"Enable Bitlocker" in Task Sequence do not "Wait for Bitlocker to complete... before.. continues..." even if option is selected.

Question

The "Enable Bitlocker" task as been placed near the End of the Task Sequences, and the option to "Wait for Bitlocker to complete the drive encryption..." has been checked, but despite this we see that the task does not wait for the encryption to be completed before continuing to the nex task.

The result is that when the TS is completed, we run a QA script and the script still detects that the disk encryption is not complete.
But the process of encryption is running...

In the SMSTS.LOG we can see the Bitlocker task which runs in less than a few seconds and moves on to the next task.
So it doesn't wait for encryption to finish even if the option has been checked !!

Has anyone ever encountered this ?

(SCCM Version 1910)

Answer 1

We ended up using the Powershell command (Get-Bitlockervolume) in the task sequence, and the WMI command (That can run without Admin rights) when the QA is run outside the task sequence.

Thanks @Colin Ford for your help.

Answer 2

It looks like you run the Enable BitLocker command twice and the first command succeeds

1st run

Encrypting used disk space  OSDBitLocker    2/06/2021 5:17:13 PM    8148 (0x1FD4)
Process completed with exit code 0  TSManager   2/06/2021 5:20:13 PM    684 (0x02AC)

2nd run

Volume 'C:' is already protected with BitLocker OSDBitLocker    2/06/2021 5:20:14 PM    8036 (0x1F64)
Process completed with exit code 0  TSManager   2/06/2021 5:20:14 PM    684 (0x02AC)

The first run is quick, but it can be especially if you are using BitLocker pre-provisioning. The QA script detection is likely the issue as you mention. Try using the WMI namespace root\cimv2\Security\MicrosoftVolumeEncryption

The ProtectionStatus property of Win32_EncryptableVolume will tell you whether a drive is fully encrypted.

Answer 3

Thank you ColinFord-6663 for the answer.

We use the WMI namespace you mention, but because the QA need also to run after the TS (On first open session) we changed it to a command that doesn't need Admin elevation, that's why we use the other command.

But thank you for your help, I think we have to investigate why it doesn't return the correct value when run in TS, even if encryption is completed.