Hey guys, welcome back.
This is Bernardo from the BTNHD.
And yes, I am finally tackling BitLocker with SCCM.
I've done a lot of reading and research and this is what I've come up with.
I haven't tested this out yet within my environment because I'm still looking for a physical laptop
that I'm able to enable BitLocker you know, within BIOS and all that stuff.
So hopefully, the steps that I go over with you guys, you test it out, let me know if
it works out, give me some pointers and whatever.
But first time tackling this, I read a lot of Microsoft documentation.
And this is what I got so far.
So first things first, we're going to open up our SCCM I am running SCCM 1910.
And we need to get into our operating system node.
Within our operating system node, I'm going to go inside my task sequence.
I'm going to right click on it and pick create task sequence you're going to get the nice
little wizard we're going to leave the default setting as install an existing image package.
Click Next.
Give you a task sequence and name and also pick your boot image.
This is the following information that I entered, click next, pick your image package, as well
as your index and then also provide a local admin password.
So I gave it all that information click on Next.
For this task sequence, I actually clicked on join a domain i entered my domain as well
as the domain OU and then that provided an account that has full access within the Active
Directory to add this machine into, you know, the domain controller.
Click Next.
This right here is your configuration manager client settings.
These.. these are my settings within my environment, but yours is probably a little different.
So make the modifications here then click Next.
I am not going to do a state migration so I just uncheck everything because I'm not
doing it.
click next here.
You are able to push out updates during your deployment process.
I left it as do not install any software updates.
Next, I'm not installing any apps, but most likely you guys are installing apps within
your environment.
So for this video, I'm going to say no no for apps.
So hit Next on that nice little summary next, and you get green checkmarks which is always
a good thing and we're going to close it.
now within our test sequence, we are going to select our new task sequence which for
me was BTNHD windows 10 BitLocker.
We're going to right click on it and we are going to click on Edit.
So once your task sequence editor opens up, the first thing I'm going to do is select
the BIOS the partition disk zero BIOS everything is configured as you UEFI or unify.
So within that variable, I'm going to go to options and then just give a checkmark to
disable this step because I do not want it.
we're going to go inside partition to zero unify.
And within options just make sure that your task sequence variable make sure you have
on the _SMSTS boot unify equals to true okay now that task sequence variable is extremely
important so select it copy it because you're going to be pasting it in other places next
thing we need to do is to pre provision BitLocker I left everything as the default for my understanding
what the documentation that Microsoft released but within options, there is nothing in there
and so that copy and paste that you did within the partition disk zero.
We're going to paste it in there.
Now if you forgot to copy it, you are able to enter it manually.
So you click on Add conditions, you want to click on task sequence variable the variable
and the value will be this will be underscore SMS TS boot unify and the value should be
true.
Press okay.
Right.
If you were smart, you copied and pasted into this.
If not, you could do it manually.
You knew the way I just showed you.
Now next thing that we need to do is at the very end where it says enable BitLocker.
Right, I left everything as the default.
But within options, they're going to give you the SMS TS WTG not equal to true.
Now this variable is this, okay!
This is for System Center 2012 Configuration Manager, SP1 and later, and it specifies if
the computer is running a Windows to go device.
Now I don't have any machines, I'm going to be pushing out windows 10 that has a Windows
to go device, I'm going to remove that task variable within my task sequence because I
don't think I'm going to use it.
So I selected it, click the Remove, you get a nice little warning.
Are you sure you want to delete it? press OK.
And if you're smart, you copy that SMS TS boot unify variable and you can paste it in
here.
I was a smart so I'm going to click on the drop down, click task sequence variable, provide
the variable name and the value which was this, click OK.
And then you get to go then you apply it And then you Okay, boom.
Now once you're inside your test sequence node you're going to right click on it and
you want to click on deploy to get the deploy software wizard because you need to deploy
it, you need to pick your collection.
So I'm going to click on browse, you get a nice little warning, just press OK.
And pick your collection.
Now, I'm going to pick all unknown computers, right because when I PXE boot, I want the
TPM the BitLocker thing to enable during the PXE boot process, so press OK on that, leave
everything as a default Click on Next.
I don't want to advertise this to clients.
So click on that drop down menu and I'm going to pick only media and PXE.
Okay, click next.
Scheduling I'm not going to schedule anything click next here user experience left everything
as the default click next alerts default nothing click Next.
For the DP, I left everything as the default click next nice little summary.
Click Next.
All green checkmarks which is a good thing and then close and then you boom Now, a couple
of things that you need to do within your domain controller, your Active Directory,
I have my Active Directory my slash domain controller hooked up into my vMDT.btnhd.edu
in MDT server slash a lot of things I know.
Also, my Azure AD Connect sue me right not best practice.
But when you have limited resources, you got to make it work for you.
So within my domain controller, I'm going to click on starts.
And I'm going to open up the Server Manager.
Once your Server Manager is up and running on the upper right hand side and click on
Manage, click on Add Roles and Features.
Get the wizard click on next, next, next, again, we don't want any roles, we need features.
So click on next here, we're going to go all the way to the bottom where we see Remote
Server Administration tools are going to open that up.
We also going to open feature administration tools open that up and the one that we want
is BitLocker drive encryption administration utilities.
So when you open that guy up, you get two other things that come with the package, you
got the BitLocker drive encryption tools.
And then you got the BitLocker recovery password viewer, which these are kind of settings,
or plugins that are going to be added within your Active Directory, which I'm going to
show you guys.
So select all three of them, click on Next install, it's going to start installing it
and eventually is going to say installation succeeded, which is a good thing.
Click Close, right.
Next thing that I kind of read with my you know, researching the BitLocker thing with
deployment is we need to create a GPO.
So open up your group policy management within your domain controller or whatever workstation
it has access to or whatever, open it up, I'm going to select my group policy objects,
right click on it and then click on new.
Provide your GPO new name.
So I gave it the following BTNHD BitLocker policy and click OK.
And then Locate your new policy, right click on it and then click on Edit, we need to get
into the following.
To configure this, we need to get inside Computer Configuration policies, Administrative Templates,
and Windows components.
And the node that we need to get into is called BitLocker drive encryption.
inside that folder, there's three other folders, you got fixed data drives, operating system
drives, and removable data drives.
Now, the one that we're focused on is operating system drive.
So when you select that you get like a crap load of policies to configure, we're only
going to focus on a couple of them.
And the first one is choose how BitLocker protected operating system drives can be recovered.
So double click on that, you got a lot of settings, we're going to click on enabled.
I can't really tell you what's the best practice but for what I read within Microsoft, the
default ones will work great.
Depending on your environment, you might have to configure it and tweak it to fit your environment.
Okay, now once you have this enabled, One thing that you need to check off and it's
the last option which do not enable BitLocker until recovery information is stored DDS for
the operating system drive so you want to enable that once you enable it apply, okay.
Now the next GPO setting that we need to configure is configured TPM platform for native UEFI
firmware configurations.
So locate that double click on it for again, like documentations that I read, if you enable
it, leave all the default settings as as it should work with no problem, you are able
to look at the list and then configure it for your environment, but i'm going to leave
everything as a default, I'm going to apply it Okay.
And then you're done with the GPO.
Now, if you go inside Active Directory, you locate one of your computer nodes, right click
on it, you go to properties, you're going to see a new tab which is going to say BitLocker
recovery.
If you click on it, you should have like BitLocker recovery passwords and details.
Again, I haven't found a machine that I can actually test this stuff out.
So I'm hoping that one of you Guys are brave enough to follow the kind steps test it out
environment, let me know how it works out.
And also, with one of the items right here says if you right click on the domain object,
you are able to do a find BitLocker recovery password, which is pretty cool.
So if you right click on the primary node of your domain controller, you're going to
see a new option that says find BitLocker recovery password, you click on it, it gives
you a nice little kind of finder, search box thing, which is awesome.
And that's it.
Again, I'm still trying to find a machine that I'm able to configure this and test it
out for you guys.
This is kind of the information that I kind of grabbed from Microsoft and just put it
together.
Hopefully you guys can follow along, test it out within your lab and see how well it
works.
If it works out, let me know at the bottom of the video at the comment section.
If it doesn't let me know.
See, I want to see how if you guys got it to work or you had to do a couple of things
to get it to work.
I like to know because this is my first time actually tackling BitLocker and SCCM so hopefully
you guys enjoyed this video leave comments below don't forget about hitting that like
button and also subscribe share the video and I'll catch you guys on the next one.
Peace out!