This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(76.8, 98%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETZ%3C/text%3E%3C/svg%3E)
Students install Office 365 to their personal computers and agree the "Allow My Organization To Manage My Device”. Now we see their Windows 10 Home computers as Azure AD Registered with BitLocker keys in Intune.
This has caused data loss. Eg. a student upgraded his computer by moving the HDD from the old to the new computer, got a prompt to type BitLocker recovery key but had no idea that the key was or why he needed it. => Total reinstall.
You can create Bitlocker policy (Endpoint secury -> Disk encryption -> Create Policy) but there's nota n option to disable. Only choices are "Yes" and "Not configured".
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(89.60000000000001, 81%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERA%3C/text%3E%3C/svg%3E)
Something is not right.
First of all BitLocker is not available in the Windows 10 Home, so I am wondering did they upgrade from the Home to Pro or other version?
When you set the policy to Not configure it won't enforce BitLocker.
All those devices use Windows 10 Home version. I can check the version from Intune and I have also personally used those devices.
Operating system: Windows
Operating system version: 10.0.19042.1348
Operating system edition: Home
Operating system SKU: Windows 10/11 Home (101)
Ownership: Personal
Azure AD registered: Yes
DEVICE NAME: LAPTOP-XXXXXXXX
BITLOCKER KEY ID: 12345678-1234-1234-1234-1234567890ab
BITLOCKER RECOVERY KEY: 123456-123456-123456-123456-123456-123456-123456-123456
DRIVE TYPE: Operating system drive
Have you tried set the BitLocker to Not configure?
What was the result?
First of all BitLocker is not available in the Windows 10 Home
It actually is, it's just called something different but the underlying plumbing and APIs are the same: "Device Encryption". See https://support.microsoft.com/en-us/windows/device-encryption-in-windows-ad5dcf4b-dbe0-2331-228f-7925c2a3012d for details.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 13%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJS%3C/text%3E%3C/svg%3E)
@Tavas Zervie How are things going on? We are waiting to know if the below responses helped in answering your query. If it did, please do not forget to accept the appropriate response as Answer so that others in the community facing similar issues can easily find the solution.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 66%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENH%3C/text%3E%3C/svg%3E)
You can use enrollment restrictions in Intune to prevent personal Windows devices from enrolling in Intune.
Do you want to unmanage Bitlocker on personal Windows 10 devices or unmanage these personal devices altogether? If it is just Bitlocker, then you can create a device filter policy for personal Windows 10 devices and exclude this filter in your Bitlocker policy assignment. If you want to unmanage the personal Windows 10 devices then +1 to @Nick Hogarth 's suggestion to disallow enrollment against Windows 10 BYOD.
I want to unmanage Bitlocker on personal Windows 10 devices.
We don't have explicitly turned Bitlocker on. "Bitlocker policy (Endpoint secury -> Disk encryption -> Create Policy) but there's not an option to disable. Only choices are "Yes" and "Not configured". This is set to "Not Cinfigured". We don't have anything from which we could filter out personal Windows 10 devices.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 94%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
Newest Windows versions, including Windows 10 Home, will silently encrypt hardisk after Windows installation. A clear key is stored on HDD.
manage-bde -stautus shows that HDD is encrypted but Protection status is off because the clear key i used.
Conversion Status: Used Space Only Encrypted
Percentage Encrypted: 100,0%
Encryption Method: XTS-AES 128
Protection Status: Protection Off
If you install O365 and agree the option "Allow My Organization To Manage My Device” which is checked by default, the clear key is removed from HDD and Bitlocker keys are store in AAD device object. All this is done fully automatically without user's knowledge. Now the protection status is "on".
Conversion Status: Used Space Only Encrypted
Percentage Encrypted: 100,0%
Encryption Method: XTS-AES 128
Protection Status: Protection On
Now if your laptop gets broken and for example a motherboads need to be replaced you need the Bitlocker recovery key from AAD. If it's deleted from AAD, you will lose all your data.
From Intune you can disable enrolling personal devices or you can disable the encryption from user's device.