Issue here: we have French computer W10 Pro it's not working in french ... in English all good can you provide more infos ?
@christopherrich6190
Ай бұрын
My issue is that the GP is getting pushed out but the Scheduled task isn't. Not sure why but I thought about pushing the script out one time to the PC's since it only has to be run once. Would that that?
@seanjr4387
27 күн бұрын
You can run the script directly. The Task Scheduler will not show unless you're an Administrator. If it's still not there after opening Task Scheduler as an Administrator, rewatch the video to see if you overlooked something in the video.
@fabriciomattos16
Ай бұрын
Even though the GPO is confugured, do I need to enable BitLocker manually?
@jamesjames601
Ай бұрын
It works without running the batch file
@seanjr4387
27 күн бұрын
The GPO is telling the computer what to do if bitlocker is enabled, while in the same GPO a script is set to automatically start the Bitlocker. Remember, the reason for the video is so you don't have to do it manually.
@fabriciomattos16
27 күн бұрын
@@seanjr4387 Perfect!!! Really appreciate!
@mammamia-qx5pz
2 ай бұрын
The "Store bitlocker recovery information in active directory domain services" gpo is only applicable for windows server 2008 and vista, try reading the shit you're doing before making a video guide on it and misinforming everyone
@seanjr4387
27 күн бұрын
If I did a video showing exactly how I did it while using Windows Server 2019!!!!, how did you then draw the conclusion that the bitlocker feature is only available in Windows Server 2008? Just think about it for a second. I did a video and successfully completed this. Here's another clue: If you like, read the other comments and you'll see that others have done it.
@christopherdesouza8334
3 ай бұрын
Not bad. To avoid multiple keys change the scheduled task. Go to common tab and check the apply once and do not reapply checkbox. Otherwise everytime device is idle or login occurs it will record a new key and eventually have tons in active directory. Also would have the group policy create scheduled task not update as it will reset task like it has not been run and cause same multi key entries. Plus there is a bug where it will mismatch and possible that no key works. Resetting a device later and needing that key will be a real problem. The way we do this is actually to create a registry key via group policy the applies script to runonce for same purpose but find it is much more consistent.
@ricorodrigo523
5 күн бұрын
Hi @christopherdesouza8334 any tutorial or video for this !! really intersting remark, PLesae share more
@FranklinChekani
3 ай бұрын
script worked flawlessly. Just curious, where does the script store recovery key? assuming did not say to save in ADDS
@nevillbowyer4175
3 ай бұрын
It's saved in ADDS. Go to the Properties of the Computer Object and you'll see a BitLocker Tab. 12:03 If you're not seeing the tab, you might have to rewatch the video where I install the BitLocker role. I hope this helps.
@matthewsharrer2203
4 ай бұрын
I noticed that the batch file is missing a couple of GOTOs/batch labels: :VerifyBitLocker for /F "tokens=3 delims= " %%A in ('manage-bde -status %systemdrive% ^| findstr " Encryption Method:"') do ( if "%%A"=="AES" goto Inprogress ) for /F "tokens=3 delims= " %%A in ('manage-bde -status %systemdrive% ^| findstr " Encryption Method:"') do ( if "%%A"=="XTS-AES" goto Inprogress ) for /F "tokens=3 delims= " %%A in ('manage-bde -status %systemdrive% ^| findstr " Encryption Method:"') do ( if "%%A"=="None" goto EncryptionFailed ) Inprogress and EncryptionFailed do not exist. This will result in either, "The system cannot find the batch label specified - Inprogress", or "The system cannot find the batch label specified - EncryptionFailed".
@matthewsharrer2203
4 ай бұрын
Unless the intention was to monitor the progress (which I doubt given the text in the EncryptionCompleted block), I would recommend to replace Inprogress with EncryptionCompleted. One can also create the block for EncryptionFailed: :EncryptionFailed echo. echo ============================================================= echo = System Volume Encryption on drive (%systemdrive%\) failed. = echo = The script was able to make it past the TPM steps. = echo = Encryption was not turned on. = echo ============================================================= echo Closing session in 30 seconds... TIMEOUT /T 30 /NOBREAK Exit What would be helpful is to get output that explains why the encryption failed, but at least this doesn't result in any errors, and explains that at least the TPM part was passed.
@keithambio2502
4 ай бұрын
I'd love your fully edited file... I'm script/programming deficient
@steffan23
4 ай бұрын
i'm seeing multiple entries of keys stored on a computer's AD object. is this a result of the idle time?
@galaxyguy9873
4 ай бұрын
hold up. why would you have to add roles and features when it definitely already there by default on every single windows 11 machine???????
@nevillbowyer4175
3 ай бұрын
The role is so you can create a BitLocker policy. For example, you need a policy telling the script or a user who manually tries to BitLocker their computer to not BitLocker the computer unless the key is stored in ADDS. Plus you'll need the role so you can see the recovery key. I hope this helps.
@rickglorie
Ай бұрын
And this is for your domain controller(s), not on the clients.
@seanjr4387
27 күн бұрын
That's correct.
@LiamGaffey-pi9en
5 ай бұрын
ive managed to get it to pushout with all these settings but the Task Schedular doesnt seem to run correctly. showing it has ran but not starting the Encryption, but when you force the task to run manually it works -_- any ideas?
@nevillbowyer4175
3 ай бұрын
It might be the user that the task is running as. Or it could be a conflicting policy in your environment.
@user-yu2dp9cf2v
5 ай бұрын
Something weird happened to me, this procedure worked for me pretty well a couple of months ago, but I try to run it again and it doesn't work, it creates the Schedulled Task but it runs with operative code 2. Any idea?
@davebyers9567
6 ай бұрын
What are you using to display the system information on your desktop?
@seanjr4387
27 күн бұрын
BGinfo
@jrelvio
7 ай бұрын
Excellent. And for computers that do not have a TPM chip. Does it work?
@nevillbowyer4175
3 ай бұрын
Usually you can define the requirements in the BitLocker GPO. But I believe my script is looking for a TPM chip.
@purepure8950
8 ай бұрын
Where did he get the script???
@user-sz1fe7er5e
8 ай бұрын
Hi, is it possible to enter n GPO that at the time that disk is starting to encrypt that user would be prompted to enter PIN as additional layer of security? mostly for laptops that can be stolen
@nevillbowyer4175
3 ай бұрын
You should be able to do this by updating the GPO to require PIN.
@kyleelam4337
8 ай бұрын
You sir are an absolute legend.
@vishaljagtap2881
8 ай бұрын
please send me enablingbitlocker.bat file
@MattEOKC
9 ай бұрын
This worked like a charm! Thanks for the video! One thing I learned was that if a PC has BitLocker On already, you will have to disable it and then reboot and let the policy turn it on in order for AD to pickup the key. AD will not pick up the key except during generation.
@osamaelnabawy462
7 ай бұрын
can i disable it for all devices by GPO or manually?
@MrMilesThompson
10 ай бұрын
Thanks! worked like a charm
@roti_pani
10 ай бұрын
Is it compulsory to have TPM in users computer for this to run ? What if we are using VM ?
@shevonnedixon583
11 ай бұрын
how do i prompt the user to enter a password
@seanjr4387
10 ай бұрын
You can control this part from the GPO. Explore Group Policy options for Bitlocker.
@bsoliman5737
11 ай бұрын
Just tried this...worked perfectly! Thanks!
@Hodenkat
Жыл бұрын
What is the batch file?
@seanjr4387
Жыл бұрын
You can find the batch file via the link in the description.
@Hodenkat
Жыл бұрын
@@seanjr4387 Thank you. This entire process did not work. I followed the steps carefully twice on two virtual machines and nothing happens. The task shows in Task Sceduler, and the GPO shows when I do a gpresult /r but nothing happens. I have made sure the policy is enforced and all settings are correct. Running the script (EnablingBitLocker.bat) in Powershell ISE shows many errors. I will try it a 5th time along with this video and hopefully I will figure out what I'm doing wrong.
@MikesGarageWorks
Жыл бұрын
This only works with a batch file. How do I get a PowerShell script to run instead of a batch file? the script works perfectly when ran manually, however closes immediately and doesn't even start the transcript when executing as system at user login.
@seanjr4387
Жыл бұрын
What made you configure it to run at User Login and not via Task Scheduler at system startup?
@MikesGarageWorks
Жыл бұрын
@@seanjr4387 my script is enabling bitlocker and initializing tpm. File hosted on dc, network not available at startup for laptops.
@MikesGarageWorks
Жыл бұрын
@@seanjr4387 actually, startup script works fine now. So nevermind, however would still be nice to know the solution. I could see maybe needing to schedule a task as system to run a power shell script from a network drive. Absolutely nothing I have tried will allow the system account to get past execution policy restrictions.
@SinodosAmaha
Жыл бұрын
@@MikesGarageWorks i used bat file too cuz the script didnt work for me , how did it work for you ?
@MikesGarageWorks
Жыл бұрын
@@SinodosAmaha I ended out placing as a startup script in GPO and hosted the script on NETLogon. The script is PowerShell and runs before login.
@pizppizp
Жыл бұрын
hi the task is not running for me any ideas?
@SinodosAmaha
Жыл бұрын
it works start task schduler as admin
@Jackalas974
Жыл бұрын
Hi. Nice tuto but for me : Task Don't show on client. Key does not upload to Active Directory =====SOLVED===== edit : Ok, it was 2 mistakes/error : -1 In french, username is "AUTORITE NT\System" but mapping is not good with this ID, use english ID instead (as you shown) -2 In script "goto ElevateAccess" block the script even if launch in Admin mod. Comment it solved the issue
@252ruud
Жыл бұрын
Thank you!
@stefanogensabella3749
Жыл бұрын
Super useful, thanks
@RayHampton
Жыл бұрын
Excellent walk-through. Thank You!
@fadynagy9183
Жыл бұрын
Hi Sean, first thank you, i have tested on a virtual environment and it is working but is this script woks only for system drives because i have D Drive and it did not enable bitlocker on it ?
@huseman21
Жыл бұрын
But most places users are not administrators.
@Lofote
Жыл бұрын
Thats how it should be.
@mahmoudaljariri9282
8 ай бұрын
That's why he used the system user
@rakshithshaz6221
Жыл бұрын
Hi sean, Could you please help me out with enabling fixed drives automatically. Im a fresher to this field. Please help me out. Im stuck.
@franklinmoreno3805
Жыл бұрын
Hello, I have applied what you indicate in the video, but bitlocker cannot be applied to drive C:, could you help me?
@metalstez88
Жыл бұрын
Hello, i need some help because this doesn't work on some PC, the schedule task is present but encryption won't start and the key is not saved on AD, i have 20 pc failing on this, on others works perfectly, thanks for help, is there any log or something to troubleshoot?
@DusanSRB96
Жыл бұрын
Check all steps in the video again and all devices must have TPM 1.2 or newer so this could work
@jsrizo01
Жыл бұрын
Works like a charm!
@valeriomarino7597
Жыл бұрын
Not Working for me dear..
@kimmag
Жыл бұрын
Was about to do this on 50 computers spread around the country - thank you for a brief explanation, I felt totally overwhelmed by the deployment-script stage. I'm going to do some tests and pray for the TPM-modules being activated! :- )
@keventagolgol8899
Жыл бұрын
I need a copy pf script file
@ranno525
Жыл бұрын
same here
@keventagolgol8899
Жыл бұрын
Share the Bitlocker script
@andrewcarpenterCC
Жыл бұрын
It's linked in the video description
@HardWorkZz
Жыл бұрын
Hi Sean, Thank You So much. Works Perfectly in My Company. 10/10 !!! =) =) =)
@keventagolgol8899
Жыл бұрын
do you have a copy of scripts?
@yip50685545
Жыл бұрын
setup all, but computers doesn't run auto-encryption. Any idea? can access the bat file. manually run bat is fine
@interstellaroverdrive3658
Жыл бұрын
I'm having the same issue.
@userbox0029
2 ай бұрын
I have set to run the script under "System", but the script works when I login under an Administrative account, but it does not work when I login under an account without administrative rights.
@tanjidamunne1567
Жыл бұрын
Can you share the script file, please?
@keventagolgol8899
Жыл бұрын
do you have script?
@yaaj008
Жыл бұрын
Great work Sean Jr. Works perfectly. Really appreciate sharing this video, just a question on enabling it on data disks
@andersonmota4392
Жыл бұрын
Thanks! Working perfectly!
@TheDJZeroX
2 жыл бұрын
Does this script also work on machines with a different language? Since the findstr searches for english words?
@johnhampe4214
2 жыл бұрын
Sean, absolute genius dude! Well done!
@amitals01
2 жыл бұрын
What needs to change in a batch file, if we want to encrypt a data drive like a D drive.
@Siraj_Ather
Жыл бұрын
Did you found the answer im also searching for the same
@troystory7389
Жыл бұрын
@@Siraj_Ather I am also looking to encrypt two disks C: and D: on a workstation
@FaithfulMC
2 жыл бұрын
Thanks, seems to work perfectly
@baboo84
2 жыл бұрын
My problem is the TPM chip isn't even activated in BIOS on many systems. Is there a way to activate the TPM chip in the BIOS from the DOS command line or Powershell?
@rerazol
2 жыл бұрын
Hi Sean, i try to doesn't work, i run the script manually and i get the message "It looks like your system require that you run this program as an Administrator.", what is wrong?
@KarlTheYeetus
2 жыл бұрын
Have you checked the box of run with highest privileges on the task scheduler?
@thomasweingart9005
Жыл бұрын
I have the same problem. I have set the checkmark with "Execute highest priority". What was the solution? Thank you.
@userbox0029
2 ай бұрын
I have set to run the script under "System", but the script works when I login under an Administrative account, but it does not work when I login under an account without administrative rights.
Пікірлер