Bitlocker through Intune in Co-Management

Question

Hi all,

Continuation of the topic https://learn.microsoft.com/en-us/answers/questions/999137/defender-onboarding-co-management.html and a guide in it I believe.

What I wanted to achieve is to apply automatically bitlocker through Co-Management. All is set fine, devices are co managed. After understanding all from previous post, we managed to clean the workloads and there were no further conflicts. Policies for bitlocker arrived to device which I could see for example through Intune or regedit (key saying require encryption was set to 1) etc.

We were sure policies do apply.

In event viewer Bitlocker API, for my two devices I was getting two entries:

1. The following DMA (Direct Memory Access) capable devices are not declared as protected from external access, which can block security features such as BitLocker automatic device encryption:
2. Bitlocker cannot use Secure Boot for integrity because the UEFI variable 'SecureBoot' could not be read
   Error Message: A required privilege is not held by the client

Bitlocker encryption doesn't happen automagically at all. What is even weirder, is that TPM 2.0 UEFI and all that settings were on, except for secure boot.
Troubleshooting so far was to:

1. Set policy to act like below with explanation: Compatible TPM startup PIN
   • Blocked
   Compatible TPM startup key
   • Blocked
   Compatible TPM startup key and PIN
   • Blocked

These settings are all very related and coordinating the selections is important. The BitLocker CSP documentation has a brief note that says “Only one of the additional authentication options can be required at startup, otherwise an error occurs.” That error will be a “Policy Conflict”, because if you Require any one of these then you CANNOT Allow anything else. So we’ll Require TPM, and set the other three to “Do not allow

This removed the 1st error, so the DMA one.

Secondly, I've turned secure boot on one of two machines and tested if secure boot is really needed
From that point I have verified if TPM and all other components are setup correctly and they were in 99%!
the only issue was that Key protectors were empty, for every built device, these are factory new, built and connected with co management devices, user connected to them

I ran manage-bde -protectors c: -get to validate that 7,11 are the PCR used - And this is the ONLY missing thing, it was simply empty. In my understanding is that if TPM owner is known, if system works properly, hardware and all that stuff is put in place, this should populate on its own. It didn't, so I ran the following:

manage-bde -protectors c: -delete -t tpm  
manage-bde -protectors c: -add -tpm  

This didn't still trigger any auto apply both on Secure Boot enabled and disabled device. I've switched off the enabled one, and after logging back in I've received

I ran out of ideas what is happening. What I assume is that somehow the policy is not able to start the auto encryption, but why?

My workaround was to run a TS from MECM

It worked in few minutes on both Secure Boot Enabled and Disabled devices. I know the supremacy of MECM in many aspects, but the general decision is to unify security and some policies in one place, that would be cloud. This means it is only a temporary solution... Can someone give me some hints what could I test later on when I will be trying to do it via cloud again?

Answer 1

@Heimdallr , Thanks for posting. I am glad to hear that our first error is resolved. For your second error based on my research, I find a known issue in the following link:
https://learn.microsoft.com/en-us/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues#issue-6

It seems we have enabled silent Bitlocker drive encryption which requires the secure boot to be turned on and the PCR7 measures the state of secure boot.

From your troubleshooting, I know the PCR is empty. I think it's the cause of our issue. I notice we have tried to delete the key protection methods and add it back. Could you let us know if the PCR Validation Profile include 7 after this action?

Meanwhile, please type msinfo32 to see if the "Secure Boot State" is On. If the setting is Unsupported. then means we can't use Silent BitLocker Encryption on this device. You can change to use manually enable Bitlocker policy instead on these devices.

Hope it can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@Heimdallr , Thanks for your update.

From the first test, I know the device can't be with PCR7 binding. As TPM with PCR 7 is one of the hardware requirement, the failure will be expected.
https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-bitlocker#bitlocker-automatic-device-encryption-hardware-requirements

After researching, I find there's a group policy can set PCR7, maybe you can try:

1. On the affected device, make sure the Bitlocker is turned off and restart the PC.
2. Open "gpedit.msc" to access local group policy. navigate to Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives,
3. Find the setting “Configure TPM platform validation profile for native UEFI firmware configuration”. set it as Enable. and select PCR 7 Secure Boot State.
4. After the policy is set, restart the computer again and check if the PCR7 can be there.
   However, if the PCR7 is still not there, I think we need to open case with windows support to help on this.

For the second test, it seems one device with PCR7 also didn't trigger Bitlocker with event 834, 839. Based on my research, I find a similar case. It seems Bitlocker debug log is needed for analysis. As Intune support, I am not familiar with it. So still suggest to contact windows support to get more help.
https://learn.microsoft.com/en-us/answers/questions/46556/pcr7-configuration-binding-not-possible-bitlocker.html

I notice "windows-10-security" tag is added. we can wait some days to see if any windows support can be involved. If not, you can contact our Phone support to help this:
https://support.microsoft.com/en-us/topic/global-customer-service-phone-numbers-c0389ade-5640-e588-8b0e-28de8afeb3f2

Thanks for your understanding and have a nicer day!

Answer 3

Hello.

I have fixed half of my errors.

https://forum.xda-developers.com/t/fix-un-allowed-dma-capable-bus-device-s-detected.4321643/ <--- This solves the Unallowed BUS problem, however all my models suffering this issue, have also Binding not possible on PCR7 with EventViewer ID 839:

BitLocker cannot use Secure Boot for integrity because the TCG Log entry for the OS Loader Authority is invalid.  
      
 The signature contained in the EFI_SIGNATURE_DATA structure from the OS authority event could not be found in the verified certificate chain for the boot loader.  

I am working on it right now to figure that out. After that I will need to make whole thing automatic
Will update when next milestone will be reached