Microsoft Endpoint Manager is great however, if you want to encrypt Windows 10 device silently with a normal standard user logged in then you might find it difficult to do so via the MEM Portal settings. So this is where this blog post will come in handy 🙂
In order to encrypt the device silent you need to create a Custom Configuration Policy. Browse to your Microsoft Endpoint Manager Portal or Intune Portal –> Go to Device Configurations Profile –> Create New Profile
- Enter a Name for the Profile
- Select Windows 10 and later from Platform
- Select Custom from Profile type
- Select Configure from Settings
- Press Add
We will now need to enter the following information to configure encryption.
Once you have created the policy, assign it to your required devices and BitLocker will now encrypt the devices.
Oh but wait!!!
In my experience in performing this procedure have ran into an issue where Intune recognises the device has compliant against “Require BitLocker” but non-compliant against “Encryption of data storage on the device”.
This is due to the device not being able to backup the BitLocker Encryption Key to Azure Active Directory. The workaround for this was to deploy a PowerShell script using Intune that forces the key to be backup up.
So lets add a script to Intune which will execute the required steps; First go to Device Configuration –> Scripts –> Add
Provide a Name which will easily identify the script in the Intune Portal.
Browse to the script location on your local machine or network drive
Tick Yes to Run script in 64 bit PowerShell host.
And save then assign to the required AAD Group to execute on the client macine.
I cannot take any credit for the script but it resolves the issue I encountered and my compliant policy was once again “Compliant” for all devices. I have made this script available via my GitHub account.
The Author – Blogabout.Cloud