Windows 10 device with secure boot enabled shows as Not Compliant in Intune

by

https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-protection/secure-boot-enabled-device-shows-not-compliant

Symptom

You create a compliance policy for Windows 10 devices in Intune. You set the Require Secure Boot to be enabled on the device setting to Require.

Screenshot of the Require Secure Boot to be enabled on the device setting.

In this scenario, a Windows 10 device that meets the requirement is marked as Not Compliant.

Screenshot shows Require Secure Boot to be enabled on the device Not compliant.

Check Secure Boot status

To check the status of Secure Boot on your PC:

  1. Go to Start.
  2. In the search bar, type msinfo32 and press enter.
  3. System Information opens. Select System Summary.
  4. On the right-side of the screen, look at BIOS Mode and Secure Boot State. If Bios Mode shows UEFI, and Secure Boot State shows Off, then Secure Boot is disabled.

Cause

The Require Secure Boot to be enabled on the device setting is supported on some TPM 1.2 and 2.0 devices. For devices that don’t support TPM 2.0 or later, the policy status in Intune shows as Not Compliant. TPM 2.0 requires UEFI firmware. A computer with legacy BIOS and TPM 2.0 won’t work as expected.

For more information about supported versions, see Supported versions for device health attestation.

For more information about how mobile device management (MDM) solutions use the Health Attestation Service, see Protect, control, and report on the security status of Windows 10-based devices.

Troubleshooting Steps

Use these steps to check whether your device meets the hardware requirements for the health attestation feature.

  1. Check the TPM version.Type tpm.msc in the Run box, and then check the value in Specification Version.Screenshot of TPM Management on Local Computer window, where the Specification Version is highlighted. NoteIf the TPM version is 1.2 and your device supports TPM 2.0, contact your device manufacturer to update to TPM 2.0.
  2. Open an elevated command prompt, and run the msinfo32 command.
  3. In System Summary, verify that BIOS Mode is UEFI, and PCR7 Configuration is Bound.Screenshot of System Summary, where BIOS Mode is UEFI, and PCR7 Configuration is Bound.
  4. Open an elevated PowerShell command prompt, and run the following command:PowerShellCopyConfirm-SecureBootUEFI Verify that it returns the value of True.
  5. Run the following PowerShell command:PowerShellCopymanage-bde -protectors -get $env:systemdrive Verify that the drive is protected by PCR 7.Screenshot of the PCR validation profile.

If any issues similar to the below screenshot. enter the Command

manage-bde -protectors c: -add -tpm

If you encounter BitLocker could not be enabled when USB drive is not found error.

Symptoms

When attempting to turn on BitLocker using a Startup Key as a protector and the system check option is accepted, BitLocker restarts the machine to complete the hardware test. If the USB drive holding the Startup Key is removed, or if USB ports are not enumerated correctly by the BIOS, then BitLocker isn’t enabled on the volume and you may see following error message:

BitLocker could not be enabled.
The BitLocker encryption key cannot be obtained. Verify that the Trusted Platform Module (TPM) is enabled and ownership has been taken. If this computer does not have a TPM, verify that the USB drive is inserted and available.
C: was not encrypted.

Screenshot of the BitLocker error message.

Cause

Boot Manager (Bootmgr) verifies that, the key material needed to unlock the disk is available before booting and starting encryption. If it is not available during the pre-boot hardware test before encryption, BitLocker will refuse to encrypt rather than leave the disk in a state that may not be usable in the expected manner. In the Startup Key case, this can occur when Bootmgr fails to find the Startup Key, either because then USB flash drive containing the Startup Key wasn’t plugged in, or because the BIOS did not correctly enumerate the USB port with the USB drive inserted.

Resolution

The resolution will depend on the underlying cause. If you have already verified that the USB flash drive containing the Startup Key is inserted correctly and securely in the USB port, try the following steps:

  1. Some USB ports are not enumerated during boot. Try a different USB port.
  2. Some USB drives cannot be read during boot. Try a different USB dongle.
  3. Boot into the BIOS and ensure USB is supported at boot time.
  4. Check to see if there is a firmware update for your machine.

Leave a Comment