Last week I did a deployment on notebooks with BitLocker support. In my earlier posts I explained how to enable and activate TPM during a task sequence and how to save a recovery key to Active Directory. That way there's no need to configure BIOS settings and/or back-up recovery keys manually. During deployment however the task sequence failed on almost last step, which is "Enable BitLocker" in my case. Looking in settings TPM was enabled and activated, pre-provisioning was done, all seems okay. But no recovery key was set in Active Directory on the computerobject.
Looking at the deployment log (in monitoring) it was mentioning the condition on "Enable BitLocker" was false. Looking at the condition on this step (which is there by default when creating a new task sequence, but not when adding this step in an existing task sequence?) it was like "SMSTSWTG - Not equals - True".
Looking at Microsoft TechNet explains wat SMSTSWTG is doing: "Specifies if the computer is running as a Windows To Go device". In my case I was doing an deployment on a notebook, which is (as far as I know) not a Windows To Go device?
With Manage-BDE -status in command prompt you can see that encryption is 100% done but not active. Long story short, I removed the condition on the "Enable BitLocker" step, and voila, BitLocker was running fine again and the recovery key was set in Active Directory as well. Next time I remove it immediately after creating the task sequence I guess. Still strange the condition is not set when adding this step in an existing task sequence?
Other posts on BitLocker:
How to Enable BitLocker, Automatically save Keys to Active Directory
Enable TPM for BitLocker usage during OS deployment on endpoints
Hope it helps!
Last week I wrote a blogpost about "How to Enable BitLocker, Automatically save Keys to Active Directory". As mentioned in that blogpost the Trusted Platform Module (TPM) chip must be enabled and activated in BIOS. This is disabled by default, so no BitLocker by default when using functionality within ConfigMgr. This is a pre-requisite BEFORE running the deployment task sequence. But you can enable TPM during deployment also! Let's have a look.
Step 1. Download the CCTK from Dell HERE.
Once you've download it, install the MSI. Both CCTK and HAPI are used for doing the job.
Step 2. Create a CCTK package for x86 and/or x64 usage.
Just copy %ProgramFiles%\Dell\CCTK\* to a location that will be used for ConfigMgr, and create a new package.
Step 3. Edit your task sequence with the following changes:
Group: Enable TPM on Dell systems
Group: Prepare CCTK and HAPI
Run Command Line: xcopy CCTK
xcopy.exe ".\*.*" "x:\CCTK\X86\" /E /C /I /Q /H /R /Y /S
Run Command Line: Enable HAPI
x:\CCTK\X86\HAPI\hapint -i -k C-C-T-K -p X:\CCTK\X86\HAPI\
Run Command Line: Set BIOS password
x:\CCTK\x86\CCTK.exe --setuppwd=password
Run Command Line: Enable TPM
x:\CCTK\x86\CCTK.exe --tpm=on --valsetuppwd=password
Restart Computer
Group: Prepare CCTK and HAPI
Run Command Line: xcopy CCTK
xcopy.exe ".\*.*" "x:\CCTK\X86\" /E /C /I /Q /H /R /Y /S
Run Command Line: Enable HAPI
x:\CCTK\X86\HAPI\hapint -i -k C-C-T-K -p X:\CCTK\X86\HAPI\
Run Command Line: Activate TPM
x:\CCTK\x86\CCTK.exe --tpmactivation=activate --valsetuppwd=password
Restart Computer
This must be placed between the "Partition Disk 0" and "Pre-provision BitLocker" step in the task sequence.
When using HP systems this can be done too. The BIOSConfigUtility.exe and TPMEnable.REPSET are used then. More information about that can be found HERE. The code on Dell systems are working great, on HP systems I didn't use it before.
No need to Set BIOS password, Enable TPM and Activate TPM manually anymore. Just use a single Task sequence for BIOS configuration and BitLocker at once. The ConfigMgr task sequence will take care of BitLocker furthermore. Just great!
Source: Windows-noob.com
When using BitLocker (used for encryption of data on disks) on endpoints the Trusted Platform Module (TPM) chip must be enabled and activated in BIOS. This is disabled by default, so no BitLocker by default when using functionality within ConfigMgr. This is a prerequisite BEFORE running the deployment task sequence. When using BitLocker within ConfigMgr you must select "Configure task sequence for use with BitLocker" during the task sequence wizard. That way the "Pre-provision BitLocker" is added after the "Format and Partition Disk" step. In the end of the task sequence "Enable BitLocker" is added, which saves the BitLocker recovery key in Active Directory Domain Services (ADDS). By default however the recovery key cannot be found in Active Directory. In this blogpost I show you which configuration is needed to find the recovery key.
Logon on your Domain Controller first and look at the Operating System version installed. If you will use a domain controller running Windows Server 2003 with SP1 or SP2, you will need to apply the schema extension to store BitLocker and TPM passwords in Active Directory. This file can be downloaded from the BitLocker and TPM Schema Extension page. If you are running Windows Server 2008 (R2) or 2012 (R2) there's no need to do the schema update. These operating systems already include the necessary schema extensions. Another thing to do is to delegate write permissions on the msTPM-OwnerInformation object to the “SELF” account. Tom Acker has a great article on how to do this on the TechNet blog. Essentially what you need to do is open the AD Users and Computers MMC, right click the OU where your computers are (or the domain root) and Delegate rights to the SELF account using a “custom task” to only the Computer objects. You grant General, Property-specific and Create/deletion to the “Write msTPM-OwnerInformation” attribute.
To see the information that is being stored in AD, you need to install the BitLocker Recovery Password Viewer which is a component of Remote Server Administration Tools (RSAT). On your 2008 R2 Domain Controller(s) you simply start the “Add a feature” wizard and navigate to the RSAT/Feature Administration Tools and select the BitLocker Drive Encryption Administration Utilities. For older Operation System version it can be downloaded at Microsoft Download Center too. Once the Viewer has been added (or installed), you can now open the Active Directory Users and Computers MMC and open the Properties page of any computer account to see the BitLocker recovery tab. There you will see all of the Recovery ID’s and Passwords that have been generated for all drives encrypted by that computer. In my case the BitLocker recovery key was available after this simple steps. already When you don't use ConfigMgr for BitLocker activation you can use Group Policy to do the job also. Just have a look at Microsoft TechNet for more information on that. Hope it is useful information!
Source: Enable BitLocker, Automatically save Keys to Active Directory
