Automatically bitlocker Windows 10 MDM Intune Azure AD Joined devices

Update: in recent builds of Windows the BackupToAAD-BitLockerKeyProtector PowerShell command does most of what this used to do 🙂

I recently ran into an article by Pieter Wigleven, based on an original idea of Jan Van Meirvenne that I simply have to share, and expand upon.

When you go cloud first, and do light MDM management of your Azure AD Joined Windows 10 devices, you will likely enable a Bitlocker policy in Intune. What you’ll quickly discover, is that your policy will not automatically enforce/enable Bitlocker on non-InstantGo capable devices.

So, I expanded upon Jan and Pieter’s script to automatically enable Bitlocker on Windows 10; it has additional error handling, local logging and it will eject removable drives prior to immediately (vs reboot) encrypting your system drive. After this is started, it will register your recovery key in AzureAD. Of course all credit for the original idea goes to Jan van Meirvenne.

Powershell source file

enableBitlockerAndRegisterInAAD_v0.04.ps1 (right click, save as)

MSI file

enableBitlockerAndRegisterInAAd_v0.04.msi (right click, save as)

As Intune won’t let you deploy a Powershell script, I’ve also wrapped the script in an MSI file with Advanced Installer for you. What this will do;

  1. Deploy the PS1 file to the machine
  2. Register a scheduled task to run this PS1 file at logon each time
  3. Kick off the scheduled task once so a first reboot isn’t required

Advanced installer package (.aip) (right click, save as)


  1. Windows 10, AzureAD Joined
  2. TPM chip
  3. User should be local admin
Notify of

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Voted
Newest Oldest
Inline Feedbacks
View all comments
6 years ago

Hey Jos! Does the user really need to be a local admin? Doesn’t Intune already install apps on a system level?
At our company we’d not like to make users a local admin. Is there a way to do this without the user having admin privileges?

Thank you in advance for your help,
All the Best


[…] used Advanced Installer to wrap this in an MSI for easy deployment through Intune, and would like to share this with you […]

gary chen
gary chen
6 years ago

HI, i found that the MSI package only can encrypt the OS drive (C:), but can’t encrypt data drive (D:).

Berry van Bree
Berry van Bree
6 years ago

Hi Jos! When you use a provisioning package the “HKLM:SYSTEMCurrentControlSetControlCloudDomainJoinJoinInfo” key is filled with the ID of the package. Example:

In that case it will be impossible to write the key to AAD. I think this will also be the case when you use provisioning methods as Autopilot in the future.

6 years ago

Hi Jos! Can you send me the aip file for your msi? I have problem to create msi files thats works with intune and need to be run with higher privileges. Thanks!/John