In part 5 ,we have downloaded the MDOP 2015 templates ,extracted,copied MBAM 2. In this Part 6 of MBAM 2. However, you can extract the MSI from the executable file. If you look into the MBAM installer file in MDOP 2015, you will find only 2. The command line to extract. Edit the deployment type to change the name of the DT like MBAM Client 2. Login to test PC windows 8. TPM chipset is hardware based sits on motherboard and does specific functions. So in lab,we will try to do bitlocker using manual method instead of doing it via MBAM agent and rest will be managed by MBAM only. I will update this post ,when I find solution. So in lab,instead of encrypting the the drive using MBAM agent,we use manual method from control panel. This is only step we are by-passing and rest of process is managed by MBAM. If you are trying this on physical machine that ,it should work good for you without any issues atleast you will not see above error. Login to Windows 8. How do we check if the GPO settings applied correctly or not? Open the registry key on windows 8. We can also check if the Client is able to download the MBAM policies from MBAM server or not using event viewer. With this setting,user cannot close this action and must do encryption But in production this setting may vary. Enter the password between 8-255 character and click Create Password. Here is my next screen for bitlocker status: For some reason,it failed encrypting the disk. Go to Event Viewer — Applications and Services Logs — Microsoft — Windows — MBAM Admin and Operational Check for operational if Client is able to download the policies correctly or not. From above screen,client is able to pull the download the policies ,next look at Admin section. So as I discussed earlier in Note,lets do the bitlocker manually. Accept the default option and click Continue Restart now After you restart,it ask for password to continue. After you login to the PC,a small window appear on the taskbar with encryption is in progress. After a while,encryption gets complete and you must see the bitlocker information about this client from your MBAM Server reports. With this,we have completed the bitlocker encryption on client side using manual method instead of doing it via MBAM Agent. How to use MBAM 2. Next ,we will look at MBAM compliance reports using SCCM and also try to recover the bitlocker recovery key incase user forget the password to unlock the computer during the boot process. Restart the Client PC 8. Press ESC ,it takes you to below screen to enter the recovery Key for this drive. Note: This recovery key keeps changing every times you press ESC. When you press ESC ,a new recoverykey will be created in the MBAM Recovery and Hardware database. To retrieve the Bitlocker Recovery Key ,we need to have the first 8 digit of Recovery Key ID 364ACBC6 shown in the below screen and retrieve the recovery Key using self service portal as discussed in. So launch the selfservice portal on any computer who has enough security permissions to run the selfservice portal and run the URL: As shown below ,enter the first 8 digit recovery Key ID and select the reason what you are interested in all these requests will be stored in database for auditing purpose incase you want to check how many times performed like this. Every time when you request for recovery key,it creates new one. You can also perform the SQL query to get the recovery key instead of going via portal. This recovery key information stored in database MBAM Recovery and Hardware table RecoveryAndHardwareCore. Enter the recovery Key which we obtained from above and press Enter it should allow you to login. With this ,we have completed the demo on ,how to get Bitlocker recovery key using self service portal. Next ,we will see the compliance results using SCCM configmgr reports. Before that ,you must confirm if the hardware and Configuration. From the log,we mainly interested in changes i. Run the Configuration manager reports URL my SCCM report server CM01. I am interested to to know the Bitlocker Enterprise Compliance summary report. By default,the report select MBAM supported computers but you can select the collection from drop down list. We have got 1 computer with 100% complaint but this report is missing linked report to know what computer is that. With this,we have completed how to extract MBAM 2. In the next ,we will see the new features added to support windows 10 like Customize pre-boot recovery message and URL.
