Enabling BitLocker Encryption to Remote Windows 10 Devices: Workspace ONE Operational Tutorial

Consumer Simple Encryption

When it comes to BitLocker encryption for Windows 10 devices, the security by design approach provides the best user experience. Security by design implements device encryption in a way that feels like a non-disruptive, natural part of the device experience.

Enterprise Secure Devices

Create a BitLocker encryption profile to keep Windows 10 device data enterprise secure. After the profile is configured, Workspace ONE Intelligent Hub automatically enforces encryption settings as part of the device’s general security posture. Use the Workspace ONE UEM compliance engine to ensure devices remain compliant.

For more information, see Microsoft Docs: BitLocker Overview.

Two security principles that are top of mind when dealing with device encryption are least privilege and separation of duties.

Workspace ONE UEM leverages role-based access controls (RBAC) for admins, allowing you to grant access to view recovery keys only to the admins who require access. 

In addition to RBAC, Workspace ONE UEM logs each action of viewing a recovery key by each admin to the console event logs, which can also be sent to your preferred Syslog provider. This allows for InfoSec to audit admin access to recovery keys to prevent rogue admins from capturing all recovery keys, for example.

Workspace ONE UEM BitLocker encryption also helps in the following ways:

Ensure that you have the following Workspace ONE components installed and configured:

• A Workspace ONE UEM tenant with admin access to:
  • Enroll a Windows 10 device into the Workspace ONE UEM environment.
  • Configure and deploy a BitLocker policy.
  • Workspace ONE self-service portal URL for retrieval of the recovery keys.
• Workspace ONE Intelligence with admin access to:
  • Configure reports, dashboards, and automations.  

For more details about BitLocker profiles, see VMware Docs: Windows Desktop Encryption Profile.

On the Windows 10 device, check that you have the following components installed and configured:

• Windows Pro, Enterprise, or Education device - enrolled in Workspace ONE UEM. 
  • For more information, compare Windows 10 editions, or contact a Microsoft representative.
• Disk with Two partition minimum.
• 350 MB boot partition with the appropriate format:
  • NTFS Mode — Use if booting in legacy BIOS mode.
  • FAT32 Mode — Use if booting in UEFI mode.
• TPM version 1.2 or later.
  • Workspace ONE can provide encryption for devices without TPM. The best practice is to use devices with TPM.
• Meet Windows system requirements for BitLocker.

1. In the Workspace ONE UEM console, select Add.
2. Select Profile.

1. Select the Windows platform.
2. For the Device Type, select Windows Desktop.
3. Select the Context of the profile to Device.

1. Select General if it is not already selected.
2. Enter a profile name in the Name text box, for example, BitLocker Encryption.
3. Click in the Assigned Groups text box.
   • This will pop up the list of created Assignment Groups. Select the Assignment Group you want to deploy the profile to.
4. Select the Encryption payload and click Configure.

1. Select OS Drive and All Fixed Hard Drives from the Encrypted Volume drop-down menu.
   • Choosing this option encrypts the entire hard disk on the device, including the System Partition where the OS is installed and any additional drives.
2. Leave Encryption Method set to System Default.
   • When you select another encryption method such as XTS AES 128 bit from the Encryption Method drop-down menu, another option will appear.
   • Use the option Default to the System Encryption Method as a fail-safe for devices that do not support the selected encryption method.
   • For example, selecting this setting ensures that Windows 10 1507 and below devices—which do not support XTS encryption—will still get encrypted.
3. Enable Only Encrypt Used Space During Initial Encryption to reduce the time required for encryption.
   
   Important: The drive’s unused space remains unencrypted, potentially placing confidential data at risk.
   
   
4. Enter the Self-Service Portal URL, https://[Your Device Services Host Name]/MyDevicein the Custom URL for the Recovery text box.
   • This URL displays on the lock screen and directs end users to their recovery key.
     
     Tip: URL shorteners and URL redirections can be used to help users to remember the URL.
     For example https://staff.comany.com/mydevice (redirecting to the Workspace ONE UEM Self-Service Portal URL).

1. Using the scroll bar on the right, scroll down to the BitLocker Authentication Settings section.
2. Select TPM as the Authentication Mode to use the device’s Trusted Platform Module to authenticate.
3. Select Require PIN at startup. 
   • This option locks out the OS start up and auto-resume from suspend or hibernate until the user enters the correct PIN.
4. Specify the Pin Length to match organizational complexity requirements. For example, enter 4.
5. Select Use Password if TPM Not Present to use a password as a fallback if TPM is unavailable.
   • If deselected, devices that do not have TPM do not encrypt.
6. Configure Minimum Password Length to match organizational complexity requirements.
   • For example, enter 8. Settings apply to the Password Authentication Mode, and the setting Use Password if TPM Not Available.

1. Using the scroll bar on the right, scroll down to the BitLocker Static Recovery Key Settings section.
2. Select Create Static BitLocker Recovery Key to create a shared key for a group of devices. This simplifies key recovery for IT personnel who use the shared key to unlock devices.
3. Click the arrow icon to generate a static recovery key.
4. Enter 28 or any value greater than 0 into the Rotation Period text box to create a rotation schedule. Enter 0 to opt out of the rotation schedule.
5. Enter 7 into the Grace Period text box to specify the number of days after rotation that the previous recovery key still works.

1. Using the scroll bar on the right, scroll down to the BitLocker Suspend section.
2. Select Enable BitLocker Suspend.
   • This suspends BitLocker encryption during maintenance periods and allows devices to reboot without end-user interaction.
   • This setting is particularly important for kiosk or shared devices or updating device drivers or some windows updates.
3. Select Schedule from the Suspend BitLocker Type drop-down menu. This suspends BitLocker during a specific time period that repeats daily or weekly.
4. Enter the suspend start and end time.
   • BitLocker Suspend Start Time — Set to 11:00 PM
   • BitLocker Suspend End Time — Set to 6:00 AM
5. Select Daily from the Scheduled Repeat Type drop-down menu.
6. Click Save & Publish, review the devices assigned, and select Publish.

1. In the Workspace ONE UEM Console, navigate to Resources then Profiles and Baselines, then Profiles.
2. Search for the BitLocker Encryption Profile. The BitLocker Encryption Profile now appears in the Device Profiles list view.

There are a few different locations in the Workspace ONE UEM console where you can view the device's encryption details. Let's explore these.

Encryption can also be confirmed on the device itself. The following steps detail how to confirm BitLocker encryption on the device.

1. In the Windows Search bar, enter Command Prompt.
2. Select Run As Administrator.

1. For a more detailed view, launch an elevated command prompt and enter manage-bde -status.
2. Review the Encryption details of each hard drive.
3. Review the properties of each status. For example Encryption Method and Percentage Encrypted.

1. Review the BitLocker policy and ensure the Encrypted Volume is set to OS Drive and All Fixed Hard drives.

1. Navigate to the Security tab, you might need to select it from the drop-down list.
2. Review BitLocker Encryption details and statuses for all hard drives.

1. Toggle between the drive letters to see the Recovery keys. In this example, we have two additional fixed drives.
2. Review the Personal Recovery Key and the Static Recovery Key.

BitLocker recovery is the process by which you can restore access to a BitLocker-protected drive in the event that you cannot unlock the drive normally. 

Workspace ONE UEM leverages role-based access controls (RBAC) for admins, allowing you to grant access to view recovery keys only to the admins who require access.  

End-Users can log into Self-Service Portal for BitLocker Recovery Key Retrieval. Roles Based Access Controls (RBAC) are available for the Self Service Portal controls to turn this feature off.

There are many different scenarios where a machine may prompt a user for the Recovery Key on reboot. These are well documented in the Microsoft Docs: BitLocker recovery guide.

1. Toggle between the drive letters to see the Recovery keys. In this example, we have additional fixed drives.
2. Review the Personal Recovery Key and the Static Recovery Key.

1. Navigate to the Self-Service Portal URL and log in.
   • For example, your Self Service URL will be  https://[Your Device Services Host Name]/MyDevice
2. Click Go To Details.

1. Expand the More tab.
2. Select Security.

1. Navigate to Encryption to find the recovery key.

1. Enter the BitLocker Recovery key.
2. In the policy, we set up a self-service URL; the Self Service URL appears here.

For testing purposes, to force a drive into recovery, open Windows PowerShell as an administrator and enter  the following command:

Replace "C:" with the drive letter.

For more information, see Microsoft Docs: BitLocker ManageBDE ForceRecovery.

1. In the Workspace ONE UEM console, select Add.
2. Select Compliance Policy.

1. Select the Windows platform.
2. For the Device Type, select Windows Desktop.

1. Select the Rules tab.
2. Select Encryption as the compliance flag.
3. Change the Rule to Is.
4. Select compliance value.
   • Drop-down values include Not Applied to System Drive, Not Applied to Some Drives or Suspended.
5. For BitLocker Status of Not Applied to Some Drives or Suspended, the Workspace ONE Intelligent Hub 2101 or later is required.

Define the consequences of noncompliance within your policy by completing the Actions tab.

1. Select the Actions tab.
2. Select Command as an Action.
3. Select Request Device Check In as the Command.
   • This ensures that the device has checked into the Workspace ONE UEM console with the latest information. You can re-evaluate the compliance Rule in the Compliance tab of the device details.
4. Select Notify as an Action.
5. Select Send Email to User.
   • This sends a compliance email to the end user with remediation actions they can take.
   • You can select the default template, or customize the compliance templates based on the compliance rule.
6. Select Profile as an Action.
7. Select from
   • Install Compliance Profile - Install a compliance profile.
   • Block Remove Profile - Block or remove a specific profile - For example, Certificates.
   • Block Remove ALL Profiles - Remove all Profiles from the device until the device is compliant.
8. At any escalation step, you can mark the device as non-compliant. This will trigger any conditional access policies you may have set within Workspace ONE Access.
9. Click Next.

1. Ensure that you are on the Assignment tab.
2. Select a Smart Group to apply the device compliance policy to.
3. Click View Device Assignment to see the devices.

1. Selecting View Device Assignment allows you to review the devices assigned to the compliance policy.

1. Ensure that you are on the Summary tab.
2. Enter a Name for the Compliance Policy.
   • For example, Encryption.
3. Enter a description for the Compliance Policy.
   • For example, Encryption. You might also want to specify in the description how a similar Encryption Compliance Policy will differ.
4. Review the Device Summary.
   • This displays how many devices in total have been assigned the Compliance Policy. This also displays how many devices are currently Compliant and how many are Non-Compliant.
   • Use this information before you activate compliance policies. If your remediation action might cause calls to the help desk, you can apply the compliance policy in stages - or maybe extend the Escalated Actions to 7 days instead of 1 day, for example.
5. Click Finish and Activate.
   • This activates the policy and compliance actions are sent to the devices.

Navigate to Devices > Compliance Policies > List View.

1. Ensure that the Encryption policy is active and review the Compliant status.

Navigate to the Workspace ONE Intelligence console.

1. Select the Reports tab.
2. Click Add.

1. Select Custom Report and click Start.

1. Under Category, select Workspace ONE UEM, then select Devices.

1. Enter a report name.
   • In this example, the report is called Windows Desktop Encryption Status.
2. In the filters, select the following:
   • Enrollment Status - Equals - Enrolled.
   • This ensures that we are pulling in a report on currently enrolled devices.
3. Click the plus icon + to add the following filters:
   • Platform - Includes - Windows Desktop
4. Click Refresh Preview to see the latest data.
5. Next, we will edit the fields displayed. Select the edit columns option.

1. Use the Search function to search for columns to add to the report.
2. Expand the column categories to see all available columns.
3. Select the column that you want to add.
4. Click Add to add the column. This will appear on the right.
5. Use the Remove buttons to remove columns from the report.
6. Use the up and down arrows to change the column order.
7. When you are satisfied with the arrangement of your report data, click Save.

1. Click Refresh Preview to see the preview of the current data.
2. Review the report data and make any adjustments as necessary and ensure that you select Save.

You have now configured a report with data displaying Windows 10 Device Encryption details.

1. Select Edit to make any changes.
2. Click Run to run the report.
3. Select View to view report downloads.
4. Select Add Schedule to automate data collection and collaboration.

To check health of TPM on a system, you can launch the TPM snap-in; tpm.msc.

Alternatively, run this PowerShell command:
Get-wmiobject -Namespace ROOT\CIMV2\Security\MicrosoftTpm -Class Win32_Tpm or
get-tpm