this machine is disabled for file encryption

After a while we noticed Secure Boot was disabled on some devices. We went through the BIOS (which is UEFI) searching for differences.

So we run a TPM update on some of our test devices, without luck. We compared the TPM versions on several devices and noticed we have TPM 1.2 and 2.0. It couldn`t be a hardware requirment, the hardware is all equal and still on some hardware it worked as expected and some did not. We also checked online documentation if we missed a requirement to silent enable encryption. We searched on the internet for those events. We also set Warning for other Disk encryption to Block, this equals BitLocker CSP AllowWarningForOtherDiskEncryption set to 0.Īs stated on Microsoft docs here, on Windand newer devices Windows will attempt to silent enable BitLocker with those settings.īecause these events are completely the opposite of each other and the recovery information was written to Azure AD, we didn`t immediately had an idea where to begin with our troubleshooting. One of the encryption settings we set is Encrypt devices (to Require), which equals to the Bitlocker CSP setting RequireDeviceEncryption set to value 1. We created an Endpoint Protection policy with some Windows encryption settings. So the user authenticates to Azure AD, the device is joined to the Azure AD and automatically enrolled in Intune. In this environment we are testing modern desktop deployment using Windows AutoPilot. I`d like to share my findings in this blog post and what setting resolved our issue.

One of the paragraphs was about security and the ability to fully automate disk encryption on Azure AD joined, Intune managed devices.Īt one of our customers we are implementing Intune to manage the laptops and run into a problem with this silent encryption process. One of my latest blog posts I wrote about Modern desktop deployment.

This machine is disabled for file encryption