Edit

Share via


New-CMUseFddEnforcePolicy

Create a policy to configure the number of days that fixed drives can remain noncompliant until they are forced to comply with BitLocker policies.

Syntax

Default (Default)

New-CMUseFddEnforcePolicy
    [-PolicyState <State>]
    [-GracePeriodDays <Int32>]
    [-DisableWildcardHandling]
    [-ForceWildcardHandling]
    [<CommonParameters>]

Description

Create a policy to configure the number of days that fixed drives can remain noncompliant until they are forced to comply with BitLocker policies. After the grace period, users can't postpone the required action or request an exemption. The grace period starts when BitLocker determines the fixed data drive is noncompliant. BitLocker doesn't enforce the fixed data drive policy until the OS drive is compliant.

Examples

Example 1: New enabled policy with grace period set to seven days

This example creates a policy that's enabled and a grace period of one week (seven days).

New-CMUseFddEnforcePolicy -PolicyState Enabled -GracePeriodDays 7

Parameters

-DisableWildcardHandling

This parameter treats wildcard characters as literal character values. You can't combine it with ForceWildcardHandling.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-ForceWildcardHandling

This parameter processes wildcard characters and may lead to unexpected behavior (not recommended). You can't combine it with DisableWildcardHandling.

Parameter properties

Type:SwitchParameter
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-GracePeriodDays

Specify the number of days that a fixed data drive can be not protected by BitLocker. After this number of days, BitLocker protects the drive and encrypts it.

Specify a value of 0 to immediately enforce this fixed data drive policy after the OS drive becomes compliant.

Parameter properties

Type:Int32
Default value:None
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

-PolicyState

Use this parameter to configure the policy.

  • Enabled: If you enable this policy, BitLocker enforces the policy on fixed data drives, and provides users with grace period that you specify in the -GracePeriodDays parameter.

  • Disabled, NotConfigured: If you disable or don't configure this setting, Configuration Manager doesn't require users to comply with BitLocker policies.

Parameter properties

Type:State
Default value:None
Accepted values:Enabled, Disabled, NotConfigured
Supports wildcards:False
DontShow:False

Parameter sets

(All)
Position:Named
Mandatory:False
Value from pipeline:False
Value from pipeline by property name:False
Value from remaining arguments:False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

None

Outputs

Microsoft.ConfigurationManagement.AdminConsole.BitlockerManagement.PolicyObject