0

I am tasked with enabling BitLocker via InTune and I am struggling to understand why the following settings are not taking effect on the endpoint.

In the OS drive settings

Compatible TPM Startup - Blocked
Compatible TPM startup PIN - Blocked
Compatible TPM startup key - Blocked
Compatible TPM startup key and PIN - Required

I have had the solution working for TPM and PIN, but the people I work for want TPM, Key and PIN. When I go to turn on BitLocker in "Manager BitLocker", I am greeted with the dreaded "This PC requires a startup option that isn't supported by BitLocker setup."

Trying to research this error led me to 4sysops.com which says:-

"If you see this one, it is usually caused by having more than one required option for additional authentication for an OS Drive at startup.

You can’t require more than one startup type."

Unless my (il)logic is flawed, then with the settings I set above, this condition should be satisfied.

Anyone have any ideas?

Swisstone
  • 6,725
  • 7
  • 22
  • 32
The_Honkler
  • 3
  • 1

2 Answers2

1

This is not supported, take a look at the documentation:

https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#bitlocker-key-protectors

PIN A user-entered numeric key protector that can only be used in addition to the TPM.

Additionally, the supported authentication methods are listed too:

TPM only
TPM + PIN
TPM + Network key
TPM + startup key
Startup key only
Swisstone
  • 6,725
  • 7
  • 22
  • 32
  • This had crossed my mind, but it begs the question why Microsoft had included it as an option in InTune. I personally think Microsoft need to revise the way BitLocker is configured in InTune. Nonetheless, thanks for your input. :) – The_Honkler Oct 14 '21 at 10:52
0

TPMandPINandStartupKey needs to be configured using the command line. The wizard isn't compatible with that setting.

TPMandPINandStartupKey

Greg Askew
  • 35,880
  • 5
  • 54
  • 82
  • As it goes, whereas this would be the solution and I had seen this in Group Policy, what my bosses were looking at would not be achievable anyway due to our current usb "tokens" being recognised as smart cards which cannot be currently used in the pre-boot environment. Thanks for your input! – The_Honkler Oct 14 '21 at 10:47