I am having issues with BitLocker from SCCM

Randy Miller 1

On a couple laptops I am getting an error in the logs and the laptops are not encrypting.

Volume ID is not a proper GUID. BitlockerManagementHandler 6/16/2021 4:20:39 PM 4976 (0x1370)
Unable to add volume \?\Volume{a666de71-952d-4514-9286-3dc935c3f83d}\ XML to key escrow payload. 0x800401f3 BitlockerManagementHandler 6/16/2021 4:20:39 PM 4976 (0x1370)
Volume ID is not a proper GUID. BitlockerManagementHandler 6/16/2021 4:20:39 PM 4976 (0x1370)
Unable to add volume \?\Volume{367f9200-5673-48bc-90a7-cf0b30a204a8}\ XML to key escrow payload. 0x800401f3 BitlockerManagementHandler 6/16/2021 4:20:39 PM 4976 (0x1370)
All volumes failed to add XML to message payload. BitlockerManagementHandler 6/16/2021 4:20:39 PM 4976 (0x1370)

HanyunZhu-MSFT 1,846 Reputation points Microsoft Vendor

2021-06-17T09:08:34.513+00:00

Hi,

Could you upload the complete BitLockerManagementHandler.log(with the sensitive information masked)?
Refer to more information may be helpful to solve the problem.
Thanks for your time.
Randy Miller 1 Reputation point

2021-06-17T12:17:37.68+00:00

106661-bitlockermanagementhandler.log

Here is the log file

Thank you
HanyunZhu-MSFT 1,846 Reputation points Microsoft Vendor

2021-06-18T08:39:58.373+00:00

Thanks for your feedback.
Unfortunately, there is no useful information in the log file that can be used to troubleshoot.
We have done a lot of research, but this problem is very rare, and the search results for reference are also very limited.

So what I want to know is, is there any difference between these "a couple" devices and the others that run bitlocker normally?
For example, they are a certain model of a certain brand.
Patrick Bahne 1 Reputation point

2021-06-18T15:13:11.58+00:00

Hey Randy,

ii've exactly the same problem.
Randy Miller 1 Reputation point

2021-06-21T14:04:28.92+00:00

It seems to be across all models we have. The strange thing is that we see this error on almost all laptops. It seems to work itself out after some time. However, sometimes it works itself out in 30 minutes. The laptop that I copied that log from took about 2 days and that is a problem. Also, this laptop had been encrypted before with no issues. I just reimaged it and then it could not encrypt. The error seems to indicate that there is an issue with the hard drive GUID in SCCM. Could it be that this GUID changes during reimaging and it is not refreshed in SCCM?
Fabrizio Preatoni 1 Reputation point

2021-08-26T06:47:06.867+00:00

Hi,
I also have the same errors in the log.
followed by this error at every startup:

I really don't know how to resolve it.

8 answers

BryanB 26 Reputation points

2021-08-18T19:24:41.603+00:00

I had the same errors mentioned by the other posts in this thread. For me it came down to this note in the Bitlocker Management documentation:

If a remote desktop protocol (RDP) connection is active, the MBAM client doesn't start BitLocker Drive Encryption actions. Close all remote console connections and sign in to a console session with a domain user account. Then BitLocker Drive Encryption begins and the client uploads recovery keys and packages. If you sign in with a local user account, BitLocker Drive Encryption doesn't start.

Any machines I logged in to the console session with a domain user account started the encryption process without issue after the next compliance check (90 minutes in my environment). For spare or guest machines that aren't regularly used and had no one logged in, running "Manage-bde -on c:" via SCCM remotely also successfully encrypted and escrowed the recovery keys.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Fergal 1 Reputation point

2021-06-21T09:16:33.063+00:00

We are also having the same issue with SCCM 2103 using enhanced http
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Andreas 1 Reputation point

2021-06-24T11:38:59.497+00:00

We also have this issue on several clients with SCCM 2103
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
shogo 1 Reputation point

2021-07-20T13:40:56.057+00:00

I am also seeing this on clients in SCCM 2103.
And then it continues and i also see this:

Attempting to launch MBAM UI BitlockerManagementHandler 2021-07-20 15:41:18 106220 (0x19EEC)
[Failed] Could not get user token - Error: 800703f0 BitlockerManagementHandler 2021-07-20 15:41:18 106220 (0x19EEC)
Unable to launch MBAM UI. Will try again later. BitlockerManagementHandler 2021-07-20 15:41:18 106220 (0x19EEC)

But result does not seems consistent.
Please sign in to rate this answer.
Paul Isaac 6 Reputation points

2022-06-13T16:10:59.4+00:00

This is not an error. The MBAM UI is tryng to launch to allow you to enter the required PIN, but as there is no one logged on it cannot start the UI and so registers this and then waits a predetermined time (90 minutes by default) and tries again. If you login to the machine and the 90 minutes pass, the screen will appear and you can enter your PIN and the device will start encrypting. As the for initial error screen, that is something to do with the inability to find the volume ID on the drive AT THAT POINT IN TIME. 90 minutes later, the Volume ID is available and everything works. I am still looking into why the drive fails to return a volume ID at first login. I am leaning towards it being a service that has not yet started, or hadn't when the bitlocker encryption triggered as it normally happens after a reboot when the user first logs in.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
ben 21 Reputation points

2021-07-21T16:00:37.26+00:00

Same thing with HTTPS enable sites in SCCM 2010

<![LOG[Processing group policy UseFddEnforcePolicy, enforce mode is ON]LOG]
<![LOG[Bitlocker Management rule BitLockerManagementSettings_UseFddEnforcePolicy is compliant]LOG]
<![LOG[Executing key escrow task.]LOG]!
<![LOG[Volume \?\Volume{4b29a35a-6067-4e22-8496-374f1892552a}\ of type 1 has compliance status 0]LOG]!
<![LOG[Adding numerical password to volume \?\Volume{4b29a35a-6067-4e22-8496-374f1892552a}.]LOG]
<![LOG[Key for volume needs to be escrowed.]LOG]!>
<![LOG[Volume ID is not a proper GUID.]LOG]!>
<![LOG[Unable to add volume \?\Volume{4b29a35a-6067-4e22-8496-374f1892552a}\ XML to key escrow payload. 0x800401f3]LOG]!>
<![LOG[All volumes failed to add XML to message payload.]LOG]!>
<![LOG[Unable to get volume payload to escrow keys. 0x80004005]LOG]!>
<![LOG[Error escrowing keys. 0x80004005]LOG]!><
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

I am having issues with BitLocker from SCCM

8 answers

Your answer