Note: This method is not officially supported by Microsoft. That said, this speeds up compliance and more importantly increases security as the device is already encrypted (part 1) before the user logs on (part 2). BitLocker recovery key changes after the user has completed enrolment are handled automatically (part 3).
Windows Autopilot preprovisioning (WhiteGlove) is the ability to pre-stage content and policies to devices while it's been installed in the factory. We had a challenge to speed up the overall compliance of Windows Autopilot devices and the obvious solution was to stage as much content as we could during pre-provisioning (WhiteGlove) but to also enable BitLocker encryption during that process, the only problem is that Microsoft don't officially support BitLocker encryption during the WhiteGlove scenario as the recovery key information is only uploaded after a user logs in. In our initial testing, Bitlocker disk encryption wouldn't even start until the user logged in.
That is not so much of a problem for a small amount of content on the hard disc but what if you have hundreds of Gigabytes of data to encrypt which could potentially take hours to encrypt after the user has logged on. As BitLocker encryption is a common Compliance policy setting, this needed to be addressed.
The challenge was to do the heavy lifting (pre-provisioning and encryption) during the WhiteGlove process and to only upload the key to Intune once the user actually enrolled the device. That need brought about this solution which is in 3 parts. The first part covers device encryption during provisioning at the factory. The second part uploads the recovery key to Intune after the user has signed in and completed WHFB setup and the final part moves those successfully encrypted devices to a WhiteGlove_Completed azure ad group targeted with BitLocker policy to take care of rotating recovery key info etc.
In Microsoft Intune, create a dynamic device group called WhiteGlove Computers with a query for a WhiteGlove Group Tag. This group will dynamically fill with computers that have the correct Group Tag assigned to them.
Step 2. Exclude BitLocker configuration profiles from this group
Locate any existing BitLocker configuration profiles in your tenant and exclude then from this group otherwise they will cause the solution to fail.
Step 3. Allow Pre-provisioned deployment
Next, locate your Windows Autopilot Deployment Profiles and enable the WhiteGlove ability by turning on theAllow Pre-provisioned deployment setting. Deploy the profile to the group created in Step 1. This profile must also enable a User Account Type of Local Admin. Don't panic, we'll be removing this local admin ability later on in the solution before the end user can cause trouble.
In the example below you can see a Windows Autopilot deployment profile called Intune: Local admin
Step 4. Exclude standard user deployment profiles
If you have any additional Deployment Profiles for Standard Users, make sure to exclude this group from those profiles otherwise they won't get the right settings needed for the second part of this solution.
Step 5. Configure a WhiteGlove ESP
Configure at least one Enrollment Status Page (ESP) targeted to your WhiteGlove Computers Azure AD group
Step 6. Add a Win32 App
Next, using the latest version of the IntuneWinappUtil.exe app, create a Win32 app called Enable Bitlocker during Windows Autopilot WhiteGlove. This app will enable Bitlocker during WhiteGlove at the factory. The app is in the attached 7 ZIP file, use 7-Zip to uncompress.
Note: Only logged on members of windows-noob.com can download this file.
Name: Enable Bitlocker during Windows Autopilot WhiteGlove
Program Install command: install.win.ap.enable.bitlocker.during.whiteglove.cmd
Program uninstall command: install.win.ap.enable.bitlocker.during.whiteglove.cmd
Install behavior: System
Device restart behavior: No specific action
Return codes:
0 Success
1707 Success
3010 Soft reboot
1641 Hard reboot
1618 Retry
Requirements:
Operating system architecture: x64
Minimum operating system Windows 10 1903
Detection rules:
Rules format Manually configure detection rules
Detection rules File
Path: C:\Windows
File or folder: Installed_WhiteGlove_Bitlocker.txt
Detection method: File or folder exists
Next, assign the app as required to your WhiteGlove Computers AAD group
Step 7. Add the Group tag to a test device
In this step either import a new CSV of a Windows Autopilot device (or use an existing device) to test this on, and then add the WhiteGlove GroupTag to that Windows Autopilot device.
Step 8. Provision the device
The staging of content and policies to the device normally will take place at the factory (OEM) or IT Admin staging area. At the first screen of OOBE (shown below)
The technician needs to press the Windows key 5 times to start provisioning mode.
Next, Select Windows Autopilot provisioning from the list and click Continue.
If everything went well it will download the correct Windows Autopilot deployment profile and display it (Intune: Local admin)
Click Provision to start the staging process.
Once the ESP installs the Win32 app, it will begin encrypting the drive. You can reveal this with the following command:
manage-bde -status
The next screenshots are from real hardware.
and once all apps and policies are installed completely and successfully the drive is fully encrypted and the protectors are stored in the TPM along with a BEK key stored on the SYSTEM partition temporarily.
At this point the technician can click on Reseal to seal the device for user enrollment (Part 2).
That 's it for this part, please join me in Part 2 where we'll add the next Win32 app which will do a bunch of actions including:
create a scheduled task to run a script when WHFB setup is completed
remove BEK protector
add numerical password protector
upload the key to Intune
restart the computer with a shutdown message to the end user
Troubleshooting
The Win32 app used in this part logs to C:\Windows\Temp\win.ap.enable.bitlocker.during.whiteglove.log
The contents of which are shown below from a working WhiteGlove deployment, please use this as a reference to compare your log file.
02/27/202304:33:46Starting script:'win.ap.enable.bitlocker.during.whiteglove' version:'0.11'...02/27/202304:33:46 checking the current bitlocker encryption status
02/27/202304:33:47CurrentBitlockerStatus:FullyDecrypted,None02/27/202304:33:47Fully decrypted,no need to decrypt
02/27/202304:33:47 starting TPM section
02/27/202304:33:48 TPM chip is currently owned, will not attempt to take ownership
02/27/202304:33:48 attempting to assign drive letter to the SYSTEM partition
02/27/202304:33:51 starting BitLockerEncryption section
02/27/202304:33:51 adding reg keys forBitLocker encryption settings
02/27/202304:33:51 succeeded adding the reg key
02/27/202304:33:51 adding AES-XTS256 reg key forBitLocker encryption settings
02/27/202304:33:51 succeeded adding the reg key
02/27/202304:33:51EnablingBitLocker, TPM ProtectorandRecoveryPasswordProtector02/27/202304:34:10 enabling bitlocker worked YAY!!!!02/27/202304:34:16Current BL Status: C:,EncryptionInProgress,XtsAes256,TpmExternalKey02/27/202304:34:16PercentageEncrypted:'96'%.02/27/202304:34:16PercentageEncrypted:'96'%.02/27/202304:34:16PercentageEncrypted:'96'%.02/27/202304:34:17PercentageEncrypted:'96'%.02/27/202304:34:17PercentageEncrypted:'96'%.02/27/202304:34:17PercentageEncrypted:'96'%.02/27/202304:34:17PercentageEncrypted:'96'%.02/27/202304:34:18PercentageEncrypted:'96'%.02/27/202304:34:18PercentageEncrypted:'96'%.02/27/202304:34:18PercentageEncrypted:'96'%.02/27/202304:34:18PercentageEncrypted:'96'%.02/27/202304:34:18PercentageEncrypted:'96'%.02/27/202304:34:19PercentageEncrypted:'96'%.02/27/202304:34:19PercentageEncrypted:'96'%.02/27/202304:34:19PercentageEncrypted:'97'%.02/27/202304:34:19PercentageEncrypted:'97'%.02/27/202304:34:19PercentageEncrypted:'97'%.02/27/202304:34:20PercentageEncrypted:'97'%.02/27/202304:34:20PercentageEncrypted:'97'%.02/27/202304:34:20PercentageEncrypted:'97'%.02/27/202304:34:20PercentageEncrypted:'97'%.02/27/202304:34:21PercentageEncrypted:'97'%.02/27/202304:34:21PercentageEncrypted:'97'%.02/27/202304:34:21PercentageEncrypted:'97'%.02/27/202304:34:21PercentageEncrypted:'97'%.02/27/202304:34:21PercentageEncrypted:'97'%.02/27/202304:34:22PercentageEncrypted:'97'%.02/27/202304:34:22PercentageEncrypted:'97'%.02/27/202304:34:22PercentageEncrypted:'97'%.02/27/202304:34:22PercentageEncrypted:'97'%.02/27/202304:34:22PercentageEncrypted:'97'%.02/27/202304:34:23PercentageEncrypted:'97'%.02/27/202304:34:23PercentageEncrypted:'97'%.02/27/202304:34:23PercentageEncrypted:'97'%.02/27/202304:34:23PercentageEncrypted:'97'%.02/27/202304:34:24PercentageEncrypted:'97'%.02/27/202304:34:24PercentageEncrypted:'97'%.02/27/202304:34:24PercentageEncrypted:'97'%.02/27/202304:34:24PercentageEncrypted:'97'%.02/27/202304:34:24PercentageEncrypted:'97'%.02/27/202304:34:25PercentageEncrypted:'97'%.02/27/202304:34:25PercentageEncrypted:'97'%.02/27/202304:34:25PercentageEncrypted:'97'%.02/27/202304:34:25PercentageEncrypted:'97'%.02/27/202304:34:26PercentageEncrypted:'97'%.02/27/202304:34:26PercentageEncrypted:'97'%.02/27/202304:34:26PercentageEncrypted:'97'%.02/27/202304:34:26PercentageEncrypted:'97'%.02/27/202304:34:26PercentageEncrypted:'97'%.02/27/202304:34:27PercentageEncrypted:'97'%.02/27/202304:34:27PercentageEncrypted:'97'%.02/27/202304:34:27PercentageEncrypted:'97'%.02/27/202304:34:27PercentageEncrypted:'97'%.02/27/202304:34:28PercentageEncrypted:'97'%.02/27/202304:34:28PercentageEncrypted:'97'%.02/27/202304:34:28PercentageEncrypted:'97'%.02/27/202304:34:28PercentageEncrypted:'97'%.02/27/202304:34:29PercentageEncrypted:'97'%.02/27/202304:34:29PercentageEncrypted:'97'%.02/27/202304:34:29PercentageEncrypted:'97'%.02/27/202304:34:29PercentageEncrypted:'97'%.02/27/202304:34:29PercentageEncrypted:'97'%.02/27/202304:34:30PercentageEncrypted:'97'%.02/27/202304:34:30PercentageEncrypted:'97'%.02/27/202304:34:30PercentageEncrypted:'98'%.02/27/202304:34:30PercentageEncrypted:'98'%.02/27/202304:34:31PercentageEncrypted:'98'%.02/27/202304:34:31PercentageEncrypted:'98'%.02/27/202304:34:31PercentageEncrypted:'98'%.02/27/202304:34:31PercentageEncrypted:'98'%.02/27/202304:34:31PercentageEncrypted:'98'%.02/27/202304:34:32PercentageEncrypted:'98'%.02/27/202304:34:32PercentageEncrypted:'98'%.02/27/202304:34:32PercentageEncrypted:'98'%.02/27/202304:34:32PercentageEncrypted:'98'%.02/27/202304:34:33PercentageEncrypted:'98'%.02/27/202304:34:33PercentageEncrypted:'98'%.02/27/202304:34:33PercentageEncrypted:'98'%.02/27/202304:34:33PercentageEncrypted:'98'%.02/27/202304:34:34PercentageEncrypted:'98'%.02/27/202304:34:34PercentageEncrypted:'98'%.02/27/202304:34:34PercentageEncrypted:'98'%.02/27/202304:34:34PercentageEncrypted:'98'%.02/27/202304:34:35PercentageEncrypted:'98'%.02/27/202304:34:35PercentageEncrypted:'98'%.02/27/202304:34:35PercentageEncrypted:'98'%.02/27/202304:34:35PercentageEncrypted:'98'%.02/27/202304:34:35PercentageEncrypted:'98'%.02/27/202304:34:36PercentageEncrypted:'98'%.02/27/202304:34:36PercentageEncrypted:'98'%.02/27/202304:34:36PercentageEncrypted:'98'%.02/27/202304:34:36PercentageEncrypted:'98'%.02/27/202304:34:36PercentageEncrypted:'98'%.02/27/202304:34:37PercentageEncrypted:'98'%.02/27/202304:34:37PercentageEncrypted:'98'%.02/27/202304:34:37PercentageEncrypted:'98'%.02/27/202304:34:37PercentageEncrypted:'98'%.02/27/202304:34:38PercentageEncrypted:'98'%.02/27/202304:34:38PercentageEncrypted:'98'%.02/27/202304:34:38PercentageEncrypted:'98'%.02/27/202304:34:38PercentageEncrypted:'98'%.02/27/202304:34:39PercentageEncrypted:'98'%.02/27/202304:34:39PercentageEncrypted:'98'%.02/27/202304:34:39PercentageEncrypted:'98'%.02/27/202304:34:39PercentageEncrypted:'98'%.02/27/202304:34:39PercentageEncrypted:'98'%.02/27/202304:34:40PercentageEncrypted:'98'%.02/27/202304:34:40PercentageEncrypted:'98'%.02/27/202304:34:40PercentageEncrypted:'98'%.02/27/202304:34:40PercentageEncrypted:'98'%.02/27/202304:34:40PercentageEncrypted:'98'%.02/27/202304:34:41PercentageEncrypted:'98'%.02/27/202304:34:41PercentageEncrypted:'98'%.02/27/202304:34:41PercentageEncrypted:'98'%.02/27/202304:34:41PercentageEncrypted:'98'%.02/27/202304:34:41PercentageEncrypted:'98'%.02/27/202304:34:42PercentageEncrypted:'98'%.02/27/202304:34:42PercentageEncrypted:'99'%.02/27/202304:34:42PercentageEncrypted:'99'%.02/27/202304:34:42PercentageEncrypted:'99'%.02/27/202304:34:42PercentageEncrypted:'99'%.02/27/202304:34:43PercentageEncrypted:'99'%.02/27/202304:34:43PercentageEncrypted:'99'%.02/27/202304:34:43PercentageEncrypted:'99'%.02/27/202304:34:43PercentageEncrypted:'99'%.02/27/202304:34:44PercentageEncrypted:'99'%.02/27/202304:34:44PercentageEncrypted:'99'%.02/27/202304:34:44PercentageEncrypted:'99'%.02/27/202304:34:44PercentageEncrypted:'99'%.02/27/202304:34:44PercentageEncrypted:'99'%.02/27/202304:34:45PercentageEncrypted:'99'%.02/27/202304:34:45PercentageEncrypted:'99'%.02/27/202304:34:45PercentageEncrypted:'99'%.02/27/202304:34:45PercentageEncrypted:'99'%.02/27/202304:34:45PercentageEncrypted:'99'%.02/27/202304:34:46PercentageEncrypted:'99'%.02/27/202304:34:46PercentageEncrypted:'99'%.02/27/202304:34:46PercentageEncrypted:'99'%.02/27/202304:34:46PercentageEncrypted:'99'%.02/27/202304:34:46PercentageEncrypted:'99'%.02/27/202304:34:47PercentageEncrypted:'99'%.02/27/202304:34:47PercentageEncrypted:'99'%.02/27/202304:34:47PercentageEncrypted:'99'%.02/27/202304:34:47PercentageEncrypted:'99'%.02/27/202304:34:48PercentageEncrypted:'99'%.02/27/202304:34:48PercentageEncrypted:'99'%.02/27/202304:34:48PercentageEncrypted:'99'%.02/27/202304:34:48PercentageEncrypted:'99'%.02/27/202304:34:48PercentageEncrypted:'99'%.02/27/202304:34:49PercentageEncrypted:'99'%.02/27/202304:34:49PercentageEncrypted:'99'%.02/27/202304:34:49PercentageEncrypted:'99'%.02/27/202304:34:49PercentageEncrypted:'99'%.02/27/202304:34:49PercentageEncrypted:'99'%.02/27/202304:34:50PercentageEncrypted:'99'%.02/27/202304:34:50PercentageEncrypted:'99'%.02/27/202304:34:50PercentageEncrypted:'99'%.02/27/202304:34:50PercentageEncrypted:'99'%.02/27/202304:34:51PercentageEncrypted:'99'%.02/27/202304:34:51PercentageEncrypted:'99'%.02/27/202304:34:51PercentageEncrypted:'99'%.02/27/202304:34:51PercentageEncrypted:'99'%.02/27/202304:34:51PercentageEncrypted:'99'%.02/27/202304:34:52PercentageEncrypted:'99'%.02/27/202304:34:52PercentageEncrypted:'99'%.02/27/202304:34:52PercentageEncrypted:'99'%.02/27/202304:34:52PercentageEncrypted:'99'%.02/27/202304:34:52PercentageEncrypted:'99'%.02/27/202304:34:53PercentageEncrypted:'99'%.02/27/202304:34:53PercentageEncrypted:'99'%.02/27/202304:34:53PercentageEncrypted:'99'%.02/27/202304:34:53PercentageEncrypted:'99'%.02/27/202304:34:54PercentageEncrypted:'99'%.02/27/202304:34:54PercentageEncrypted:'99'%.02/27/202304:34:54PercentageEncrypted:'99'%.02/27/202304:34:54PercentageEncrypted:'99'%.02/27/202304:34:54PercentageEncrypted:'99'%.02/27/202304:34:55PercentageEncrypted:'99'%.02/27/202304:34:55PercentageEncrypted:'99'%.02/27/202304:34:55PercentageEncrypted:'99'%.02/27/202304:34:55PercentageEncrypted:'99'%.02/27/202304:34:55PercentageEncrypted:'99'%.02/27/202304:34:56PercentageEncrypted:'99'%.02/27/202304:34:56PercentageEncrypted:'99'%.02/27/202304:34:56PercentageEncrypted:'99'%.02/27/202304:34:56PercentageEncrypted:'99'%.02/27/202304:34:56PercentageEncrypted:'99'%.02/27/202304:34:57PercentageEncrypted:'99'%.02/27/202304:34:57PercentageEncrypted:'99'%.02/27/202304:34:57PercentageEncrypted:'99'%.02/27/202304:34:57PercentageEncrypted:'99'%.02/27/202304:34:57PercentageEncrypted:'99'%.02/27/202304:34:58PercentageEncrypted:'99'%.02/27/202304:34:58PercentageEncrypted:'99'%.02/27/202304:34:58PercentageEncrypted:'99'%.02/27/202304:34:58PercentageEncrypted:'99'%.02/27/202304:34:59PercentageEncrypted:'99'%.02/27/202304:34:59PercentageEncrypted:'99'%.02/27/202304:34:59PercentageEncrypted:'99'%.02/27/202304:34:59PercentageEncrypted:'99'%.02/27/202304:34:59PercentageEncrypted:'99'%.02/27/202304:35:00PercentageEncrypted:'99'%.02/27/202304:35:00PercentageEncrypted:'99'%.02/27/202304:35:00PercentageEncrypted:'99'%.02/27/202304:35:00PercentageEncrypted:'99'%.02/27/202304:35:01PercentageEncrypted:'99'%.02/27/202304:35:01PercentageEncrypted:'99'%.02/27/202304:35:01PercentageEncrypted:'99'%.02/27/202304:35:01PercentageEncrypted:'99'%.02/27/202304:35:01PercentageEncrypted:'99'%.02/27/202304:35:02PercentageEncrypted:'99'%.02/27/202304:35:02PercentageEncrypted:'99'%.02/27/202304:35:02PercentageEncrypted:'99'%.02/27/202304:35:02PercentageEncrypted:'99'%.02/27/202304:35:03PercentageEncrypted:'99'%.02/27/202304:35:03PercentageEncrypted:'99'%.02/27/202304:35:03PercentageEncrypted:'100'%.02/27/202304:35:03Current BL Status: C:,FullyEncrypted,XtsAes256,TpmExternalKey02/27/202304:35:03 removing drive letter assigned to the SYSTEM partition now...02/27/202304:35:04The drive is fully encrypted now :-), we are exiting the script !
Once encryption during WhiteGlove is completed a reg key is created (and we look for that later)
Introduction
Note: This method is not officially supported by Microsoft. That said, this speeds up compliance and more importantly increases security as the device is already encrypted (part 1) before the user logs on (part 2). BitLocker recovery key changes after the user has completed enrolment are handled automatically (part 3).
Windows Autopilot preprovisioning (WhiteGlove) is the ability to pre-stage content and policies to devices while it's been installed in the factory. We had a challenge to speed up the overall compliance of Windows Autopilot devices and the obvious solution was to stage as much content as we could during pre-provisioning (WhiteGlove) but to also enable BitLocker encryption during that process, the only problem is that Microsoft don't officially support BitLocker encryption during the WhiteGlove scenario as the recovery key information is only uploaded after a user logs in. In our initial testing, Bitlocker disk encryption wouldn't even start until the user logged in.
That is not so much of a problem for a small amount of content on the hard disc but what if you have hundreds of Gigabytes of data to encrypt which could potentially take hours to encrypt after the user has logged on. As BitLocker encryption is a common Compliance policy setting, this needed to be addressed.
The challenge was to do the heavy lifting (pre-provisioning and encryption) during the WhiteGlove process and to only upload the key to Intune once the user actually enrolled the device. That need brought about this solution which is in 3 parts. The first part covers device encryption during provisioning at the factory. The second part uploads the recovery key to Intune after the user has signed in and completed WHFB setup and the final part moves those successfully encrypted devices to a WhiteGlove_Completed azure ad group targeted with BitLocker policy to take care of rotating recovery key info etc.
All parts are listed below:
Step 1. Create an Azure AD group
In Microsoft Intune, create a dynamic device group called WhiteGlove Computers with a query for a WhiteGlove Group Tag. This group will dynamically fill with computers that have the correct Group Tag assigned to them.
Below is the query used:
(device.devicePhysicalIds -any (_ -eq "[OrderID]:WhiteGlove"))Step 2. Exclude BitLocker configuration profiles from this group
Locate any existing BitLocker configuration profiles in your tenant and exclude then from this group otherwise they will cause the solution to fail.
Step 3. Allow Pre-provisioned deployment
Next, locate your Windows Autopilot Deployment Profiles and enable the WhiteGlove ability by turning on the Allow Pre-provisioned deployment setting. Deploy the profile to the group created in Step 1. This profile must also enable a User Account Type of Local Admin. Don't panic, we'll be removing this local admin ability later on in the solution before the end user can cause trouble.
In the example below you can see a Windows Autopilot deployment profile called Intune: Local admin
Step 4. Exclude standard user deployment profiles
If you have any additional Deployment Profiles for Standard Users, make sure to exclude this group from those profiles otherwise they won't get the right settings needed for the second part of this solution.
Step 5. Configure a WhiteGlove ESP
Configure at least one Enrollment Status Page (ESP) targeted to your WhiteGlove Computers Azure AD group
Step 6. Add a Win32 App
Next, using the latest version of the IntuneWinappUtil.exe app, create a Win32 app called Enable Bitlocker during Windows Autopilot WhiteGlove. This app will enable Bitlocker during WhiteGlove at the factory. The app is in the attached 7 ZIP file, use 7-Zip to uncompress.
Note: Only logged on members of windows-noob.com can download this file.
WhiteGlove - Enable BitLocker During WhiteGlove preprovisioning.7z
Configure the app settings as follows:
Name: Enable Bitlocker during Windows Autopilot WhiteGlove
Program Install command: install.win.ap.enable.bitlocker.during.whiteglove.cmd
Program uninstall command: install.win.ap.enable.bitlocker.during.whiteglove.cmd
Install behavior: System
Device restart behavior: No specific action
Return codes:
0 Success
1707 Success
3010 Soft reboot
1641 Hard reboot
1618 Retry
Requirements:
Operating system architecture: x64
Minimum operating system Windows 10 1903
Detection rules:
Rules format Manually configure detection rules
Detection rules File
Path: C:\Windows
File or folder: Installed_WhiteGlove_Bitlocker.txt
Detection method: File or folder exists
Next, assign the app as required to your WhiteGlove Computers AAD group
Step 7. Add the Group tag to a test device
In this step either import a new CSV of a Windows Autopilot device (or use an existing device) to test this on, and then add the WhiteGlove GroupTag to that Windows Autopilot device.
Step 8. Provision the device
The staging of content and policies to the device normally will take place at the factory (OEM) or IT Admin staging area. At the first screen of OOBE (shown below)
The technician needs to press the Windows key 5 times to start provisioning mode.
Next, Select Windows Autopilot provisioning from the list and click Continue.
If everything went well it will download the correct Windows Autopilot deployment profile and display it (Intune: Local admin)
Click Provision to start the staging process.
Once the ESP installs the Win32 app, it will begin encrypting the drive. You can reveal this with the following command:
manage-bde -statusThe next screenshots are from real hardware.
and once all apps and policies are installed completely and successfully the drive is fully encrypted and the protectors are stored in the TPM along with a BEK key stored on the SYSTEM partition temporarily.
At this point the technician can click on Reseal to seal the device for user enrollment (Part 2).
That 's it for this part, please join me in Part 2 where we'll add the next Win32 app which will do a bunch of actions including:
Troubleshooting
The Win32 app used in this part logs to C:\Windows\Temp\win.ap.enable.bitlocker.during.whiteglove.log
The contents of which are shown below from a working WhiteGlove deployment, please use this as a reference to compare your log file.
Once encryption during WhiteGlove is completed a reg key is created (and we look for that later)
Recommended reading
Share this post
Link to post
Share on other sites