Preventing Users from Decrypting Laptops

Question

Hello,

Is there a way to prevent users in our company from decrypting the laptops? Our security policy requires that all laptops be encrypted with BitLocker, but some users need both a local user account and an administrator account. As a result, they can remove the encryption with their administrator account. Is it possible to remove the "Turn off BitLocker" option? If not, what is the best practice to prevent users from decrypting laptops?

Thank you for your guidance and help!

Answer 1

Hello

Yes, MBAM should be a good solution and it has been integrated into SCCM.

Deploy BitLocker management - Configuration Manager | Microsoft Learn

Best Regards,

Wesley Li

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

Answer 2

Hi, @Margie j

Thank you for posting in Microsoft Q&A forum.

We may use Microsoft BitLocker Administration and Monitoring (MBAM), which offers a customized control panel that can replace the default Windows BitLocker control panel. This customized control panel enables users to manage their PIN and passwords and to unlock drives, and hides the interface that enables administrators to decrypt a drive or to suspend or resume BitLocker drive encryption.

https://learn.microsoft.com/en-us/microsoft-desktop-optimization-pack/mbam-v2/how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel-mbam-2#how-to-hide-default-bitlocker-encryption-in-the-windows-control-panel

---

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Add comment".