager Intune Disk Encryption Policy 

Table of Contents

BitLocker hardware requirements

• A Trusted Computing Group (TCG)-compliant BIOS or UEFI firmware
• TPM (Trusted Platform Module) 1.2 or 2.0
• TPM 2.0 devices must have the BIOS configured for UEFI boot mode

Requirements for BitLocker silent encryption with Intune

Device requirements for silently enabling BitLocker

• Must be Azure AD Joined or Hybrid Azure AD Joined
  
• Device must have at least Trusted Platform Module (TPM) 1.2

Disk Encryption Policy settings for silently enabling BitLocker

These settings must be configured for silently enabling BitLocker

• Hide prompt about third-party encryption = Yes
• Allow standard users to enable encryption during Autopilot = Yes
• Device must not require use of a startup PIN or startup key
  

Check if devices support BitLocker

You can check your device's TPM version, encryption readiness and encryption status using the Endpoint Manager Encryption Report.

Endpoint Manager admin center
https://endpoint.microsoft.com

Devices - Monitor

Encryption Report

In this example, both the laptop's OS drive and fixed drive are not encrypted

Testing BitLocker on Hyper-V Virtual Machine

To test the BitLocker policy using a Hyper-V virtual machine, you'll need to enable TPM in the VM security settings

Tick - Enable Trusted Platform Module

Enable TPM on the VM using PowerShell

Enable-VMTPM -VMName "CTRLF-PC3"

Create Endpoint Manager Intune BitLocker policy

In this example, we will create a BitLocker disk encryption policy with the following settings:

• Encrypt Operating System drive and fixed drives using AES 256bit XTS
• Encrypt drive using TPM, without a pin or startup key
• Configure BitLocker silently without any user interaction
• Save BitLocker recovery keys to Azure AD
• Allow silently enabling BitLocker during Azure AD Join for users who are not local administrators
• BitLocker will only be enabled if TPM is present and usable
• BitLocker won't be enabled until recovery keys have been successfully saved to Azure Active Directory

Create new disk encryption policy

Endpoint Manager admin center
https://endpoint.microsoft.com

Endpoint Security - Disk Encryption - Create Policy
Platform: Windows 10 and later
Profile: BitLocker

Create

Name: BitLocker Policy

BitLocker - Base Settings

BitLocker - Fixed Drive Settings

BitLocker - OS Drive Settings

BitLocker - Removable Drive Settings

In this example, we are not using scope tags.

Assign disk encryption policy to test group

Click Create

Hide Windows toast notifications for BitLocker

Even though the Endpoint Manager Disk Encryption policy has been configured to silently enable BitLocker, you may still see Windows toast notifications for BitLocker encryption.

Example: BitLocker "Encryption in progress" Windows toast notification

Registry key to disable BitLocker toast notifications

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Microsoft.Explorer.Notification.{4958E903-D554-EF09-81F9-13359BC57101}

"Enabled"=dword:00000000 

PowerShell script to create registry key to disable BitLocker notifications

hide-bitlocker-notifications.ps1
New-Item -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings" -Name "Microsoft.Explorer.Notification.{4958E903-D554-EF09-81F9-13359BC57101}" -Force
New-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Microsoft.Explorer.Notification.{4958E903-D554-EF09-81F9-13359BC57101}" -Name "Enabled" -Value 0 -Force
 

Deploy PowerShell registry script for disabling BitLocker notifications using Endpoint Manager

We can use Endpoint Manager to deploy the PowerShell script, which adds the registry key to disable BitLocker notifications.

Endpoint Manager admin center
Devices - Windows - PowerShell scripts - Add

Name: Hide BitLocker Notifications

Script settings

Script location: hide-bitlocker-notifications.ps1
Run this script using the logged on credentials: Yes
Enforce script signature check: No
Run script in 64 bit PowerShell Host: Yes

Assign the PowerShell Script to a test group of users

Add PowerShell script

Check BitLocker encryption status

Check BitLocker Policy status in Endpoint manager

Endpoint Security - Disk Encryption - Select BitLocker policy

You can see more details about the policy settings for a device

Devices - All Devices - Select laptop
Device configuration - BitLocker policy

Check BitLocker status using Command Prompt manage-bde

Open Command Prompt (Run as Administrator)

manage-bde -status c:

Example: Encryption in Progress

Example: Encryption Completed

 

View BitLocker recovery keys in Endpoint Manager

Devices - Windows
Select device - Recovery keys - Show Recovery Key

Rotate BitLocker recovery keys using Endpoint Manager

Devices - Windows
Select device - open menu - BitLocker key rotation

BitLocker policy settings for automatic key rotation

Enabling this option in the Endpoint Manager disk encryption policy will automatically rotate BitLocker recovery keys after they have been used on a client device.

Configure client-driven recovery password rotation: Enable rotation on Azure AD and Hybrid-joined devices.

References:

BitLocker overview
https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-overview

Manage BitLocker policy for Windows devices with Intune
https://docs.microsoft.com/en-us/mem/intune/protect/encrypt-devices

Using BitLocker recovery keys with Microsoft Endpoint Manager - Microsoft Intune
https://techcommunity.microsoft.com/t5/intune-customer-success/using-bitlocker-recovery-keys-with-microsoft-endpoint-manager/ba-p/2255517

Enabling BitLocker with Microsoft Endpoint Manager - Microsoft Intune
https://techcommunity.microsoft.com/t5/intune-customer-success/enabling-bitlocker-with-microsoft-endpoint-manager-microsoft/ba-p/2149784

by Author