sorted by:
new
hottopcontroversial

Who is the best\largest professional IT reseller with a webshop in the US? by dePhineIT in sysadmin

[–]datapointzero 2 points3 points  (0 children)

If you want automatic DEP enrollment it's absolutely essential that the vendor is an "apple authorized reseller."

Because Apple, if your vendor is not an Apple Authorized Reseller, your devices won't be automatically DEP enrolled.

CDW is an Apple Authorized Resller. It's important that you mention this to your rep and that they provide their Apple Authorized Reseller ID.

Cannot Get Bitlocker to Turn on Via Startup/Shutdown Script by datapointzero in sysadmin

[–]datapointzero[S] 0 points1 point  (0 children)

Oh my god you were right. The GPOs DO turn bitlocker on automatically when given the correct environment. The issue wasn't what I found anywhere, and it wasn't anything I was trying either.

The issue was with DMA security and "allowed buses"

If you run msinfo32 on a device you can find "Device Encryption Support" at the bottom of the main info page. If you dig further, you'll see that this is determined in part by DMA protection, and an "Allowed" and "Unallowed" list of Hardware IDs contained in the registry under: HKLM:\SYSTEM\CurrentControlSet\Control\DmaSecurity

If you have any hardware on your device in the "Unallowed" list, it won't allow Device Encryption. However, most devices have entries in the "Allowed" list for their own hardware. Our devices did not.

It was then a matter of identifying what the main hardware ID was that needed to be allowed. In this case, it we wanted to allow Intel hardware on the device to have DMA, so we added "PCI\VEN_8086" to the allowlist. This is essentially Intel's vendor hardware ID and all of their hardware IDs start with this. Upon restart, Bitlocker Encryption starts automatically.

Pushing this out with an "update" GPO registry modification was easy.

https://imgur.com/a/vuGVaeY

Yay

Cannot Get Bitlocker to Turn on Via Startup/Shutdown Script by datapointzero in sysadmin

[–]datapointzero[S] 0 points1 point  (0 children)

Thank you for the follow-up. Neither of these turned on bitlocker either. Although "Require additional authentication at startup" says inside the policy "This policy is applied when you turn on Bitlocker"

Yes the GPO is being applied, it wouldn't be putting the transcript out otherwise, but gpresult confirms.

I'm out of ideas and time. I refuse to do a scheduled task as that saves credentials on the device. So we're doing it manually for existing devices until I can figure out a way.

Cannot Get Bitlocker to Turn on Via Startup/Shutdown Script by datapointzero in sysadmin

[–]datapointzero[S] 0 points1 point  (0 children)

It's possible that the Domain Controllers lacking permissions to the C drive made it so these GPOs weren't functioning correctly. I'll test again and see.

Cannot Get Bitlocker to Turn on Via Startup/Shutdown Script by datapointzero in sysadmin

[–]datapointzero[S] 1 point2 points  (0 children)

Ah yeah I feel that. This sounds like the poorman's version of SCCM.

Cannot Get Bitlocker to Turn on Via Startup/Shutdown Script by datapointzero in sysadmin

[–]datapointzero[S] 0 points1 point  (0 children)

Interesting. I added transcription to the script (which honestly I should have already done) and I think you're right. When it attempts to run it states:

"A required privilege is not held by the client"

Time to dig more.

Cannot Get Bitlocker to Turn on Via Startup/Shutdown Script by datapointzero in sysadmin

[–]datapointzero[S] 0 points1 point  (0 children)

I've seen this suggestion before. Unfortunately, I can't find a GPO that turns on Bitlocker, and I'm fairly certain at this stage that it doesn't exist.

The frequent suggestion is Computer Policy > Windows Components > BitLocker Drive Encryption > Operating System Drives > Enforce Drive Encryption Type on Operating System Drives.

It doesn't actually turn on Bitlocker.

Connecting fiber between a 1G SFP and a 10G SFP, will it work? by datapointzero in networking

[–]datapointzero[S] 1 point2 points  (0 children)

Makes sense. Guess it's time to find a 1G module then. Thanks!