This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 35%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETM%3C/text%3E%3C/svg%3E)
If we move to Configmgr for monitoring bitlocker clients and store their keys, how is this affected by Configmgr's aged inventory cleanup?
When a client is pruned out of Configmgr because it has not checked in for 180 days, what happens to the historical Bitlocker compliance information - and more importantly to the stored recovery key?
For instance... someone has a device that has been encrypted with bitlocker, and it reports its status to Configmgr and is compliant, and then the computer is stuffed in a drawer for a year. After 6 months, it ages out of the SCCM site after a period of inactivity and is removed from the DB though maintenance tasks. Everyone slowly forgets about the device. Later, during routine compliance checks, we ask the user to verify they still have that laptop assigned to them. The user goes to the drawer where he stuffed it a year ago and... Uh Oh... not there. Someone must have stolen the laptop... That device is reported lost and now people want proof that that device was encrypted when it was last seen. But SCCM has cleaned up that computer out of the DB because of aged inventory maintenance.
Is there any historical compliance data that is kept outside of the regular SCCM data for Bitlocker in particular or do I need to use something custom to ship the data out of SCCM for prosperity? What about the recovery keys? I have not looked at how Configmgr works - but MBAM would keep recovery keys forever. I suppose Configmgr will also keep the recovery keys even when the computer resource is removed from Configmgr?
It is up to me to somehow store the compliance data prior to the computer getting pruned? It would be cool if a table could be kept with a summary of information about every computer as it ages out of the SCCM database... like a single row of data. I don't want to keep installed software lists or a list of the services or other ephemeral data... but having a few things like sort of like the CombinedDeviceResources view + the bitlocker compliance data - and it is kept FOREVER for posterity sake. Is there anything like that?
What do you do/use to hold basic info about inactive computers for posterity?
Use the memcm data warehouse and the bitlocker date to it.
https://www.enhansoft.com/step-by-step-guide-on-how-to-setup-the-sccm-data-warehouse-feature/
https://www.enhansoft.com/add-tables-to-the-configmgr-data-warehouse/
This is perfect Garth. Thanks for the advice. I am not sure how I've glossed over this feature.
How immutable is the three year retention for the data warehouse in MEMCM? Is there a simple SP that would need to be modified to double the retention period? Three years seems kind of short for prove the drive on the lost/stolen computer was encrypted.
Never looked. But i would create a user voice item to ask for it to be extended.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 92%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EXM%3C/text%3E%3C/svg%3E)
SCCM Data Warehouse Retention Period Configuration Option
Based on this thread, we could open a support case to modify it.
Hi,
If I understand correctly, we could try to maintain a custom table containing all the data by SQL statements. Then migrate the current data to this table periodically.
Database table – dbo.RecoveryAndHardwareCore_Keys
