BitLocker Encryption

Question

BitLocker Encryption

IntuneUser 181

I have deployed a BitLocker policy from Intune to the device.
The device gets successfully encrypted.
However, I can manually turn off bitlocker and de-crypt the device. Post that, Intune does not re-encrypt my device again.
Is there any way from Intune to prevent users from manually turning off BitLocker on their devices ?

Accepted answer

1 additional answer

Your answer

Answer 1

Limitless Technology 39,916

Hi there,

You can achieve this by BitLocker group policy settings. This policy setting is used to prevent users from turning BitLocker on or off on removable data drives.BitLocker Group Policy settings can be accessed using the Local Group Policy Editor and the Group Policy Management Console (GPMC) under Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption.

Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives

You can select property settings that control how users can configure BitLocker.

BitLocker group policy settings

https://learn.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#bkmk-driveaccess3

I hope this information helps. If you have any questions please let me know and I will be glad to help you out.

--------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer--

IntuneUser 181 Reputation points

2022-07-12T04:28:17.657+00:00

Hi @Limitless Technology , thanks a lot for your response.
The article provided states only about Removable Data Drives.
However, I guess users can still manipulate BitLocker settings on OS System drives and Fixed Data drive.

Is there any way to prevent users to manage BitLocker settings for OS System drives and Fixed Data drives also ?
MTG 1,246 Reputation points

2022-07-12T10:42:05.747+00:00

As long as your users are admins, you cannot limit their actions without using 3rd party products.
As admin, I can revert any GPO restriction in seconds, so it's useless to look for ways, unless you hope for "security by obscurity".
Local admins need to be trusted, else, make them restricted users.

Answer 2

MTG 1,246

Standard users cannot decrypt. Only admins can decrypt, which makes me wonder if your users are admins.

IntuneUser 181 Reputation points

2022-07-11T02:03:34.53+00:00

Hello @MTG , thanks a lot for your response.
Yes, my users are local admins on their device.
Is there any configuration settings which can be applied from Intune by which we could block decrypting of the device/turning off BitLocker ?

Share via

BitLocker Encryption

1 additional answer

Your answer