https://aidenxie.net/tags/bitlocker/Recent content in BitLocker on Aiden Xie | IT PortfolioHugoen-AUWed, 24 Jun 2026 00:00:00 +0000https://aidenxie.net/labs/intune-bit-locker/Wed, 24 Jun 2026 00:00:00 +0000https://aidenxie.net/labs/intune-bit-locker/<h2 id="background">Background</h2> <p>This lab was completed as part of my preparation for the MD-102 Endpoint Administrator exam. I used a personal Microsoft 365 Business Premium lab tenant to practise endpoint security management with Microsoft Intune.</p> <h2 id="objective">Objective</h2> <ul> <li>Create a Security group</li> <li>Add a Windows device to the group</li> <li>Create a BitLocker disk encryption policy</li> <li>Assign the policy to a device group</li> <li>Sync the device from Intune</li> <li>Check the policy deployment result</li> <li>Identify why the policy did not apply successfully</li> </ul> <h2 id="lab-environment">Lab Environment</h2> <table> <thead> <tr> <th>Item</th> <th>Details</th> </tr> </thead> <tbody> <tr> <td>Tenant type</td> <td>Microsoft 365 Business Premium lab tenant</td> </tr> <tr> <td>Admin center</td> <td>Microsoft Intune admin center</td> </tr> <tr> <td>Device name</td> <td>LAPTOP-D42OPL9H</td> </tr> <tr> <td>Windows edition</td> <td>Windows 11 Home Chinese edition</td> </tr> <tr> <td>Windows version</td> <td>Windows 11 25H2, OS build 26200.8655</td> </tr> <tr> <td>Device join type</td> <td>Microsoft Entra registered / MDM-only enrolled device</td> </tr> <tr> <td>Enrollment method</td> <td>Manual MDM enrollment</td> </tr> <tr> <td>License</td> <td>Microsoft 365 Business Premium</td> </tr> <tr> <td>Device group</td> <td>LAB-Windows-Devices</td> </tr> <tr> <td>Group type</td> <td>Security</td> </tr> <tr> <td>Membership type</td> <td>Assigned</td> </tr> <tr> <td>Policy name</td> <td>LAB-BitLocker-Baseline</td> </tr> <tr> <td>Policy type</td> <td>Endpoint security &gt; Disk encryption &gt; BitLocker</td> </tr> <tr> <td>Policy platform</td> <td>Windows</td> </tr> <tr> <td>Assignment target</td> <td>MDM</td> </tr> <tr> <td>Device compliance status</td> <td>Compliant</td> </tr> <tr> <td>Last device check-in time</td> <td>6/15/2026, 12:53:21 PM</td> </tr> </tbody> </table> <h2 id="steps">Steps</h2> <h3 id="step-1-create-a-device-security-group">Step 1: Create a device Security group</h3> <p>I created a new Security group named <code>LAB-Windows-Devices</code> in the Microsoft Intune admin center. The group used the <code>Assigned</code> membership type, which means devices must be added manually.</p>