MBAM Fixed drive encryption problem

Question

Hello,

I use MBAM server.

client version mbam 2.5 sp1 and os are windows 10 1909 enterprise.

OS drive successfully encrypted automatically . I have problem with fixed drive. Fixed drive encryption can not start automatically.

My fixed drive GPO:

choose how BitLocker-protected fixed drives can be recovered Enabled
Allow data recovery agent Enabled
Omit recovery options from the BitLocker setup wizard Enabled
Save BitLocker recovery information to AD DS for fixed data drives Enabled
Configure storage of BitLocker recovery information to AD DS: Backup recovery passwords and key packages
Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives Disabled

Configure use of passwords for fixed data drives Disabled

Encryption Policy Enforcement Settings Enabled
Configure the number of noncompliance grace period days for fixed drives. This grace period begins only after the operating system drive compliance is detected: 0

Fixed data drive encryption settings Enabled

Configure Auto-Unlock for fixed data drive: Allow Auto-Unlock

When I check gpo from client , I can see only "choose how BitLocker-protected fixed drives can be recovered" and "Configure Auto-Unlock for fixed data drive:" settings .

Answer 1

Hi,
Might try using the following command in the elevated command prompt to refresh client GPO settings so they can be applied on clients:
gpupdate /force

then reboot.

Best regards.

**
If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hello,

If the policies are correctly configured and linked, it should not take so long to start encrypting. Also, try to compliance the report to determine the encryption status by using any of these commands.

• manage-bde -status or
• Get-BitLockerVolume

Please check to ensure that the PCs are part of the OU and the BitLocker and MBAM policies are configured correctly.

Saw you also configured auto-unlock. Double-check with these links for your needed BitLocker policies

• https://techdirectarchive.com/2021/01/31/bitlocker-pin-bypass-how-to-configure-network-unlock-2/
• https://techdirectarchive.com/2020/12/30/backup-bitlocker-recovery-keys-to-ad-how-to-enable-bitlocker-via-the-local-group-policy-editor-and-the-group-policy-management-console-2/

This last link will also help you in ensuring your policies are correctly configured and aligned.

If these procedures helped you in any way, please click on "It solved my problem" and also mark it as an answer, so you can help other users.

Answer 3

Hi OrtacDemirel-7821,

I had to set up MBAM in order to outline the steps for your deployment. I hope this guide helps.

• https://techdirectarchive.com/2021/03/19/mbam-components-how-to-deploy-microsoft-bitlocker-administration-and-monitoring-part-1/

Answer 4

Remember to check MBAM client logs in Event Viewer / Applications. If your GPO is set right, but there is a some problem, you should understand it from those logs.