Bitlocker Auto encryption bypass / postponed forever.
Dear reader
As you know we update this blog once we get in some kind of trouble in our daily life, So today our organization started Bitlocker implementation on all systems which will encrypt all drives, I have allowed encryption on only C (windows) drive, but soon after that, the bitlocker started giving me popups like encrypt your D,E drive.
I have clicked on postponed multiple times but it keeps on appearing after few minutes.
Sooooo, if you have faced such issue below is the an awesome trick to bypass it, also you won't find this trick any where else on internet as its completely self learned.
So I knew that this Bitlocker is some how communicating to its centralized server for policy updates or may be for some other communication or keys recovery or reports etc, and I knew that server information will be stored in Registry. But the problem was to search for those registry keys and find the server information and edit the host file and assigning the localhost to server host. OK enough talking lets start....
1st you must have admin rights on your system doesn't matter if local or provided by Active directory.
Next Open the registry, (windows button + R, type regedit and hit enter)
Go to any of below Registry keys you will find the information about Bitlocker centralized server.
The Key which contains the server information are written inside Small brackets. e.g the server information is something like this;
http://mbam.organization.com/selfservice
Note down this URL mbam.organization.com
Next open the NOTEPAD as administrator, its important because you won't be able to edit the host file.
In Notepad click on file and click on OPEN, go to c:\Windows\System32\drivers\etc now click on dropdown which it says TEXT Documents (*.txt) and select ALL FILES once you do it, you will show HOST file. double click on host file.
Now the host file is open, at the bottom of the file write this line
127.0.0.1 mbam.organization.com
Remember to replace mbam.organization.com with you own orgnazation URL which you noted from registry key
Once all done press Cntrl+S for saving the host file. And done the popup will not appear again.
As you know we update this blog once we get in some kind of trouble in our daily life, So today our organization started Bitlocker implementation on all systems which will encrypt all drives, I have allowed encryption on only C (windows) drive, but soon after that, the bitlocker started giving me popups like encrypt your D,E drive.
I have clicked on postponed multiple times but it keeps on appearing after few minutes.
Sooooo, if you have faced such issue below is the an awesome trick to bypass it, also you won't find this trick any where else on internet as its completely self learned.
So I knew that this Bitlocker is some how communicating to its centralized server for policy updates or may be for some other communication or keys recovery or reports etc, and I knew that server information will be stored in Registry. But the problem was to search for those registry keys and find the server information and edit the host file and assigning the localhost to server host. OK enough talking lets start....
1st you must have admin rights on your system doesn't matter if local or provided by Active directory.
Next Open the registry, (windows button + R, type regedit and hit enter)
Go to any of below Registry keys you will find the information about Bitlocker centralized server.
- HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\22000040 (Value of Element)
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\MDOPBitLockerManagement (Value of StatusReportingServiceEndpoint)
- HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE (Value of RecoveryKeyUrl)
- HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\FVE\MDOPBitLockerManagement (Value of StatusReportingServiceEndpoint)
The Key which contains the server information are written inside Small brackets. e.g the server information is something like this;
http://mbam.organization.com/selfservice
Note down this URL mbam.organization.com
Next open the NOTEPAD as administrator, its important because you won't be able to edit the host file.
In Notepad click on file and click on OPEN, go to c:\Windows\System32\drivers\etc now click on dropdown which it says TEXT Documents (*.txt) and select ALL FILES once you do it, you will show HOST file. double click on host file.
Now the host file is open, at the bottom of the file write this line
127.0.0.1 mbam.organization.com
Remember to replace mbam.organization.com with you own orgnazation URL which you noted from registry key
Once all done press Cntrl+S for saving the host file. And done the popup will not appear again.
Comments
Post a Comment