Hello and welcome back to the Ascent uh this is episode nine what we're going to go through
in this particular session is a paramount profile that we typically have implemented
often as the first security requirement for customers so
BitLocker encryption is what we're going to go through and Brooks is going to take
us through how that works and how to go set up the configuration in the console
thanks Adarsh yes like you said this is one of our first payloads we deploy with customers usually
it's also really easy to deploy so this should go pretty smooth and so why don't we start with
the profile itself we'll walk through that and then we'll we'll touch on the client itself
so here famous last words you said it was going to be smooth mate should but yeah I should have
learned by now yeah so we're in our modern peak UEM and we'll go ahead and create a new profile
and we'll select Windows Windows desktop and then device and we'll just quickly fill this out
so while you're filling that out BitLocker is a device profile right you won't see it in the
user profile option correct it's device only and what also is unique about it is that it's only
it's actually a a hub itself profile that's not OMA-DM so even though there isn't OMA-DM CSP
for BitLocker we currently have implemented it directly in the Hub so kind of our own tech
implementation of this so you do have to have the Hub fully installed and and and working properly
and you can see there's no OMA-DM over here or in in the encryption it um i
believe it says Hub yeah there it goes so that's how you know it's a Hub profile
and let's just do this we'll do optional and then we'll just do Windows 10 all
so we can deploy as needed all right so let's jump down to encryption so this there's a lot of
settings here so let's just quickly go through them so you for the volume to select you can
do the full hard disk itself so even if you have multiple partitions it will do all of them or you
can just do this system meaning the os partition I'll just do the complete one for encryption
you can do system default so whatever windows is set to by default this also can be configured
via baselines or GPO there's a lot of ways to change this or you can just have the Hub
directly set it to whatever you'd like per your security requirements I think xts is a
pretty common one that I've seen but it does vary I'll just leave that as default for now
only encrypt use space is pretty useful to have it just speeds up encryption so
it's only going to encrypt the data that is written so if you have a 60 GB
hard drive only 20 is written it's only going to do the 20 for to start
and then this is an interesting one here so this is a custom URL for recovery
and it gives you this little thing in the back in the gray here so HTTPS excuse me colon slash
your device services hostname slash my device so this is by default the self-service portal
that shows your device and it does contain the encryption profile so that is a common one to use
a couple caveats with that is if like it's gonna the laptop's gonna get into the screen they won't
be able to boot it's gonna present this so they're gonna have to probably go to this on their mobile
phones so they're not enrolled on their mobile phone uh they're gonna have to like type it in and
then authenticate so if you do want to set this you're going to want to make sure that your
users have their mobile devices pretty much enrolled already just for ease of use
um but if not you'll just have to they'll just have to browse to that URL
or you can just do a like help line you can do 188 modern peak help or whatever mp help whatever your
help desk line is something like that and that's just displays on the BitLocker blue
screen that comes up the nice thing about the um the self-service portal option is say
you do have relatively tech savvy users they could just go to that self-service portal
URL on their mobile phone and what they'd be able to do from there is go find their own BitLocker
recovery key so it could save you a help desk call it does depend on your user base quite a bit
yeah so in our case let's just go ahead and do it as that so we get a good example of it so in our
case it's the cn1506 uh or the the fully qualified you know friendly URL and then slash my device
at the end and then we'll show what that looks like once it's actually encrypted in a second
and then these next two are actually pretty important so that really goes to
how the encryption itself behaves so by default it's going to automatically encrypt but if we
have force encryption turned on that's going to make it so that it will immediately turn on
BitLocker in case it's ever suspended or turned off by your users so this is you know if you have
higher security requirements like there's never a case where it needs to be suspended now the caveat
here as well is that if there are times where you do need to suspend it such as upgrading the bios
servicing the firmware things like that then it can make doing those things quite
difficult because it's going to immediately turn it back on so the default if you don't
select force encryption is going to be a 30 minute automatically turn it flip it back on
so that gives you a little bit more window of time to do some servicing of the device which
is I tend to prefer that a little bit but that's what the force does if you need it and then keep
it system encrypted at all times means that even upon unenrollment or installation of the Hub or
anything that happens then it will retain and keep BitLocker turned on as is and the key itself the
recovery keys will just be saved in the console and they can be looked up later even though the
device is in an unenrolled state if that's that's a recent thing that was added I believe in 2005
forget the exact version but the last couple releases they added this this is a nice one
okay so then after that we will go into the authentication
settings so the default one and the one I recommend most of the time is just use the tpm
password is for the users will have to create their own password this will pop up a Hub screen
they'll have to type it in and then the behavior with this one is that it's going to encrypt it
in the background and then once they put in the password it will add that as a kind of a friendly
way to unlock it if they ignore the screen and don't type it in and they happen to reboot then
it's going to ask for the recovery key because there isn't an unlock key that's a pin so use that
as you know in the best way there but I like to do TPM because it's completely silent for the user
um you can also add on a TPM like an additional PIN plus TPM here if you need that i think that's
a little bit overkill for most use cases but that's there as well and then
this use password of TPM not present so this is kind of a nice one where it's like a fallback so
for some reason TPM is not functional then it will do the popup for the password so that can be nice
especially a good one if you're doing testing and VPN yeah virtual machines exactly
exactly yeah VMs often don't have TPMs because you have to go through a few steps to add it yeah
so that could be a nice one there or if you just don't ever want it on a
virtual machine this is a good way of doing the setting to just for TPM because if if
it doesn't have it it's just never going to apply at all so that is another way of doing it
and then this one suspend BitLocker until TPM is initialized really you only need to do this if
you're doing if you have systems going throughout the out of box experience and it can take a little
bit of time for those TPMs to initialize sometimes so this is just a nice um additional setting there
okay so then a couple more things here so create a static recovery key this is kind of cool this
allows you to um it'll place a key here and then you can just set it and forget it leave it the
same thing or you can have it auto-rotate you know like every 180 days this will just add an
additional key that for example you can share this with your the IT admin groups help desk
and that they can have the same key that's on every single device and so it gives just an
easy way to like quickly unlock without having to actually go and look up the unique key per device
so I've used that at times it can be nice to have but I just recommend if you do have this
then save this key somewhere in a confluence page or documentation and kind of update it as
it rotates because it'll rotate it it won't actually notify you when it when it changes
I won't do that for now and then this last one is it allows you to do some servicing at a schedule
so you can say suspend at 12 a.m in time at 8 00 a.m you know overnight if you have kiosk machines
or devices that are kind of always online for laptops this can be a little bit tricky
just because it's a hard to then also exactly get them to to service different
things at exactly that right time but it you know feel free to use this if you if it meets
some of your use cases and then you can have it repeat if needed as well
but those are more advanced and there's kind of extra stuff there for the basics we'll just do
this as is and give it a shot so I think we're good there we will save and publish
so it's an optional uh profile so it's not going to automatically go down it will once we push it
okay so let's flip to our VM here i'm going to do it in Workstation
I've got a 1909 VM set up it is built in EFI mode so that's a key requirement to adding a virtual
TPM in Workstation it does have to be in EFI mode and then let's go ahead and edit these settings
here and take a look so one additional thing you will have to do is encrypt the machine so you go
to here to options access control encrypt it and then it'll ask for a password this just ensures
that the actual virtual TPM is itself protected so that the full VM is encrypted all the way around
once you do that you have to have it powered off uh then you can add the virtual
TPM and then just double check obviously here in advance you want this to be set to UEFI
uh you can't change this after you build the os so if you actually build Windows 10 with this you
have to actually would have to convert it to MBR with there's an MBR to GPT tool and then flip it
or just recreate it clean from UEFI it's probably easier and brooks encrypting the VM um if you have
a VM that's already out there and you've you've been working with it for a little while it does
take a little a little while to do that process yeah especially on the disk depending on the disk
that you have and the resources it can take five ten minutes to fully encrypt so I've already gone
ahead and done that to save us some time here but yes that is a good good thing to remember for sure
okay and then the last step then let's add a new device and add the TPM
there we go once we power this on it should just boot right in and then
we can push the profile down to this device
and in this case I just have a local account um on this VM it's not joined to the domain
or anything so there isn't really any extra requirements around the directory type or the
what type of user you have it's it works regardless
okay let's pop back to the console here and take a look at our devices
is that it yep that's one there we go
yep that looks it okay so here we go we found it yay hey
uh there's a computer name and yep it is the VMware seven comma one so let's go ahead and
push this profile down you can see that it's available but not actually installed
oh now it'll flip to pending
take a look
there it goes encryption in progress
nice nice yeah there we go you can see how fast it works once
once it comes down it's really really quick
and then if we take a look at our TPM it should show as ready to use and healthy
ready for use nice there we go and then you'll see the C drive comes
up as encrypting and you can go into a command prompt elevated and do a manage pde dash status
and also exactly let's see how that's going to see the lock there you can right click and do
manage BitLocker we'll show the control panel item here encrypt
do
dash status
percentage there we go it looks like that e x t s aes 8128 is going to be the default yep
and then green checkbox so there we go and it'll say in progress but it immediately saves the
recovery key so that's an important bit as soon as it encrypts it's going to make sure that this
gets saved otherwise it will be unrecoverable so we always want to make sure that this key is here
and you didn't create it in the profile but the static recovery key would just show up as
another option in here exactly yeah it would just be down here it's a second item there
yep and then we can also go to security under more and it'll give some more information about
the status as well as the key from this point as well that's cool and then I think the last thing
you mentioned which was the self-service portal which you started with but is there a way that an
end user can get this information too yes so as we set it to well it's regardless if you even though
we configured it in the profile for the friendly URL it's always going to show in the self-service
portal so we'll go ahead and go to this the your ds server slash my device so I've done that
and then I've authenticated and then if you have multiple devices like we do here we'll
have to kind of hunt peck around I think it was the 7.1 was that the right one yeah
uh again best practices and we'll maybe show this in a later episode of just how to make
some of this more friendly so put the host name in here as well sometimes just to make it
easier to find like which device is it what's my device name okay so if we go to details more and
no I think it was more and then there's a security option in there I think oh yeah sorry
we could click on the device go to details click more and then click on security
nice and then there it is encryption recovery key cool so I can go to a self-service portal on my
mobile device and get that information if I need it yeah so there'll be a little education on like
where to click for your users it might be good to email them this or send them out information
on how to get this because it's a little bit buried it's not front and center unfortunately
I know that they're wanting to enhance that in the future to make that a little
bit easier to find straight in the hub but for now that's that's where you can find it
cool okay and I think that's it I mean that's the basics of encryption it's probably
done by now there we go yep uh if we probably let's see if it's updated yet
so if this doesn't immediately update the status here just do a quick query uh of device status
and then the sample for this we'll should be able to come back pretty quickly here
back we'll just keep refreshing there we go so after it the the sample came back then
it's just going to show protection on and if we go back to security it should show
everything is good yeah yep otherwise if you don't
query it it'll just do it upon the scheduler so you'll see that update pretty soon afterwards
exactly and then obviously if we remove this profile or unenroll the device by default it's
going to remove encryption since we didn't do the persist encryption thing so that
that is the default behavior there and it will just kind of undo everything that's done
but I think that's it so that's just the basics of getting started with BitLocker on Windows 10.
yeah short and sweet yeah pretty easy function often the first thing we set
up for most customers so thanks Brooks uh that was awesome and we look forward to
seeing all of you on the next episode of the Ascent take care thanks bye