Has anyone seen BitLocker policies silently fail on certain devices?

Hi Jenifer Teffani,

If your remote setup utilizes standard user accounts, you must ensure your Intune policy has "Allow standard users to enable encryption during Autopilot" or the general "AllowStandardUserEncryption" setting set to "Yes." Without this, the silent push will fail instantly because the CSP lacks the permission to write the protector to the drive.

You must also verify the status of the Windows Recovery Environment (WinRE) on these specific machines. BitLocker silent encryption requires a functional WinRE to ensure the system can be recovered if the boot configuration changes. You can check this by running reagentc /info in an elevated command prompt. If the output shows the status as "Disabled," the silent policy will abort. Running reagentc /enable is the standard fix to re-register the recovery partition, which allows the CSP to verify the environment and proceed with the encryption during the next policy sync.

To find the exact reason for the failure on a specific device, you should examine the Applications and Services Logs > Microsoft > Windows > BitLocker-API > Management log in Event Viewer. Look specifically for Event ID 853. This event usually carries a status code like 0x8031002c, which often points to "Un-allowed DMA capable bus" or a failure to bind to PCR 7. This happens on modern hardware with Thunderbolt ports or when Secure Boot is not properly configured. If the logs mention DMA buses, you may need to adjust your Intune policy to "Allow" encryption even if an un-allowed DMA bus is detected, which is a common requirement for high-performance laptops.

Also, check for a "Logical Conflict" in your policy settings. Silent encryption is strictly incompatible with any requirement for a Startup PIN or a Startup Key, as these require the user to interact with the machine during the encryption phase. Ensure your Endpoint Security profile is configured so that "Compatible TPM startup PIN" and "Compatible TPM startup key" are both set to "Blocked." This allows the system to automatically escrow the recovery key to Microsoft Entra ID and begin the encryption process without waiting for a user response that will never come through the silent channel.

Hope this answer brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

VPHAN