This causes severe performance issues in Configuration Manager, especially in SQL and with management points. Known issues include the creation of a large set of policies targeting all devices, which can lead to policy storms. In addition, as of Configuration Manager Current Branch 2103, Configuration Manager BitLocker Management no longer uses the MBAM key recovery service site to escrow keys.Īttempting to use the Invoke-MbamClientDeployment.ps1 PowerShell script with Configuration Manager Current Branch 2103 or later can cause serious problems with the Configuration Manager site. This includes escrowing BitLocker recovery keys during a Configuration Manager task sequence. This is because the PowerShell script 'Invoke-MbamClientDeployment.ps1' is not supported for use with BitLocker Management in Configuration Manager. This states that the instructions mentioned in the document do not refer to Configuration Manager BitLocker Management. In the document How to Enable BitLocker by Using MBAM as Part of a Windows Deployment, dated from April 2017, there is the box shown in the above tweet with an important note. However, I just came across the following tweet that explicitly warns against using the script in ConfigMgr. Please remember to mark the replies as answers if they help.I have no idea if this is of interest to you administrators because the above PowerShell script is used. Locate an entry that starts with Checking for Recovery Service For connectivity to the recovery service, the log shows the URL that the client is using. On the client, use the BitLockerManagementHandler.log to troubleshoot the connection to the recovery service. This option applies toĬonfiguration Manager versions 1910 or 2002. Configure the management point for HTTPS. This option only applies to Configuration Manager version 2002.Ģ.

HTTPS-enable the IIS website on the management point that hosts the recovery service. The BitLocker recovery service requires HTTPS to encrypt the recovery keys across the network from the Configuration Manager client to the management point.

Sccm mbam