I am experimenting with bitlocker deployment via AD at work. Have googled all over the internet, but the most useful reference seems to be:
Server 2012 R2, fully updated. Test client is Windows 7 Ultimate 64bit, fully updated.
For some reason, it's not working - How can I find out what's wrong? I created a GPO, linked it to an OU, joined the win7 machine onto domain, and moved the win7 machine into the OU. I would expect it (perhaps incorrect?) to simply start encrypting, and save the bitlocker recovery key into AD somewhere (not sure yet where to find that.) But it does nothing.
Checked in BIOS that the TPM is enabled. I tried '''gpupdate /force''' and rebooting the win7 machine ... But still, nothing.
- Computer / Policies / Admin Templates / System / TPM Services
- (Disabled) Turn on TPM backup to AD
- Computer / Policies / Admin Templates / Windows Components / Bitlocker Drive encryption
- (Enabled) Store bitlocker recovery info in AD (Server 2008 and Vista)
- Computer / Policies / Admin Templates / Windows Components / Bitlocker Drive encryption / Operating System Drives
- (Enabled) Enforce drive encryption on operating system drives
The first thing I notice is that it only says "2008 and Vista" ... Are there supposed to be some additional settings somewhere else for Win7 and 8?
Gosh, it would be really nice to find some way of diagnosing why it's not working, rather than guessing blindly... Also, if anyone has done this successfully and documented the process?