From 2588d19d9a2f9eed04f496854dee8cd8f2faf0c7 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 28 May 2019 15:50:14 -0700 Subject: [PATCH 001/231] Added dev comments --- windows/client-management/mdm/bitlocker-csp.md | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 917fb0bafa..bfb6938f87 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -110,7 +110,21 @@ The following diagram shows the BitLocker configuration service provider in tree -

Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.

+

Data type is integer. Sample value for this node to enable this policy: 1.

+

Supported operations are Add, Get, Replace, and Delete.

+

RequireDeviceEncryption must be set to 1 to check the device's enforcement status. If the value is not set or is set to 0, the device's enforcement status will not be checked.

+ +

An OS volume's protection status is checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value EncryptionMethodByDriveType policy is set to. However, if the OS drive is a self-encrypting drive, this policy setting will be ignored.

+ +

Encryptable fixed data volumes are treated similarly to OS volumes. However, fixed data volumes must meet additional criteria to be considered encryptable:

+ +* The fixed data volume must have supported firmware (BIOS or UEFI). +* It must not be a dynamic volume. +* It must not be a recovery partition. +* It must not be a hidden volume. +* It must not be a system partition. +* It must not be backed by virtual storage. +* It must not have a reference in the BCD store.

If you want to disable this policy use the following SyncML:

@@ -133,8 +147,6 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

Data type is integer. Supported operations are Add, Get, Replace, and Delete.

- **EncryptionMethodByDriveType**

Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".

From ca108dfa6c134b595b382b0c656f6a218c171205 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 29 May 2019 09:57:59 -0700 Subject: [PATCH 002/231] minor update --- windows/client-management/mdm/bitlocker-csp.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index bfb6938f87..18406fe831 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -112,7 +112,6 @@ The following diagram shows the BitLocker configuration service provider in tree

Data type is integer. Sample value for this node to enable this policy: 1.

Supported operations are Add, Get, Replace, and Delete.

-

RequireDeviceEncryption must be set to 1 to check the device's enforcement status. If the value is not set or is set to 0, the device's enforcement status will not be checked.

An OS volume's protection status is checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value EncryptionMethodByDriveType policy is set to. However, if the OS drive is a self-encrypting drive, this policy setting will be ignored.

@@ -126,6 +125,11 @@ The following diagram shows the BitLocker configuration service provider in tree * It must not be backed by virtual storage. * It must not have a reference in the BCD store. +

The following list shows the supported values:

+ +- 0 – Disable. If the policy setting is not set or is set to 0, the device's enforcement status will not be checked, but the device encryption will still be on. +- 1 (default) – Enable. The device's enforcement status will be checked. +

If you want to disable this policy use the following SyncML:

``` syntax From f6c4d1db54f2a407b3647276640910d0ba6fbe65 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 14 Jun 2019 13:21:47 -0700 Subject: [PATCH 003/231] Added dev comments --- .../client-management/mdm/bitlocker-csp.md | 221 +++++++++--------- 1 file changed, 111 insertions(+), 110 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 12c1053dcf..2dd4667545 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -31,10 +31,10 @@ The following diagram shows the BitLocker configuration service provider in tree ![bitlocker csp](images/provisioning-csp-bitlocker.png) **./Device/Vendor/MSFT/BitLocker** -

Defines the root node for the BitLocker configuration service provider.

+Defines the root node for the BitLocker configuration service provider. **RequireStorageCardEncryption** -

Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU.

+Allows the administrator to require storage card encryption on the device. This policy is valid only for a mobile SKU.
@@ -57,14 +57,14 @@ The following diagram shows the BitLocker configuration service provider in tree
-

Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on.

+Data type is integer. Sample value for this node to enable this policy: 1. Disabling this policy will not turn off the encryption on the storage card, but the user will no longer be prompted to turn it on. - 0 (default) – Storage cards do not need to be encrypted. - 1 – Require Storage cards to be encrypted. -

Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on.

+Disabling this policy will not turn off the encryption on the system card, but the user will no longer be prompted to turn it on. -

If you want to disable this policy use the following SyncML:

+If you want to disable this policy use the following SyncML: ``` syntax @@ -85,11 +85,11 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -

Data type is integer. Supported operations are Add, Get, Replace, and Delete.

+Data type is integer. Supported operations are Add, Get, Replace, and Delete. **RequireDeviceEncryption** -

Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption.

+Allows the administrator to require encryption to be turned on by using BitLocker\Device Encryption. @@ -112,12 +112,12 @@ The following diagram shows the BitLocker configuration service provider in tree
-

Data type is integer. Sample value for this node to enable this policy: 1.

-

Supported operations are Add, Get, Replace, and Delete.

+Data type is integer. Sample value for this node to enable this policy: 1. +Supported operations are Add, Get, Replace, and Delete. -

An OS volume's protection status is checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value EncryptionMethodByDriveType policy is set to. However, if the OS drive is a self-encrypting drive, this policy setting will be ignored.

+Status of OS volumes and encryptable fixed data volumes are checked with a Get operation. Typically, BitLocker/Device Encryption will follow whichever value [EncryptionMethodByDriveType](#encryptionmethodbydrivetype) policy is set to. However, this policy setting will be ignored for self-encrypting fixed drives and self-encrypting OS drives. -

Encryptable fixed data volumes are treated similarly to OS volumes. However, fixed data volumes must meet additional criteria to be considered encryptable:

+Encryptable fixed data volumes are treated similarly to OS volumes. However, fixed data volumes must meet additional criteria to be considered encryptable: * The fixed data volume must have supported firmware (BIOS or UEFI). * It must not be a dynamic volume. @@ -127,12 +127,12 @@ The following diagram shows the BitLocker configuration service provider in tree * It must not be backed by virtual storage. * It must not have a reference in the BCD store. -

The following list shows the supported values:

+The following list shows the supported values: - 0 – Disable. If the policy setting is not set or is set to 0, the device's enforcement status will not be checked, but the device encryption will still be on. -- 1 (default) – Enable. The device's enforcement status will be checked. +- 1 (default) – Enable. The device's enforcement status will be checked. Setting this policy to 1 will trigger encryption of all drives (silently or non-silently based on [AllowWarningForOtherDiskEncryption](#allowwarningforotherdiskencryption) policy). -

If you want to disable this policy use the following SyncML:

+If you want to disable this policy use the following SyncML: ``` syntax @@ -153,8 +153,9 @@ The following diagram shows the BitLocker configuration service provider in tree ``` -**EncryptionMethodByDriveType** -

Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)".

+**EncryptionMethodByDriveType** + +Allows you to set the default encrytion method for each of the different drive types: operating system drives, fixed data drives, and removable data drives. Hidden, system and recovery partitions are skipped from encryption. This setting is a direct mapping to the Bitlocker Group Policy "Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)". @@ -175,7 +176,7 @@ The following diagram shows the BitLocker configuration service provider in tree
Homecross mark
-

ADMX Info:

+ADMX Info: