04/25/2019 added a compatibility matrix.
03/29/2019 added some modifications. Thanks to Andrew Lubchansky for helping me creating this.
|OS Common Name||Build Version||Compatible|
|1507 (RTM) Pro & Ent||10240||No|
|1511 Pro & Ent||10586||No|
|1607 Pro & Ent||14393||No|
|1703 Pro & Ent||15063||No|
|1709 Pro & Ent||16299||Yes|
|1803 Pro & Ent||17134||Yes|
|1809 Pro & Ent||17763||Yes|
Feel free to check your support status of Windows 10 with this report: https://www.itninja.com/blog/view/kace-sma-windows-10-end-of-life-report
It’s a long time since I have posted a blog here. Today I want to share with you my KITLOCKER (KACE & Bitlocker ;) ) stuff. In this article you can download several individual KACE-packages. You can download all of them here: DOWNLOAD
If you need assistance in importing these files to your KACE SMA feel free to contact your local partner, your local sales rep or have a look to this KB article: https://support.quest.com/kace-systems-management-appliance/kb/116949/how-to-import-and-export-resources
First: These scripts are Win10 only and tested with x64 1809 Pro and Ent. Also, you need to have an TPM Module in your devices which needs to be activated and the OS needs to be the owner (default in Win10)! You can double check this in your KACE SMA device inventory:
My scenario is that Win10 devices should use Bitlocker with Aes256 bit to secure the hard disk. The disk should be automatically unlocked by TPM during boot (no password needed). If something went wrong or the hardware has changed there should be a recovery key which can be entered. This key should be stored in KACE SMA and not in AD. Also, there should be no GPO involved.
The Bitlocker information in your device inventory should look like this if there is currently nothing set up on your device:
To start we should first create a smart label which groups all devices where a TPM module is ready for the use with Bitlocker and no encryption technology is used. You can download the ready to use KACE-package here: DOWNLOAD
TPM Based Bitlocker Ready
Of course, you could add a filter like “OS Name” contains “Windows 10” (or any other filter which matches your environment) to make sure that only your clients will get Bitlocker enabled.
KACE SMA will now put all the devices where we can enable Bitlocker into this Label. There is a simple PowerShell command which will enable Bitlocker and start the encryption. Also it will add a recovery password as a key protector which will be needed in case of hardware changes. You can run this by a daily schedule and all devices which already have Bitlocker enabled will not be affected if you use the “TPM Based Bitlocker Ready” smart label which I have shown above. You can download a ready to use KACE-Script here: DOWNLOAD
[TW] Bitlocker enable TPM & Password
Enable-BitLocker -MountPoint $env:SystemDrive -EncryptionMethod Aes256 -TpmProtector -SkipHardwareTest sleep -Seconds 15 Add-BitLockerKeyProtector -MountPoint $env:SystemDrive -RecoveryPasswordProtector
This will start the encryption process of the C: drive. The user can’t abort it and it will also survive reboots.
You can also check the actual state in your KACE SMA device inventory:
If the encryption has been completed by the device, it will automatically fall out of the “TPM Based Bitlocker Ready” smart label. Now we have a secured hard disk which will be automatically unlocked during the bootup by the TPM module. Now we need a custom inventory to store all the key protector information’s in our SMA device inventory. This can be done with a simple custom inventory rule. You can download the ready to use KACE-package here: DOWNLOAD
Inventory: Bitlocker Recovery
Good to know
is that devices which need the recovery key will display a screen where users
can see the ID of the numerical password. If they call your helpdesk team and
don’t know which computer it is they can give you the ID and you can
search for it in your KACE SMA device inventory or build a report for that.
If you want to be sure that clients will always have a recovery password as a key protector you can additionally create a smart label. This will check the right key protectors after every inventory of the device. This could be used for running a script which will then add a recovery password as a key protector. This could be useful if admins change configurations local on the endpoints. The smart label can be downloaded here: DOWNLOAD
Bitlocker missing Protector
All clients which fall into this label can then run the following KACE script on a daily schedule. You can download the script here: DOWNLOAD
[TW] Bitlocker add protector
Add-BitLockerKeyProtector -MountPoint $env:SystemDrive -RecoveryPasswordProtector
This is the basic setup you can use to manage your hard disk encryption for your endpoints. You can think about creating notification which will alert you if a device has Bitlocker missing or a wrong configuration. I hope that this article helps you, creating your own KITLOCKER strategy. If there is anything unclear feel free to use the comment section.