Bitlocker silent enabler not working anymore

Question

Everything was fine for a quite some time, but now all machines which rolled autopilot recently, are without encryption. I will paste my configuration and then Bitlocker-API events happening on those machines. As a side comment, Intune has 4-5 different methods where to configure bitlocker, so which one we should use today?

Answer 1

Not sure what happend, but probably I have mess up the config profiles for Bitlocker config. I managed to get the automation back to work. Let me summarize what I've learned;

• Events ID 810, 812 813 in Bitlocker-API does not matter.
• Secure boot is not mandatory
• New Bitlocker encryption in Endpoint Protection should be in use
• Some "required" rules in configuration around TPM and PIN are too heavy, consider to change them to Allowed, that might solve some incompatibility issues.
• TPM 1.2 is enough

Answer 2

You should ideally be using Endpoint Protection Bitlocker profile. Device configuration has additional settings that can cause confusion. As for the issue, are there anymore events logged in eventvwr? Also, what does it say in system information? You can refer to the links below for some guidance.

intune-bitlocker-silent-and-automatic.html

how-to-force-escrowing-of-bitlocker.html

Answer 3

@Pavel yannara Mirochnitchenko In fact, I think any method where to configure bitlocker is ok. It is based on what settings you want. And there is no article showing which method is the best one.

If the policy is deployed via intune successfully, but it doesn't work. It is more related to windows. In fact, the information that I have is limited. For the error message, I have done a lot of research. I find that this error occurs when doesn't enable Secure Boot. We can read the following article as a reference.
https://learn.microsoft.com/en-us/windows-hardware/test/hlk/testref/954cf796-a640-4134-b742-eaf0ed2663ff#troubleshooting

The following article shows how to enable Secure Boot:
https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/disabling-secure-boot#re-enable-secure-boot

Hope the above information will help.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Found something new from msinfo32:

Device Encryption Support: Reasons for failed automatic device encryption: PCR7 binding is not supported, Hardware Security Test Interface failed and device is not Modern Standby, Un-allowed DMA capable bus/device(s) detected

Answer 5

I see that msinfo32 does not matter, what I did was I took the problematic machine, reset Secure Boot, reset Bios factory defaults, reset TPM and started autopilot again. After that, is is encrypted with same error messages in event viewer: