There are other ways to do it, such as USB or TPM and USB, but they add a level of complexity and arn’t what we are looking for here. This is a required part to make use of this solution. The first step of enabling BitLocker is to find out which of your clients that has a TPM chip. Create the Configuration Item that will evaluate if TPM is activated on the client The part you want is under Hardware Inventory.

You can create a new Client Settings instead if you want to test this on a few clients first. Select Bypass from the dropdown and click OK Go to Computer Agent and find the setting PowerShell execution policy Open Properties on Default Client Settings If this is left as default you will get an error message that read Script is not signed. You can read more about this setting here. This is a requirement for one of the Configuration Items that we will create later. Create a Task Sequence to set encryption level and enable BitLockerĪllow unsigned scripts to be run from SCCM.Create a collection with compliant devices.Create the Configuration Baseline using our new CIs and deploy it to clients.One to verify that TPM is activated and one to check if BitLocker is already enabled. Allow unsigned scripts to be run from SCCM.These are the steps we need to perform to enable bitlocker on existing devices. Please note that you need to make sure that your environment is prepared for BitLocker before taking these steps! Instructions I will use a Configuration Baseline (CB) to determine this and also to find the computers that are not ready to encrypt the disks.ĭuring this How-to there might be some changes you need to perform in your SCCM environment but they are minor and shouldn’t be an issue for you. First off we need to find out which computers require BitLocker and if they are ready to be enabled. In this case, I will use SCCM and a Task Sequence to enable BitLocker. TPM is a hardware component that is installed by the manufacturer and can be used to ensure that the computers have not been tampered with while the computer was powered off. This can easily be done during OS installation for all new computers but it might be troublesome to enable BitLocker on existing devices.īitLocker can use multiple key information methods but in this case, I will focus on TPM. A big part of this is to encrypt the disks of their devices using BitLocker. All businesses want to protect their data to make sure it is safe from unauthorized users.

Mbam sccm