Change BitLocker Drive encryption to XTS-AES 256 during OSD with #ConfigMgr

Windows 10 Current Branch (1607 & 1703) is using a default drive encryption of XTS-AES 128 if you encrypt the disk during OSD using ConfigMgr Current Branch.
001

Command above: manage-bde -status

Some customer maybe have the requirement to change the default to a different mode like XTS-AES 256.

This can be changed using a GPO or CIs in ConfigMgr but then you have first to decrypt the disk, assign the new policy and encrypt the disk again. This is annoying and not very user & admin friendly.

Since a while ConfigMgr is using an option called Pre-provision Bitlocker. This step in the TS is encrypting only the currently used diskspace. As it is in WinPE this is a very small part of the disk and also a quick step. But this step is using the command “manage-bde.exe  -on C: -used” and you are not able to change the encryption method.

Solution

To change the method to XTS-AES 256 or a different method, use following registry key just before the Pre-provision BitLocker step:

cmd /c reg.exe add HKLM\SOFTWARE\Policies\Microsoft\FVE /v EncryptionMethod /t REG_DWORD /d 7 /f

The DWORD value 7 ist setting the method to XTS-AES 256. Use the list bellow to assign a different method:

Value 3, AES_128:
The volume has been fully or partially encrypted with the Advanced Encryption Standard (AES) algorithm, using an AES key size of 128 bits.

Value 4, AES_256
The volume has been fully or partially encrypted with the Advanced Encryption Standard (AES) algorithm, using an AES key size of 256 bits.

Value 6, XTS_AES128 *
The volume has been fully or partially encrypted with the Advanced Encryption Standard (AES) algorithm, using an XTS-AES key size of 128 bits. – This is the default of Windows PE 10.0.586.0 (1511 Release)

Value 7, XTS_AES256 *
The volume has been fully or partially encrypted with the Advanced Encryption Standard (AES) algorithm, using an XTS-AES key size of 256 bits.

* Only supported for deployments of Windows 10 images build version 1511 or higher

The Task Sequence step I used is a command line and is configured to run just before “Pre-provision” BitLocker:

004005

This has been testet with the Windows 10 Enterprise Builds 1607 (Anniversary) & 1703 (Creators).

4 thoughts on “Change BitLocker Drive encryption to XTS-AES 256 during OSD with #ConfigMgr”

  1. I’ve found that on Windows 10 1703 using the key value “Encryption Method” causes the task sequence step to fail. MBAM policy creates the value as “Encryption MethodWithXtsOs” but although the step completes successfuly that the pre-provision step ignores it. Do you experience the same behaviour?

    Like

  2. There seems to be some inconsistency in the results of using “Encryption Method” and “Encryption MethodWithXtsOs”, I am deploying Windows 10 1703 in ConfigMgr 1706 with MDT Integration and saving BitLocker Recovery to AD until MBAM is implemented, the BitLocker Pre-provision step did not work with the “Encryption MethodWithXtsOs” registry option, but did when I added the “Encryption Method” registry option.

    Subtle changes and reversions seem to be implemented without adequate documentation from Microsoft.

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s