With us the same problem, have it of the previous already got someone solved?
Bitlocker window 10 Enterprise
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 7.000000000000001%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESD%3C/text%3E%3C/svg%3E)
soutumi debnath
11
Reputation points
Hi All,
I am getting the following error when trying to activate bitlocker (from Intune as well as manually)
"Your Active Directory Domain Services schema isn't configured to run Bitlocker Drive Encryption. Contact you system admin."
I have cloud only environment, local Active directory is not there. Besides, All the devices are joined by Autopilot and doesn't have the issue except this one laptop.
Any help would be appreciated.
Windows for business | Windows Client for IT Pros | Devices and deployment | Configure application groups
5 answers
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 66%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBM%3C/text%3E%3C/svg%3E)
Benjamin Mann 0 Reputation points2023-07-10T11:06:04.98+00:00 -
soutumi debnath 11 Reputation points
2023-07-10T14:09:12.6566667+00:00 For us we figured out the issue is caused by PCR7. It was not bounded so we had to contact the manufacturer to fixed it.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 35%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EVA%3C/text%3E%3C/svg%3E)
Valter Anjos 0 Reputation points2023-07-13T11:02:05.97+00:00 @Benjamin Mann we are facing the same issue and it has started on July 10th.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(310.4, 26%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESR%3C/text%3E%3C/svg%3E)
Sérgio Batista 0 Reputation points2023-07-19T10:07:25.7633333+00:00 Any news about this problem? We are facing the same problem!
Thank you
-
Valter Anjos 0 Reputation points
2023-07-19T10:16:40.0133333+00:00 Hi Sérgio,
We have a case with Microsoft but there is no conclusion yet. They are reviewing all the logs. I can see some people complaining about the same issue where nothing was changed on Intune profile or AAD side. This looks like an issue from Microsoft side but we don't have that confirmation yet.
Thank you!
-
Sérgio Batista 0 Reputation points
2023-07-19T10:55:16.46+00:00 Hello Valter
Thank you for the reply. Let me know please If there is any updates about the case!
Thank You!
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 30%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFM%3C/text%3E%3C/svg%3E)
Felipe M Ferreira 11 Reputation points2023-07-26T19:00:51.0866667+00:00 After researching this extensively, I found a workaround that worked for me.
It looks like the problem is related to devices that have TPM v2.0 modules with TPM Spec version 1.16.
You can run this command in CMD to verify your TPM info:
tpmtool getdeviceinformation
To work around this issue you have to:
Open regedit, backup this key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\Configuration\Local\SSL\00010003
Double click on Functions, then remove the following signature suites from the list:
RSAE-PSS/SHA256
RSAE-PSS/SHA384
RSAE-PSS/SHA512
Reboot your device, try to enable BitLocker (saving the key to Azure AD).
Other solutions would be update the TPM firmware (if available), or replace the TPM module with one that has the TPM spec version 1.38 or above.
Hats off to S1ngl3t0n who wrote this post: Windows 10 TPM 2.0 Client Authentication in TLS 1.2 with RSA PSS making trouble - Microsoft Q&A
-
Sérgio Batista 0 Reputation points
2023-07-27T10:38:12.4366667+00:00 Hello,
That's it! Worked for me in two devices affected.
Thank you for help!
Sign in to comment -
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(28.799999999999997, 3%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYD%3C/text%3E%3C/svg%3E)
Yogesh Deshpande 0 Reputation points2023-03-14T06:37:16.6333333+00:00 I am facing same issue its new autopilot machine and having no local account.
-
soutumi debnath 11 Reputation points
2022-09-27T11:47:47.383+00:00 Hello Hania,
There is no local account created on the laptop. Laptop is joined via Intune autopilot and user is joined as domain user.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2022-09-27T05:39:55.593+00:00 Hi.
This problem most likely occurs because you are logged on to the computer by using a local computer account instead of a Windows domain account.
Please try signing in with your domain account and enabling it.Hope the information is helpful.
============================================
If the Answer is helpful, please click "Accept Answer" and upvote it.