How to Manage BitLocker?

BitLocker is Microsoft’s built-in full volume encryption tool for Windows PC that enforces encryption on system drives, fixed data drives, and removable drives for data protection. BitLocker encryption helps prevent unauthorized access to data on lost or stolen devices by encrypting the entire Windows operating system volume on the hard disk and verifying the boot process integrity. When used in conjunction with TPM versions 1.2 and above, BitLocker can validate system files and boot activity. Hexnode UEM enables you to set up and manage BitLocker policy to help you configure encryption and recovery settings on Windows 10 PC.

Configure BitLocker encryption with Hexnode UEM

1. Log in to your Hexnode MDM portal > Navigate to Policies tab > Click on New Policy to create a new one or click on any policy to edit an existing one > Enter the Policy Name and Description in the provided fields.
2. Navigate to Windows > Select BitLocker under Security > Click on Configure.
3. Configure BitLocker settings.

Prompt for device encryption

Check this option to prompt users to encrypt the OS drive. Note: You cannot revert the action once encrypted.

How to create a custom recovery message and URL for Bitlocker encrypted PCs?

1. Log in to your Hexnode MDM portal > Admin > General Settings.
2. Enter a Custom Message and URL under Windows Custom Recovery Message.

How to check whether your device has a compatible TPM?

Method 1

1. Press Win+R and open Run > Type tpm.msc > Click OK to open the TPM Management snap-in console.
2. It will show whether your device has a compatible TPM or not.

Method 2

1. Press Win+R and open Run > Type tpm.msc > Click OK to open the Device Manager.
2. Check to see if you have Security devices listed. If yes, expand Security devices to see if you can see a TPM with its version number.

Method 3

Beginning with Windows 10, version 1803, you can check TPM status in Windows Defender Security Center > Device Security > Security processor details.

Apply the BitLocker Configuration to target entities using Hexnode UEM

There are two ways by which you can associate restrictions to the devices in bulk.

If you haven’t saved the policy yet,

1. Navigate to Policy Targets.
2. Click on + Add Devices, search and select the required device(s) to which you need to apply the policy > Click OK.
3. Click on Save to apply the policies to the devices.

If you’ve already saved the policy and taken to the page which displays the policy list,

1. Select the required policy.
2. Click on Manage > select Associate Targets.
3. Search and select the devices/ users/ device groups/ user groups/ domains to which you need to apply the policy. Click Associate.

Note:

Once the BitLocker policy is applied to your Windows PC, fixed data drives and removable data drives become write-protected (if the appropriate options are checked) until the BitLocker encryption is completed from the user end.

Possible Group policy conflicts

1. When write access to drives not protected by BitLocker is denied, the use of a USB startup key cannot be required.
   
2. Storing recovery information to Active Directory Domain Services cannot be required when the generation of recovery passwords is not permitted.
3. When OS drive is to be encrypted, if the device has no compatible TPM, “Allow BitLocker without a compatible TPM” should be checked.
   
4. You cannot create both a recovery key and a recovery password at the same time.
   
5. If one startup authentication method is required, the other method cannot be allowed. If you require the startup key, you must not allow the startup PIN and vice versa.
6. If the Deny write access to removable drives not protected by BitLocker policy setting is enabled, the option to generate recovery key must be disallowed.
7. Backup of BitLocker recovery information to AD DS must be enabled if both the recovery options are disallowed.