There are a couple of challenges when using BitLocker in ConfigMgr 2012. Using Pre-Provisioning and locking a 2nd HDD in REFRESH Scenarios is one such challenge.
Here is how i handle it.
Scenario 1: NEW – Single Disk
Background and overview: New PC or Laptop, single hard drive.
1. Create a PreInstall partition on the disk if there is no available partitions
2. Configure BIOS and TPM (see previous post)
3. Format and Partition Disk0 for use with BitLocker. Create a BDE partition with fixed size 500Mb, NTFS and store the drive letter as a variable BOOTPART. Create a System partition of 100% remaining space, NTFS, store drive letter as OSPART.
4. Pre-Provision BitLocker to “Logical drive letter stored in a a variable” – OSPART
5. At the end of the Task Sequence Enable BitLocker on “Current operating system drive”. Choose to wait for BitLocker to complete before continuing.
Scenario 2: REFRESH – Single Disk
Background and overview: Refresh PC or Laptop, single hard drive.
1. When started from Software Center, disable BitLocker on current operating system drive and reboot to WinPE.
2. If started from USB or PXE, use a script to unlock the operating system drive.
3. continue from step 2, Scenario 1.
Scenario 3: NEW – Additional Disk
Background and overview: New PC or Laptop, multiple hard drives.
1. Out of the box means started from USB or PXE, use a script to unlock OS and data drives.
2. continue from step 2, Scenario 1.
3. When finalizing BitLocker on the OS disk choose to continue on error. This because the attributes will be inconsistent after C, D and E drive letters are reassigned but the BitLocker process will finalize ok.
4. Enable BitLocker on the additional drive, choose either to wait for BitLocker to finish or continue and allow the drive to encrypt in the background. The machine will be usable but the 2nd disk will have limited availability until the process is finished which could be 20 – 50 minutes.
Scenario 4: REFRESH – Additional Disk
Background and overview: Refresh PC or Laptop, multiple hard drives.
1. When started from Software Center, disable BitLocker on current operating system drive and data drives and reboot to WinPE.
2. If started from USB or PXE, use a script to unlock the operating system drive and data drives.
3. continue from step 2, Scenario 1.
3. continue from step 2, Scenario 3.
Here are some screenshots of the TS:
Life In The Cloud 