Create and Configure BitLocker Management in Configuration Manager

This is my first blog, and sorry if it's not fancy, but I want to share what one of my clients asked me to implement for them. They were managing BitLocker via AD.  


As many of you are aware, Microsoft stopped developing MBAM. Many companies started managing their BitLocker via SCCM or Intune.


Today in this short post I will discuss how to Setup, Configure, Deploy, and Test BitLocker in SCCM, hopefully this will help.  I will do the Intune later.


  •      You will need to create 3 different Security Groups in AD and then add users and admins to each one. The group's name depends on each company and how they like it to be.

 


  •         In the SQL server you have to Create, Backup, Restore, and Verify the BitLocker management encryption certificate. Make sure you have a "sysadmin" role in the SQL server to do that.


  •  Create Both Admin and User Portals by running the script "MBAMWebSiteInstaller.ps1" with this cab file "MBAMWebSite.cab" the script can be found in SMSSETUP\BIN\X64 in the site server. Make sure to replace anything in the command line to match your environment:-    .\MBAMWebSiteInstaller.ps1 -SqlServerName <ServerName> -SqlInstanceName -SqlDatabaseName <DatabaseName> -ReportWebServiceUrl <ReportWebServiceUrl> -HelpdeskUsersGroupName <DomainUserGroup> -HelpdeskAdminsGroupName <DomainUserGroup> -MbamReportUsersGroupName <DomainUserGroup> -SiteInstall Both

  •      You can check if both portals are created by checking IIS.



  •      Now both are installed you can navigate to the URL of each portal, the self-service portal looks like this below:-


  • The Admin portal is like this below:-


Many thanks to Johan Arwidmark and Niall Brady for their blogs. 

Resources:
  • https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/bitlocker/setup-websites
  • https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/bitlocker/encrypt-recovery-data
  • https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/bitlocker/setup-websites
  • https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/bitlocker/helpdesk-portal





Location: United States

Comments

Post a Comment

Popular posts from this blog

Mastering Configuration Manager Patch Compliance Reporting

Image
In the last couple of weeks, I saw a post from Microsoft regarding a post has been published 2 years ago but got updated last Oct 2022. Microsoft's post was amazing about the new Configuration Manager report which can provide you with various of details about many Applications, Updates, etc.  So I decided to install it on my Report Server and test and it was amazing, so I want to share this with you. Before we start to configure the report, this will use data from WMI class Win32_QuickFixEngineering, so please make sure to enable that from Client Settings > Hardware inventory > Set Classes   Download Updatereporting script from GitHub  , after extracting it you will have (Import-SSRSReports.ps1). before you run the script, grab some info required for the script to run,  1 . ReportServerURI reportServer (you can get it from Configuration Manager Console > Monitoring > Reporting.    2 . TargetFolderPath   (I recommend opening Report from SCCM Console > Reporting then
Read more

Remote Help & Microsoft Intune Suite

Image
 Since last year and I have been testing "Remote Help" and trying to see how Microsoft is going to make it more affordable to all companies. When Ignite came last year and announced about Intune package, I was waiting for it, till this week when I saw Microsoft released Intune Suite and the prices. Let us talk about creating Remote Help App for Intune and how to Install it first, then talk about assigning the license. Create the App:- 1.        First let us download the app from Microsoft from this Download Remote Help . 2.        This app needs to be deployed via Intune, in this case, we have to create Win32App using Microsoft Script available on GitHub . 3.        Convert the (.exe) format to Intunewin format.  4.         Let’s go to Microsoft Intune Admin Center and create a security group to deploy the app to it later, or create the App first, I will do the group. 5.        Then build the app, two ways to build it, manually or by using 3rd party. 5.1    Manua
Read more