With Intune’s new Bitlocker Encryption Report administrators have an effective way of seeing which of their devices have been encrypted.
But if we want to know if we can actually recover the bitlocker key of a device, we need to know if it was ever uploaded to AzureAD.
Network or local device issues can sometimes prevent the recovery key from reaching AzureAD, resulting in lost data if the device’s disk needs to be recovered for any reason. To hunt down devices that have not escrowed their recovery key to AzureAD, you can use my report function (in PowerShell as always):
In a Windows 10 full MDM (AzureAD+Intune) scenario, you’ll move your email, app and file workloads to Office 365 (or alternatives).
In your pilot or hybrid phase, you may still need access to certain file shares on your servers, so here’s a simple PowerShell script you can deploy using Intune Device Configuration that maps your desired share. Deploy multiple times for multiple shares (or groups of users).
It will create a shortcut in a location you define, so the mapping is always user-driven, it will automatically suggest your user’s AzureAD login as username. You can of course customize the script to your liking if you did not change your local AD upn yet.
So, I expanded upon Jan and Pieter’s script to automatically enable Bitlocker on Windows 10; it has additional error handling, local logging and it will eject removable drives prior to immediately (vs reboot) encrypting your system drive. After this is started, it will register your recovery key in AzureAD. Of course all credit for the original idea goes to Jan van Meirvenne.
You may have been reading up on the Enterprise Mobility Suite by Microsoft. Especially now that Windows 10 has been released, it seems like everything is becoming easier and simpler for end users, managers and admins alike while Microsoft is really pushing the Anywhere, Anyplace, Anytime concept.
Let me state first off that I believe these advancements are incredible, and I really feel Microsoft is heading in the right direction, but there are quite a few ‘gotcha’s’ that you probably don’t know about that could hurt your implementation, they may not always apply to you.
In my opinion, as EMS currently stands as a suite, when used to manage Windows 10 laptops / tablets and desktops, is only suitable for very ‘light’ management situations unless there is an additional device management authority such as SCCM fully configured and implemented as Internet Facing for true device and application management.