Intune - BitLocker silent and automatic Encryption Settings for Lenovo Thinkpads
A while ago, I was working on an endpoint management project and one of the key requirements was to roll out BitLocker policies to the Windows 10 MDM enrolled devices. As much as this may seem routine, what made things interesting was that the customer only had Lenovo devices and apparently it required some additional bits and pieces to be put in place along side the Intune BitLocker encryption settings. I will cover the details and my experience through this blog. Before going into the details, please make a note of the requirements for automatic BitLocker device encryption: 1. Device should be running 1903 with latest CU or newer build. 2. TPM 1.2 or 2.0. 3. UEFI Secure Boot should be enabled. 4. DMA protection should be enabled. As for my project requirements for enabling BitLocker encryption are concerned, they are as follows - 1. Enable BitLocker of OS drive. 2. Configure BitLocker automatically and silently without any kind of user interaction. 3. Disable Startup Pin. 4. Escrow...