Windows: Deploying and Managing BitLocker in the Enterprise 
Student Lab Manual 

Version 2.5

Conditions and Terms of Use
Microsoft Confidential

This training package is proprietary and confidential, and is intended only for uses described in the training materials. Content and software is provided to you under a Non-Disclosure Agreement and cannot be distributed. Copying or disclosing all or any portion of the content and/or software included in such packages is strictly prohibited.
The contents of this package are for informational and training purposes only and are provided "as is" without warranty of any kind, whether express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, and non-infringement.
Training package content, including URLs and other Internet Web site references, is subject to change without notice. Because Microsoft must respond to changing market conditions, the content should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. 

© 2014 Microsoft Corporation.  All rights reserved.

Copyright and Trademarks
© 2014 Microsoft Corporation. All rights reserved.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. 
For more information, see Use of Microsoft Copyrighted Content at
http://www.microsoft.com/about/legal/permissions/
Active Directory, BitLocker, BitLocker To Go, Hyper-V, Internet Explorer, Microsoft, SharePoint, SQL Server, Windows, and Windows PowerShell are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other Microsoft products mentioned herein may be either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are property of their respective owners.

Contents
Before You Begin	1
Lab Exercises	1
Lab 1: Enabling BitLocker	3
Lab 1, Part 1 - Storing a Key in AD DS	3
Lab 1, Part 2 - Working with Delegation of BitLocker Recovery Keys	8
Lab 2: Setup BitLocker To Go	9
Lab 3: BitLocker Recovery	12
Lab 4: Troubleshooting Boot Issues with DaRT	15
Lab 5: Install Microsoft BitLocker Administration and Monitoring 2.5 in Integrated Topology with High Availability SQL Server Clustering and NLB IIS	22
Lab 6: Encrypt Windows 8 with Password Protector and Used Space Only	34
Appendix A: Access MBAM Site (helpdesk and selfservice) and Confirm Compliancy Through System Center Configuration Manager	37
Appendix B: Microsoft BitLocker Administration and Monitoring 2.5 Prerequisite Checklist	38
Prerequisites for the Recovery Database	38
Prerequisites for the Compliance and Audit Database	39
Prerequisites for the Reports	39
Prerequisites for the Administration and Monitoring Server	41
Prerequisites for the Self-Service Portal	44
Prerequisite for Configuration Manager Integration	45
Appendix C: Editing MOF files	48
Edit the Configuration.mof File	48
Create or Edit the Sms_def.mof File	56

Lab Exercises 
The following hands-on exercises are provided for this course:
·	Enabling BitLocker in your environment
·	Configure Microsoft BitLocker Administration and Monitoring 2.5 Group Policy Object (GPO) and deploy Microsoft BitLocker Administration and Monitoring (MBAM) Agent 
·	Encrypt operating system and fixed data drives
·	View reports
·	Install Microsoft BitLocker Administration and Monitoring 2.5 in an high availability environment with Network Load Balancing (NLB), Internet Information Services (IIS), and SQL Server clustering
·	Recovering an encrypted drive and troubleshooting
Lab Files on Hyper-V Host Machine
·	C:\Classfiles\ISO\: Contains ISOs to Microsoft Desktop Optimization Pack for Software Assurance (MDOP) and Microsoft Windows Server 2012 R2.
·	C:\Classfiles\Tools\: Contains all the tools / scripts you will use during this lab.
·	C:\Classfiles\VM\: Contains the pre-built virtual machines required to complete the lab exercises.
Lab Environment
Confirm that your Hyper-V host has the correct virtual machines (MBAM-DC, MBAM-SQL, MBAM-IIS, MBAM-SCCM, MBAM-SQL-N1, MBAM-SQL-N2, MBAM-IIS-NLB1, and MBAM-IIS-NLB2, MBAM-Win7, MBAM-Win8)
·	Confirm the virtual network:
o	“Internal” connected to the Internal Network
o	RAM notes:
§	Each of the virtual machines has 2 GB of RAM and has been configured for Dynamic Memory.
User Accounts
Computer	User Name	Password	
Domain: Contoso	Administrator	Pa$$w0rd	
MBAM-DC	Contoso\administrator	Pa$$w0rd	
MBAM-SQL	Contoso\sqladmin	Pa$$w0rd	
MBAM-IIS	Contoso\webadmin	Pa$$w0rd	
MBAM-SCCM	Contoso\smsadmin	Pa$$w0rd	
MBAM-SQL-N1	Contoso\sqladmin	Pa$$w0rd	
MBAM-SQL-N2	Contoso\sqladmin	Pa$$w0rd	
MBAM-IIS-NLB1	Contoso\webadmin	Pa$$w0rd	
MBAM-IIS-NLB2	Contoso\webadmin	Pa$$w0rd	
MBAM-Win7	Contoso\administrator	Pa$$w0rd	
MBAM-Win8	Contoso\administrator	Pa$$w0rd	

Lab 1: Enabling BitLocker 
Machines Involved: Perform this lab on the Windows Server 2012 Domain Controller (MBAM-DC) and Windows 7 Enterprise Client (MBAM-Win7) virtual machines.
Scenario: Need to enable BitLocker Encryption on the Client and Delegate the ability to view the recovery keys in Active Directory Domain Services (AD DS) to a helpdesk user.
Lab 1, Part 1 - Storing a Key in AD DS
Steps:
1.	Log on to the Windows Server 2012 Domain controller (Virtual Machine Name: MBAM-DC).
2.	Enter the following details:
o	Username: CONTOSO\Administrator
o	Password: Pa$$w0rd
3.	Open Group Policy Management Console.
4.	Create a New Group Policy Object with the following settings:
a.	Policy Name: Non_MBAM_BitLocker
b.	Right-click Non_MABM_BitLocker and select Edit.
c.	Under Computer Configuration, go to Policies > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
i.	Enable Choose how BitLocker-protected operating system drives can be recovered.
·	Select Do not enable BitLocker until recovery information is stored to AD DS for operating system drives.
ii.	Enable Require additional authentication at startup.
5.	Link the Non_MBAM_BitLocker policy to the Clients Organizational Unit (OU).
6.	Close Group Policy Management.
7.	Run Active DirecAdminig

8.	Browse to the “Clients” OU.
9.	Double-click MBAM-Win7 and select BitLocker Recovery.
o	Notice that there is no Recovery key tab. This is because the BitLocker Recovery Password Viewer Feature in not installed on the server.
10.	Close Active Directory Users and Computers.
11.	Open Server Manager. 
12.	Click Manage.
13.	Click Add Roles and Features.
14.	Click Next.
15.	On the Select destination server, click Next.
16.	On the Select server roles page, click Next.
17.	Select BitLocker Drive Encryption.

a.	Click Add Features.
b.	Click Next.
c.	Click Install.
d.	Reboot the domain controller.

18.	Once the install has been completed, open Active Directory Users and Computers and take a look at the properties of the Windows 7 Computer object.

19.	Log on to the Windows 7 Client Machine (VM Name: MBAM- Win7).
o	Username: CONTOSO\Administrator
o	Password: Pa$$w0rd
20.	Open a command prompt and run the following: 
gpupdate /force

21.	Once this is done run the following: 
gpresult /h gpresult.html
22.	Open the gpresult.html file and you will notice that under Administrative Templates, the BitLocker Policies are enabled on the system.

23.	Click Media > Diskette Drive > Insert Disk. Go to the \Classfiles\tools folder and select VirtualTPM.vfd.
24.	Format the Virtual Floppy Disk from Windows Explorer.
25.	Open an elevated Command Prompt and run the following command:
Manage-bde –on c: -recoverypassword –startupkey a:\ -recoverykey a:\ -skiphardwaretest

26.	Go to the Windows Server 2012 Domain Controller.
27.	Run Active Directory Users and Computers.
28.	Go to the “Clients” OU. 
29.	Double-click MBAM-Win7 and select BitLocker Recovery tab.
o	Notice that whether you see the recovery keys now.

Lab 1, Part 2 - Working with Delegation of BitLocker Recovery Keys 
1.	On the domain controller virtual machine, open an elevated Command Prompt and run the following commands:
Net group BitLockerDL /add /domain
Net group BitLockerDL helpdesk /add /domain
This is done to show you that you need to delegate to a Security Group and not to an individual.
2.	Click Media > DVD Drive > Insert Disk and select \classfiles\tools\Tools.iso.
3.	Go back to the elevated Command Prompt and type:
Cscript.exe d:\delegate.vbs
Note that if you open the script, at the second line, you will need to change the name to any group that you wish to delegate control; this has been done already for the lab.

Lab 2: Setup BitLocker To Go 
Machines Involved: Perform this lab on the Windows Server 2012 Domain Controller (MBAM-DC) and Windows 7 Enterprise Client (MBAM-Win7) virtual machines.
Scenario: Setup Group Policy to require removable storage is encrypted with BitLocker To Go.
Steps:
1.	Log on to the Windows Server 2012 Domain controller (VM Name: MBAM-DC):
o	Username: CONTOSO\Administrator
o	Password: Pa$$w0rd
2.	Open Group Policy Management Console (GPMC).
3.	Open the Group Policy Non_MBAM_BitLocker and add the following settings:
4.	Under Computer Configuration, go to Policies > Administrative Templates > Windows Components > BitLocker Drive Encryption > Removable Data Drives.
a.	Enable Deny write access to removable drives not protected by BitLocker.
b.	Enable Configure use of passwords for removable data drives.
c.	Select Require password for removable data drive.
d.	Enable Choose how BitLocker-protected removable drives can be recovered.
e.	Enable Control use of BitLocker on removable drives.
i.	Clear Allow users to suspend and decrypt BitLocker protection on removable data drives.

5.	Log on to the Windows 7 Client
a.	Username: CONTOSO\Administrator
b.	Password: Pa$$w0rd
6.	Open a command prompt and run the following: 
gpupdate /force

7.	Run the following: 
gpresult /h gp_removable_drives.html

8.	Notice the policy changes under Windows Components.

Note: Due to the lack of physical hardware, this is a view only lab at this time; we cannot detect devices as Removable that are not removable.

Lab 3: BitLocker Recovery 
Machines Involved: Perform this lab on the Windows Server 2012 Domain Controller (MBAM-DC) and Windows 7 Enterprise Client (MBAM-Win7) virtual machines.
Scenario: Getting BitLocker Recovery Key from AD DS and successfully booting up a machine that has entered Recovery Mode as a standard user that has been delegated control of the Recovery Keys.
Steps:
1.	Log on to the Windows 7 Client (VM Name: MBAM-Win7).
o	Username: CONTOSO\Administrator
o	Password: Pa$$w0rd
2.	Shut down the Windows 7 Client Virtual Machine.
3.	Click Media > Diskette Drive > Eject VirtualTPM.vfd

4.	Start the Windows 7 Client Machine.
5.	At this point, it will come to a screen that asks you to “Insert key storage media.” 

6.	Press Enter to go into Recovery Mode.

Note: Make note of the Recovery Key ID. 
Hint: Typically, the first eight characters are enough.
7.	Go to the Domain Controller and add Helpdesk and Advhelpdesk to Backup Operators Security Group in Active Directory Users and Computers. 

8.	Log off the Domain Controller as Administrator.
9.	Log on to the Domain Controller with the following credentials: 
o	User: Contoso\Helpdesk
o	Password: Pa$$w0rd
10.	Click Media > DVD Drive > Insert Disk and select \classfiles\tools\tools.iso.

11.	Open a command prompt and type the following to retrieve the BitLocker Recovery Key as a standard user:
Cscript d:\bitlock.vbs MBAM-Win7
12.	Match the Recovery ID from the Windows 7 client to the output and get the 48-digit key that corresponds in AD DS.
13.	Once you get the 48-digit key typed into the Virtual Machine, it will then boot up. 
Note: If you do not insert the VirtualTPM.vfd back into the system, on every reboot it will go into Recovery mode.

Lab 4: Troubleshooting Boot Issues with DaRT 
Machines Involved: Perform this Lab on the Windows 2012 Domain Controller (DC) and Windows 7 Enterprise Client VMs.
Scenario: Your Client is not able to fully boot to Windows and you need to be able to boot into Windows Recovery Environment to repair the System or at least backup some of the files.
Steps:
1.	Select the Windows 7 Client VM.
a.	Click Media > DVD Drive > Insert Disk and select \classfiles\tools\Dart70.iso.
b.	Restart the machine and make sure that you boot from DVD.
2.	You should see the following screen:

3.	Click Yes when prompted Would you like to initialize network connectivity in the background? question as in the following screenshot:

4.	Click Yes to re-map the drive letters to match the mappings from the target operating system.

5.	Choose your preferred input language on the next screen and click OK. 

6.	Select Manually input the Key and click Next.

7.	
Log on to the domain controller and open Active Directory Users and Computers either by the following methods:
o	Run dsa.msc 
Or 
o	Click Start > Administrative Tools > Active Directory Users and Computers.
8.	Expand “Contoso.com”, go to the Clients Folder and double-click MBAM-Win7. Select BitLocker Recovery and view the Recovery Password.

9.	
Enter the key in the following screenshot on the Windows 7 Client and click Next.

10.	You now have access to the drive. Click Finish.

11.	The machine will try to find any boot related issues and if possible, it will try to repair it. In this scenario, nothing is wrong with the disk. Click Next.

12.	From the System Recovery Options screen, Select Microsoft Diagnostics and Recovery Toolset:

13.	Take a look at all the options provided by the Tools, and then click Explorer.

14.	Click Tools and then click Map Network Drive.

o	Folder: \\MBAM-DC\c$ 
o	User Name: Contoso\Administrator
o	Password: Pa$$w0rd
15.	You should now be able to browse the content of the MBAM-DC C: drive.
In a real world scenario, you would now be able to copy data to your server.

16.	Close Explorer and close the DaRT screen. Before restarting the machine, make sure you eject the DaRT ISO from the virtual machine. To do so, click Media > DVD Drive and click Eject DaRT70.iso.
For more information on DaRT on TechNet, see: http://technet.microsoft.com/en-us/library/ee532075.aspx
For more information about WinRE on TechNet, see: http://technet.microsoft.com/en-us/library/dd744255(v=WS.10).aspx
For a complete overview of all tools available in MDOP, see this TechNet site: http://technet.microsoft.com/en-us/windows/bb899442.aspx

Lab 5: Install Microsoft BitLocker Administration and Monitoring 2.5 in Integrated Topology with High Availability SQL Server Clustering and NLB IIS 
1.	On the machine hosting the virtual machines, connect and start the following virtual machines: MBAM-DC, MBAM-SQL-N1, MBAM-SQL-N2, MBAM –IIS-NLB1 and MBAM-IIS-NLB2, MBAM-SCCM.
a.	Make sure each of the virtual machines are connected to the Internal Network.
b.	Confirm that you can ping between these machines and it resolves with a Fully Qualified Domain Name (FQDN).
c.	Confirm that NLB is in the converged state on MBAM-IIS-NLB1 virtual machine.
ii.	Open Network Load Balance Manager from start screen.
iii.	Click MBAM-NLB.contoso.com. 
iv.	Verify that the status is converged for both nodes MBAM-IIS-NLB1, and MBAM-IIS-NLB2.
2.	Confirm that prerequisites have been met for MBAM-SQL-N1, MBAM-SQL-N2, MBAM –IIS-NLB1 and MBAM-IIS-NLB2, MBAM-SCCM for installing MBAM.
Note: See the Planning module for prerequisites. The prerequisites are also listed in Appendix C.
3.	Create MBAM groups.
a.	Log on to MBAM-DC.
b.	Open Active Directory Users and Computers.
c.	Create following Groups
§	MBAMUsers
§	MBAMAdmin
d.	Add SQLadmin, Webadmin, and SMSAdmin to the MBAMAdmin group.
e.	Add student user to the MBAMUsers group.
4.	Install Microsoft BitLocker Administration and Monitoring 2.5 Server software on MBAM-SCCM, MBAM-IIS-NLB1, MBAM-IIS-NLB2, MBAM-SQL-N1 and complete the following procedure on all these virtual machines:
a.	Attach the MDOP.iso (c:\classfiles\iso\MDOP.iso) to each of the virtual machines. 
b.	Browse to CD drive\ MBAM\Installers\2.5\x64
c.	Run MBAMServerSetup.exe to start the Microsoft BitLocker Administration and Monitoring Setup wizard.
d.	On the Welcome page, click Next. 
e.	Accept the Microsoft software License Agreement and then click Next. 
f.	Choose the Customer Experience Improvement Program and then click Next.  
g.	To start the installation, click Install. 
h.	To start MBAM Server Configuration after installation finishes, select Run MBAM Server Configuration after the wizard closes or search for MBAM Server Configuration from Start screen.
i.	Click Finish.
Task 1: Configure Databases
1.	On the server where you want to configure the databases (MBAM-SQL-N1), start the MBAM Server Configuration wizard. You can select MBAM Server Configuration from the Start screen to open the wizard.
2.	Click Add New Features.
3.	Select Compliance and Audit Database and Recovery Database, and then click Next.
4.	Click Start, accept the license agreement on the next screen and then click Next.
5.	Use the following values in fields in the wizard to configure the Compliance and Audit Database:
Field 	values	
SQL Server name 	MBAM-HA
That is Clustered SQL Server Virtual Name or browse to confirm the name	
SQL Server database instance 	Leave blank to use default value	
Database name 	Leave the default value	
Read/write access domain user or group 	MBAMAdmin	
Read-only access domain user or group 	MBAMUsers	

6.	Use the following values to configure the Recovery Database:
Field 	Values	
SQL Server name 	MBAM-HA
That is Clustered SQL Server Virtual Name or browse to confirm the name	
SQL Server database instance 	Leave blank to use default value	
Database name 	Leave the default value	
Read/write access domain user or group 	MBAMAdmin	

7.	When you finish entering the values, click Next. The wizard checks that all prerequisites for the databases have been met.
8.	If the prerequisite check is successful, click Next to continue, otherwise, resolve any missing prerequisites, and then click Next.
9.	On the Summary page, review the features that will be added.
10.	Click Add to add the MBAM databases on the server, and then click Close.
Task 2: Edit Managed Object Format (MOF) files 
Refer to Appendix C.
Task 3: Configure Microsoft System Center Configuration Manager Integration
1.	On the server where you want to configure the System Center Configuration Manager Integration feature (MBAM-SCCM), start the MBAM Server Configuration wizard. You can select MBAM Server Configuration from the Start screen to open the wizard.
2.	Click Add New Features, select System Center Configuration Manager Integration, and then click Next.
3.	If the prerequisite check is successful, click Next to continue. Otherwise, resolve any missing prerequisites, and then click Check prerequisites again.
4.	Use the following values in the fields in the wizard:
o	SQL Server Reporting Services server: Leave it as default
o	SQL Server Reporting Services instance: Leave it as default
5.	On the Summary page, review the features that will be added.
6.	Click Add to add the Configuration Manager Integration feature to the server, and then click Close.
7.	Confirm that Reports have been created in SQL Server Reporting Services (SSRS)
a.	Start Reporting Services Configuration Manager.
b.	Connect to the Report Server Instance: MSSQLSERVER (default)
c.	Click the Report Manager URL and take note of the URL (http://MBAM-SCCM/Reportserver)
d.	Click the URL link and confirm that you are able to connect and can see Microsoft BitLocker Administrator and Monitoring.
Task 4: Configure Reports
Since we have SSRS installed on MBAM-SCCM server, we will use that for reports as well. Note that this is just a test lab setup and not recommended to share SSRS. 
1.	On the MBAM-SCCM, where you want to configure the Reports, start the MBAM Server Configuration wizard. You can select MBAM Server Configuration from the Start menu to open the wizard.
2.	Click Add New Features, select Reports, and then click Next. The wizard checks that all prerequisites for the Reports have been met.
3.	Click Next to continue.
4.	Enter the field values in the wizard:
 Field 	Values	
SQL Server Reporting Services instance 	Leave it default	
Reporting role domain group 	MBAMUsers	
SQL Server name 	MBAM-HA	
SQL Server database instance 	Leave it as default	
Database name 	Leave it as default	
Compliance and Audit Database domain account 	Webadmin
password Pa$$w0rd	
5.	After entering the values, click Next.
The wizard checks that all prerequisites for the Reports feature have been met.
6.	Click Next to continue.
7.	On the Summary page, review the features that will be added.
8.	Click Add to add the Reports on the server, and then click Close.
Task 5: Configure Application Pool Account
In this lab, we are going to use webadmin account as WebService Application Pool Domain Account. Before configuring web Applications, do the following:
Add SPN
1.	Connect to MBAM-DC as domain administrator (contoso\administrator).
2.	Open a command prompt with administrator rights.
3.	Run the following commands: 
Note: Do not copy/paste commands.
Setspn –s HTTP/MBAM-NLB.contoso.com contoso\webadmin
Setspn –s HTTP/MBAM-NLB contoso\webadmin
4.	Open Active Directory Users and Computers > contoso.com > users.
5.	Select webadmin, right-click and then click Properties.
6.	Click the Delegate tab.
7.	Choose Trust this user for delegation to specified services only:
a.	Use any authentication protocol.
b.	Click Add, browse webadmin and click OK.
c.	HTTP MBAM-NLB.contoso.com should populate.
d.	Click OK.
Add webadmin
1.	Connect to MBAM-SCCM and add contoso\webadmin to local administrators group.
Task 6: Configure Web Applications
Perform the following steps on both virtual machines MBAM-IIS-NLB1 and MBAM-IIS-NLB2.
1.	On the server where you want to configure the web applications, start the MBAM Server Configuration wizard. You can select MBAM Server Configuration from the Start screen to open the wizard.
2.	Click Add New Features, select Administration and Monitoring Website and Self-Service Portal, and then click Next. The wizard checks that all prerequisites for the databases have been met.
3.	If the prerequisite check is successful, click Next to continue. Otherwise, resolve any missing prerequisites, and then click Check prerequisites again.
4.	Use the following values in the wizard under configuration for all web applications:
Field 	Values	
Security certificate 	Choose Do not use a certificate	
Host name 	MBAM-NLB.contoso.com	
Installation path 	C:\inetpub	
Port 	80	
Web service application pool domain account and password 	WebAdmin
Password – Pa$$w0rd	
5.	Verify that the built-in IIS_IUSRS account or the application pool account has been added to the Impersonate a client after authentication and the log on as a batch job local security settings.
To check whether it has been added to the local security settings, open the Local Security Policy editor, expand the Local Policies node, click the User Rights Assignment node, and double-click Impersonate a client after authentication and Log on as a batch job policies in the right pane.
6.	Use the following values to configure the connection information in the wizard for the Compliance and Audit Database connection.
Field	Value	
SQL Server name 	MBAM-HA
That is, Clustered virtual SQL Server name	
SQL Server database instance 	Leave blank to use the default value	
Database name 	Leave the defaults	

7.	Use the following values to configure the connection information in the wizard for the Recovery Database connection.
Field	Value	
SQL Server name 	MBAM-HA
That is, Clustered Virtual SQL Server name	
SQL Server database instance 	Leave blank to use the default value	
Database name 	Leave the defaults	

8.	Use the following values to configure the connection information in the wizard for the Administration and Monitoring Website.
Field	Value	
Advanced Helpdesk role domain group 	MBAMAdmin	
Helpdesk role domain group 	MBAMUsers	
Use System Center Configuration Manager Integration 	Select this check box	
Reporting role domain group 	MBAMAdmin	
SQL Server Reporting Services URL 	http://mbam-sccm/ReportServer	
Virtual directory 	Leave the defaults	

9.	Use the following values to configure the connection information in the wizard for the Self Server Portal.
Field	Value	
Virtual directory	Leave the defaults	

10.	After entering the values, click Next.
11.	The wizard checks that all prerequisites for the web applications have been met. Click Next to continue.
12.	On Summary page, review the features that will be added.
13.	Click Add to add the web applications to the server, and then click Close.
14.	Confirm that MBAM-IIS-NLBx is connected to MBAM-HA and MBAM-SCCM and able to see reports.
a.	Open Internet Explorer and in the address bar, type:  http://MBAM-NLB.contoso.com/helpdesk
b.	Authenticate yourself if asked, and click Reports in the left Panel.
c.	You should see one tab named Recovery Audit Report. Click it and validate that you are not getting any errors accessing the reports page.
Task 7: Configure Group Policy
1.	Copy Administrative Templates to the DC
a.	Connect to MBAM-DC.
b.	Copy classfiles\tools\MDOP_ADMX_Templates.exe  to \\MBAM-dc\c$.
c.	Extract to c:\MDOP_ADMX_Templates on MBAM-DC.
d.	Copy/Replace group policy template from  C:\MDOP_ADMX_Templates\Microsoft Desktop Optimization Pack\MBAM2.5 on MBAM-DC 
i.	Go to \\MBAM-DC\SYSVol\contoso.com\policies\PolicyDefinitions and copy BitLockerManagement.admx and BitLockerUserManagement.admx.  
·	Copy/Replace the following administrative language files to \\MBAM-DC\SYSVol\contoso.com\policies\PolicyDefinitions\en-us
o	BitLockerManagement.adml 
o	BitLockerUserManagement.adml 
2.	Configure Group Policy
a.	Log on to the domain controller and run GPMC.msc.
b.	Go to Domains > contoso.com > Clients
c.	Remove the linked policy Non_MBAM_BitLocker from the “Clients” Organizational Unit.
d.	Create a New Group Policy Object with the following settings:
i.	Policy Name: MBAM_BitLocker
ii.	Right-click MBAM_BitLocker and select Edit.
iii.	Under Computer Configuration, select the following policies:
·	Administrative Templates
·	Windows Components
·	MDOP MBAM (BitLocker Management)
e.	Under the MDOP MBAM (BitLocker Management) folder, configure the following policies:
Policy Group	Policy	Setting	
Client Management	Configure MBAM Services	Enabled. Set MBAM Recovery and Hardware service endpoint to http://MBAM-NLB.contoso.com/MBAMRecoveryAndHardwareService/CoreService.svc   
Set MBAM status reporting service endpoint to Disabled. 	
	Configure User Exemption	Enabled
Maximum Number of days to postpone = 2
o	Select Provide a phone number or message from the drop-down list.
o	Enter the following text in the text field:
“You are requesting an exception from the IT Standard Drive encryption, please contact the Help desk at 000-000-0000”	
Fixed Drive	Configure use of passwords for fixed data drives	Enabled
	
	Deny write access to fixed drives not protected by BitLocker	Enabled	

f.	Link the MBAM_BitLocker policy to the “Clients” Organizational Unit.
g.	Close Group Policy Management.
h.	Log on to the Windows 7 Client:
§	Username: CONTOSO\Administrator
§	Password: Pa$$w0rd
i.	Attach the media from C:\classfiles\ISO\MDOP.iso and browse to MBAM\Installers\2.5\x64. Install the MbamClient.msi package.
j.	The installation is rather silent, so to validate the installation, open the Control Panel and look for the following:

You can also validate by browsing to \Program Files\Microsoft\MDOP MBAM and view the files.
k.	Open a command prompt and run the following: 
gpupdate /force

l.	Once this is done, run gpresult /H mbam_result.html

m.	Open the mbam_result.html and validate that your MBAM Policies are configured.
n.	On the Windows 7 Client, shut down the machine and then attach the \classfiles\tools\VirtualFixed.vhd to the machine (Either IDE or SCSI) and then start the machine.

o.	Open Disk Management and initialize the disk / create the partition and format the disk.

p.	Format the Drive.
i.	Open Registry Editor.
ii.	Go to \HKLM\Software\Microsoft\MBAM
·	Create DWORD Value – NoStartupDelay = 1

iii.	Go to \HKLM\Software\Policies\Microsoft\FVE\MDOPBitlockerManagement
·	Change the value of ClientWakeupFrequency to 1

q.	Restart the MBAM Client Service on the machine by typing the following:
§	net stop mbamagent
§	net start mbamagent
r.	BitLocker should then prompt you with the following message as in the following screenshot:

s.	Click Encrypt this drive using BitLocker Drive Encryption.
t.	Enter a Password for the Drive (Pa$$w0rd) and select Automatically unlock this drive on this Computer and click Next.

Lab 6: Encrypt Windows 8 with Password Protector and Used Space Only 
1.	Go to Group Policy Management Console (GPMC) on the domain controller.
2.	Right-click Group Policy Objects and then click New.
3.	At the New GPO dialog box, enter MBAM_BitLocker_Win8 for Name, leave Source Starter GPO set to none, and then click OK.
4.	Right-click MBAM_BitLocker_Win8 and then click Edit.
5.	Go to Policies > Administrative Templates > Windows Components > MDOP MBAM.
6.	For each policy in the table that follows, select Policy Group, click the Policy, and then configure the Setting as stated below. There are other policies not mentioned here, review the policies and leave them set to Not Configured.
Policy Group	Policy	Setting	
Client Management	Configure MBAM Services	Enabled. Set MBAM Recovery and Hardware service endpoint to http://MBAM-NLB.contoso.com/MBAMRecoveryAndHardwareService/CoreService.svc   
Set MBAM status reporting service endpoint to Disabled. 	
Operating System Drive	Operating system drive encryption settings	Enabled. Set Select protector for operating system drive to TPM only. If you are running Microsoft Windows 8 or newer, and you want to use BitLocker on a computer without a TPM, select the Allow BitLocker without a compatible TPM check box. In this mode, a password is required for startup.	
	Encryption Policy Enforcement Settings	Use this policy setting to configure the number of days that users can postpone complying with MBAM policies for their operating system drive. The grace period begins when the operating system is first detected as noncompliant. After this grace period expires, users cannot postpone the required action or request an exemption from it.	

7.	Close Policy Editor.
8.	Go to the GPM Console, Right-click the Clients_Win8 OU, click Link an Existing GPO, and then select MBAM_BitLocker_Win8.
9.	Close Group Policy Management.
10.	Log on to the Windows 8 Client (VM Name: MBAM-Win8).
o	Username: CONTOSO\Administrator
o	Password: Pa$$w0rd
11.	Attach the media from C:\classfiles\ISO\MDOP.iso and browse to MBAM\Installers\2.5\x64 and install the MbamClient.msi package
12.	Open a command prompt and run the following: 
gpupdate /force

13.	Once this is done, run gpresult /H mbam_result.html.

14.	Open mbam_result.html and validate that your MBAM Policies are configured.
15.	Open Registry Editor.
16.	Go to \HKLM\Software\Microsoft\MBAM.
17.	Create DWORD Value – NoStartupDelay = 1

18.	Go to \HKLM\Software\Policies\Microsoft\FVE\MDOPBitlockerManagement. 
19.	Change the value of ClientWakeupFrequency to 1

20.	Restart the MBAM Client Service on the machine by typing the following:
o	net stop mbamagent
o	net start mbamagent
21.	Enter Pa$$w0rd as Password when prompted by the MBAM client to encrypt the C: drive. 
22.	After Encryption Percentage reaches 100 %, restart the virtual machine.
23.	Enter Pa$$w0rd in the Password field to start into Windows 8.

The drive is now unlocked, and Windows 8 continues to boot using only a password as the protector.

Appendix A: Access MBAM Site (helpdesk and selfservice) and Confirm Compliancy Through System Center Configuration Manager
1.	Log on to the domain controller and add whoever you want to have access to the helpdesk and audit reports (using the MBAM groups we have created earlier).
2.	From a client machine, navigate and test connecting to http://mbam-nlb.contoso.lab/HelpDesk as member of MBAMUsers vs members from MBAMAdmin.
3.	Go through recovery scenario using MBAM helpdesk vs SelfService.
4.	Check compliance reporting from System Center Configuration Manager reports.

Appendix B: Microsoft BitLocker Administration and Monitoring 2.5 Prerequisite Checklist
Prerequisites for the Recovery Database
Prerequisite 	Details 	
Supported version of SQL Server	Install Microsoft SQL Server with SQL_Latin1_General_CP1_CI_AS collation.	
Required SQL Server permissions	Required permissions:
·	SQL Server instance login server roles:
o	dbcreator
o	processadmin
·	SQL Server Reporting Services instance rights:
o	Create Folders
o	Publish Reports	
SQL Server Database Engine Services 	SQL Server Database Engine Services must be installed and running during MBAM Server installation.	
Windows PowerShell 3.0 or higher	 
Operating system 	
Windows PowerShell already installed on the operating system? 	

Windows 8 
Windows Server 2012 	
Yes	

Windows PowerShell does not have to be installed on the Recovery Database server if you are using Windows PowerShell to configure the database from a remote computer.	

Prerequisites for the Compliance and Audit Database
Prerequisite 	Details 	
Supported version of SQL Server	Install SQL Server with SQL_Latin1_General_CP1_CI_AS collation versions.	
Required SQL Server permissions	Required permissions:
·	SQL Server instance login server roles:
o	dbcreator
o	processadmin
·	SQL Server Reporting Services instance rights:
o	Create Folders
o	Publish Reports	
SQL Server Database Engine Services 	SQL Server Database Engine Services must be installed and running during MBAM Server installation. However, SQL Server can be running remotely; it does not have to be on the same server on which you are installing the MBAM Server software.	
Windows PowerShell 3.0 or later	 
Operating system 	
Windows PowerShell already installed on the operating system? 	

Windows 8 
Windows Server 2012 	
Yes	

Windows PowerShell does not have to be installed on the Compliance and Audit Database server if you are using Windows PowerShell to configure the database from a remote computer.	
Prerequisites for the Reports
Prerequisite 	Details 	
Supported version of SQL Server	Install SQL Server with SQL_Latin1_General_CP1_CI_AS collation.	
SSRS	SSRS must be installed and running during the MBAM Server installation.
Configure SSRS in "native" mode and not in unconfigured or "SharePoint" mode.	
SSRS instance rights – required for configuring Reports only if you are installing databases on a separate server from the server where Reports are configured.	Required instance rights:
·	Create Folders
·	Publish Reports	
Validate that SSRS is configured to use Kerberos authentication	Kerberos is used by default, so validation might be needed only for unusual configurations.
To configure SSRS to use Kerberos authentication 
1.	Navigate to the following default installation location, and open the Rsreportserver.config file:
C:\Program Files\Microsoft SQL Server\<SQL instance>\Reporting Services\ReportServer
2.	Add <RSWindowsNegotiate/> to the rsreportserver.config file as follows:
<Authentication>
<AuthenticationTypes>
<RSWindowsNegotiate/>
<RSWindowsNTLM/>
</AuthenticationTypes>
... 
</Authentication>

If present, the <RSWindowsNTLM/> tag can be left in place, but it is not required for Kerberos authentication.	
Windows PowerShell 3.0 or higher 	 
Operating system 	
Windows PowerShell 3.0 already installed on the operating system? 	

Windows 8 
Windows Server 2012 	
Yes	

Windows 7 SP1
Windows Server 2008 R2	
No. See Installing Windows PowerShell for the download link and installation instructions.	

Windows PowerShell does not have to be installed on this Database server if you are using Windows PowerShell to configure the database from a remote computer.	
Prerequisites for the Administration and Monitoring Server
The following table lists the installation prerequisites for the MBAM Administration and Monitoring Server. 
Prerequisite 	Details 	
Windows Server Web Server Role	This role must be added to a server operating system that is supported for the Administration and Monitoring Server feature.	
Web Server (IIS) Management Tools	Click IIS Management Scripts and Tools.	
Web Server Role Services	Common HTTP Features: 
·	Static Content
·	Default Document
Application Development: 
·	ASP.NET
·	.NET Extensibility
·	ISAPI Extensions
·	ISAPI Filters
Security: 
·	Windows Authentication
·	Request Filtering	
Windows Server Features	Microsoft .NET Framework 4.5 features: 
·	.NET Framework 4.5 
o	Windows Server 2012 or Windows Server 2012 R2 - .NET Framework 4.5 is already installed for these versions of Windows Server, but you must enable it.
o	Windows Server 2008 R2 - .NET Framework 4.5 is not included with Windows Server 2008 R2, so you must download Microsoft .NET Framework 4.5 (http://www.microsoft.com/en-us/download/details.aspx?id=30653) and install it separately.
·	Windows Communication Foundation (WCF) Activation 
o	HTTP Activation
o	Non-HTTP Activation
Windows Process Activation Service: 
·	Process Model
·	.NET Framework Environment
·	Configuration APIs	
Service Principal Name (SPN)	The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.
If you have administrative rights in Active Directory Domain Services, MBAM creates the SPN for you. 
If you do not have administrative rights, you have to ask the Active Directory team to create the SPN for you by using the following commands.
o	Setspn -s http//mbamvirtual contoso\mbamapppooluser
o	Setspn -s http//mbamvirtual.contoso.com contoso\mbamapppooluser
In the code example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\mbamapppooluser. 
Note: 	

If you are configuring the web applications on separate servers and are using different host names for each web application, you must create a separate SPN for each web application. If you are setting up Load Balancing, use a virtual host name, which must the same for both web applications.	

For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see: Planning How to Secure the MBAM Websites - http://technet.microsoft.com/en-us/library/dn645356.aspx.	

Prerequisites for the Self-Service Portal
Prerequisite 	Details 	
Supported version of Windows Server	For supported versions, see: MBAM 2.5 Supported Configurations - http://technet.microsoft.com/en-us/library/dn645370.aspx.	
ASP.NET MVC 4.0	For more information on ASP.NET MVC 4 download, see: http://www.asp.net/mvc/mvc4 	
Web Service IIS Management Tools		
SPN	The web applications require an SPN for the virtual host name under the domain account that you use for the web application pools.
If you have administrative rights in AD DS, MBAM creates the SPN for you. 
If you do not have administrative rights, you have to ask the Active Directory team to create the SPN for you by using the following commands.
o	Setspn -s http//mbamvirtual contoso\mbamapppooluser
o	Setspn -s http//mbamvirtual.contoso.com contoso\mbamapppooluser
In the code example, the virtual host name is mbamvirtual.contoso.com, and the domain account used for the web application pools is contoso\mbamapppooluser. 
Note: 	

If you are configuring the web applications on separate servers and are using different host names for each web application, you must create a separate SPN for each web application. If you are setting up Load Balancing, use a virtual host name, which must be the same for both web applications.	

For more information about registering SPNs for fully qualified, NetBIOS, and custom host names, see: Planning How to Secure the MBAM Websites - http://technet.microsoft.com/en-us/library/dn645356.aspx.	

Prerequisite for Configuration Manager Integration
General Prerequisites for the Configuration Manager Integration Feature
When you install MBAM with Configuration Manager, the following additional prerequisites are required in addition to the prerequisites for the stand-alone topology.
Prerequisite 	Additional Information 	
The Configuration Manager Server is a primary site in the Configuration Manager system.	N/A	
The Hardware Inventory Client Agent is on the Configuration Manager Server.	For System Center 2012 Configuration Manager, see: How to Configure Hardware Inventory in Configuration Manager - http://technet.microsoft.com/library/hh301103.aspx.
For Configuration Manager 2007, see: How to Configure Hardware Inventory for a Site - http://technet.microsoft.com/library/bb680848.aspx.	
One of the following is enabled, depending on the version of Configuration Manager that you are using: 
·	Compliance Settings - (System Center 2012 Configuration Manager)
·	Desired Configuration Management (DCM) Client Agent – (Configuration Manager 2007)	For System Center 2012 Configuration Manager, see: Configuring Compliance Settings in Configuration Manager - http://technet.microsoft.com/library/gg682002.aspx.
For Microsoft System Center Configuration Manager 2007, see: Desired Configuration Management Client Agent Properties - http://technet.microsoft.com/library/bb681009.aspx.	
A reporting services point is defined in Configuration Manager. Required for SQL Server Reporting Services (SSRS).	For System Center 2012 Configuration Manager, see: Prerequisites for Reporting in Configuration Manager - http://technet.microsoft.com/library/hh338695.aspx.
For Configuration Manager 2007, see: How to Create a Reporting Services Point for SQL Reporting Services - http://technet.microsoft.com/library/cc161824.aspx.	
Configuration Manager 2007 requires Microsoft .NET Framework 2.0	The Desired Configuration Management (DCM) Client Agent in Configuration Manager 2007 requires Microsoft .NET Framework 2.0 to report compliance.
Note: 	

Installing Microsoft .NET Framework 3.5 automatically installs .NET Framework 2.0.	

Required Permissions to Install MBAM with Configuration Manager
To install MBAM with Configuration Manager, you must have an administrative user in Configuration Manager who has a security role with the minimum permissions listed in the following table. The table also shows the rights that you must have, beyond basic computer administrator rights to install the MBAM Server. 
The permissions in the following table apply to both versions of Configuration Manager. 
Permissions 	MBAM Server feature 	
SQL Server instance login server roles: 
·	dbcreator
·	processadmin	·	Recovery Database
·	Audit Database
Note: 	

In the Configuration Manager Integration topology, the database is called just “Audit Database” because it contains only audit data, not compliance data.	

SSRS instance rights: 
·	Create Folders
·	Publish Reports	·	System Center Configuration Manager Integration	
System Center 2012 Configuration Manager 
Permissions 	Configuration Manager Server feature 	
Configuration Manager site rights:
·	Read	System Center Configuration Manager Integration	
Configuration Manager collection rights: 
·	Create
·	Delete
·	Read
·	Modify
·	Deploy Configuration Items	System Center Configuration Manager Integration	
Configuration Manager configuration item rights: 
·	Create
·	Delete
·	Read	System Center Configuration Manager Integration	
Configuration Manager 2007  
Permissions 	Configuration Manager Server feature 	
Configuration Manager site rights:
·	Read	System Center Configuration Manager Integration	
Configuration Manager collection rights: 

·	Create
·	Delete
·	Read
·	ReadResource	System Center Configuration Manager Integration	
Configuration Manager configuration item rights:
·	Create
·	Delete
·	Read
·	Distribute	System Center Configuration Manager	
Appendix C: Editing MOF files
To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the Configuration.mof file and Sms_def.mof file for System Center 2012 Configuration Manager and Configuration Manager 2007.
Edit the Configuration.mof File
To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to edit the Configuration.mof file, whether you are using System Center 2012 Configuration Manager or Configuration Manager 2007. Complete the following instructions for the version of Configuration Manager that you are using.
To edit the Configuration.mof file for System Center 2012 Configuration Manager
1.	On the Configuration Manager Server, browse to the location of the Configuration.mof file:
CMInstallLocation>\Inboxes\clifiles.src\hinv\
On a default installation, the installation location is %systemdrive%\Program Files \Microsoft Configuration Manager.
2.	Edit the Configuration.mof file to append the following MBAM classes:
Copy
//===================================================
// Microsoft BitLocker Administration and Monitoring 
//===================================================

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) 
[Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled, NoncomplianceDetectedDate, EnforcePolicyDate from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")]
class Win32_BitLockerEncryptionDetails
{
    [PropertySources{"DeviceId"},key]
    String     DeviceId;
    [PropertySources{"BitlockerPersistentVolumeId"}]
    String     BitlockerPersistentVolumeId;
    [PropertySources{"BitLockerManagementPersistentVolumeId"}]
    String     MbamPersistentVolumeId;
    //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3
    [PropertySources{"BitLockerManagementVolumeType"}]
    SInt32     MbamVolumeType;
    [PropertySources{"DriveLetter"}]
    String     DriveLetter;
    //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2
    [PropertySources{"Compliant"}]
    SInt32     Compliant;
    [PropertySources{"ReasonsForNonCompliance"}]
    SInt32     ReasonsForNonCompliance[];
    [PropertySources{"KeyProtectorTypes"}]
    SInt32     KeyProtectorTypes[];
    [PropertySources{"EncryptionMethod"}]
    SInt32     EncryptionMethod;
    [PropertySources{"ConversionStatus"}]
    SInt32     ConversionStatus;
    [PropertySources{"ProtectionStatus"}]
    SInt32     ProtectionStatus;
    [PropertySources{"IsAutoUnlockEnabled"}]
    Boolean     IsAutoUnlockEnabled;
    [PropertySources{"NoncomplianceDetectedDate"}]
    String     NoncomplianceDetectedDate;
    [PropertySources{"EnforcePolicyDate"}]
    String     EnforcePolicyDate;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL)
[DYNPROPS]
Class Win32Reg_MBAMPolicy
{
    [key]
    string KeyName;
    
    //General encryption requirements
    UInt32    OsDriveEncryption;
    UInt32    FixedDataDriveEncryption;
    UInt32    EncryptionMethod;
    
    //Required protectors properties
    UInt32    OsDriveProtector;
    UInt32    FixedDataDriveAutoUnlock;
    UInt32    FixedDataDrivePassphrase;

    //MBAM Agent fields
    Uint32    MBAMPolicyEnforced;
    string    LastConsoleUser;
    datetime  UserExemptionDate;
    UInt32    MBAMMachineError;

    // Encoded Computer Name
    string    EncodedComputerName;
};

[DYNPROPS]
Instance of Win32Reg_MBAMPolicy
{
    KeyName="BitLocker policy";
    
    //General encryption requirements
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")]
    OsDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")]
    EncryptionMethod;
    
    //Required protectors properties
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")]
    OsDriveProtector;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveAutoUnlock;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")]
    FixedDataDrivePassphrase;

    //MBAM agent fields
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")]
    MBAMPolicyEnforced;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")]
    LastConsoleUser;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")]
    UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")]
    MBAMMachineError;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")]
    EncodedComputerName;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL)
[Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"},
dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")]
class CCM_OperatingSystemExtended
{
    [PropertySources{"Name"},key]
    string     Name;
    [PropertySources{"OperatingSystemSKU"}]
    uint32     SKU;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL)
[Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"},
dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")]
class CCM_ComputerSystemExtended
{
    [PropertySources{"Name"},key]
    string     Name;
    [PropertySources{"PCSystemType"}]
    uint16     PCSystemType;
};

//=======================================================
// Microsoft BitLocker Administration and Monitoring end
//=======================================================

To edit the Configuration.mof file for Configuration Manager 2007
1.	On the Configuration Manager Server, browse to the location of the Configuration.mof file:
CMInstallLocation>\Inboxes\clifiles.src\hinv\
On a default installation, the installation location is %systemdrive%\Program Files (x86)\Microsoft Configuration Manager.
2.	Edit the Configuration.mof file to append the following MBAM classes:
Copy
//===================================================
// Microsoft BitLocker Administration and Monitoring 
//===================================================

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL) 
[Union, ViewSources{"select DeviceId, BitlockerPersistentVolumeId, BitLockerManagementPersistentVolumeId, BitLockerManagementVolumeType, DriveLetter, Compliant, ReasonsForNonCompliance, KeyProtectorTypes, EncryptionMethod, ConversionStatus, ProtectionStatus, IsAutoUnlockEnabled, NoncomplianceDetectedDate, EnforcePolicyDate from Mbam_Volume"}, ViewSpaces{"\\\\.\\root\\microsoft\\mbam"}, dynamic, Provider("MS_VIEW_INSTANCE_PROVIDER")]
class Win32_BitLockerEncryptionDetails
{
    [PropertySources{"DeviceId"},key]
    String     DeviceId;
    [PropertySources{"BitlockerPersistentVolumeId"}]
    String     BitlockerPersistentVolumeId;
    [PropertySources{"BitLockerManagementPersistentVolumeId"}]
    String     MbamPersistentVolumeId;
    //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3
    [PropertySources{"BitLockerManagementVolumeType"}]
    SInt32     MbamVolumeType;
    [PropertySources{"DriveLetter"}]
    String     DriveLetter;
    //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2
    [PropertySources{"Compliant"}]
    SInt32     Compliant;
    [PropertySources{"ReasonsForNonCompliance"}]
    SInt32     ReasonsForNonCompliance[];
    [PropertySources{"KeyProtectorTypes"}]
    SInt32     KeyProtectorTypes[];
    [PropertySources{"EncryptionMethod"}]
    SInt32     EncryptionMethod;
    [PropertySources{"ConversionStatus"}]
    SInt32     ConversionStatus;
    [PropertySources{"ProtectionStatus"}]
    SInt32     ProtectionStatus;
    [PropertySources{"IsAutoUnlockEnabled"}]
    Boolean     IsAutoUnlockEnabled;
    [PropertySources{"NoncomplianceDetectedDate"}]
    String     NoncomplianceDetectedDate;
    [PropertySources{"EnforcePolicyDate"}]
    String     EnforcePolicyDate;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL)
[DYNPROPS]
Class Win32Reg_MBAMPolicy
{
    [key]
    string KeyName;
    
    //General encryption requirements
    UInt32    OsDriveEncryption;
    UInt32    FixedDataDriveEncryption;
    UInt32    EncryptionMethod;
    
    //Required protectors properties
    UInt32    OsDriveProtector;
    UInt32    FixedDataDriveAutoUnlock;
    UInt32    FixedDataDrivePassphrase;

    //MBAM Agent fields
    Uint32    MBAMPolicyEnforced;
    string    LastConsoleUser;
    datetime  UserExemptionDate;
    UInt32    MBAMMachineError;

    // Encoded Computer Name
    string    EncodedComputerName;
};

[DYNPROPS]
Instance of Win32Reg_MBAMPolicy
{
    KeyName="BitLocker policy";
    
    //General encryption requirements
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")]
    OsDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")]
    EncryptionMethod;
    
    //Required protectors properties
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")]
    OsDriveProtector;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveAutoUnlock;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")]
    FixedDataDrivePassphrase;

    //MBAM agent fields
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")]
    MBAMPolicyEnforced;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")]
    LastConsoleUser;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")]
    UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")]
    MBAMMachineError;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")]
    EncodedComputerName;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL)
[DYNPROPS]
Class Win32Reg_MBAMPolicy_64
{
    [key]
    string KeyName;
    
    //General encryption requirements
    UInt32    OsDriveEncryption;
    UInt32    FixedDataDriveEncryption;
    UInt32    EncryptionMethod;
    
    //Required protectors properties
    UInt32    OsDriveProtector;
    UInt32    FixedDataDriveAutoUnlock;
    UInt32    FixedDataDrivePassphrase;

    //MBAM Agent fields
    Uint32    MBAMPolicyEnforced;
    string    LastConsoleUser;
    datetime  UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU
    UInt32    MBAMMachineError;

    // Encoded Computer Name
    string    EncodedComputerName;
};

[DYNPROPS]
Instance of Win32Reg_MBAMPolicy_64
{
    KeyName="BitLocker policy";
    
    //General encryption requirements
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptOsDrive"),Dynamic,Provider("RegPropProv")]
    OsDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|ShouldEncryptFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveEncryption;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|EncryptionMethod"),Dynamic,Provider("RegPropProv")]
    EncryptionMethod;
    
    //Required protectors properties
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|OSVolumeProtectorPolicy"),Dynamic,Provider("RegPropProv")]
    OsDriveProtector;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE\\MDOPBitLockerManagement|AutoUnlockFixedDataDrive"),Dynamic,Provider("RegPropProv")]
    FixedDataDriveAutoUnlock;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\FVE|FDVPassphrase"),Dynamic,Provider("RegPropProv")]
    FixedDataDrivePassphrase;

    //MBAM agent fields
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMPolicyEnforced"),Dynamic,Provider("RegPropProv")]
    MBAMPolicyEnforced;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|LastConsoleUser"),Dynamic,Provider("RegPropProv")]
    LastConsoleUser;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|UserExemptionDate"),Dynamic,Provider("RegPropProv")]
    UserExemptionDate; //Registry value should be string in the format of yyyymmddHHMMSS.mmmmmmsUUU
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|MBAMMachineError"),Dynamic,Provider("RegPropProv")]
    MBAMMachineError;
    [PropertyContext("Local|HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\MBAM|EncodedComputerName"),Dynamic,Provider("RegPropProv")]
    EncodedComputerName;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL)
[Union, ViewSources{"select Name,OperatingSystemSKU from Win32_OperatingSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"},
dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")]
class CCM_OperatingSystemExtended
{
    [PropertySources{"Name"},key]
    string     Name;
    [PropertySources{"OperatingSystemSKU"}]
    uint32     SKU;
};

#pragma namespace ("\\\\.\\root\\cimv2")
#pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL)
[Union, ViewSources{"select Name,PCSystemType from Win32_ComputerSystem"}, ViewSpaces{"\\\\.\\root\\cimv2"},
dynamic,Provider("MS_VIEW_INSTANCE_PROVIDER")]
class CCM_ComputerSystemExtended
{
    [PropertySources{"Name"},key]
    string     Name;
    [PropertySources{"PCSystemType"}]
    uint16     PCSystemType;
};

//=======================================================
// Microsoft BitLocker Administration and Monitoring end
//=======================================================

Create or Edit the Sms_def.mof File
To enable the client computers to report BitLocker compliance details through the MBAM Configuration Manager reports, you have to create or edit the Sms_def.mof file.
If you are using System Center 2012 Configuration Manager, you must create the file. Create the file on the top-tier site. The changes will be replicated to the other sites in your infrastructure.
In Configuration Manager 2007, the file already exists, so you only have to edit it. Do not overwrite the existing file.
In the following sections, complete the instructions that correspond to the version of Configuration Manager that you are using.
To create the Sms_def.mof file for System Center 2012 Configuration Manager
1.	On the Configuration Manager Server, browse to the location where you have to create the Sms_def.mof file, for example, the Desktop.
2.	Create a text file called Sms_def.mof and copy the following code to populate the file with the following Sms_def.mof MBAM classes:
Copy
//===================================================
// Microsoft BitLocker Administration and Monitoring 
//===================================================

#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL)
[ SMS_Report (TRUE),
  SMS_Group_Name ("BitLocker Encryption Details"),
  SMS_Class_ID ("MICROSOFT|BITLOCKER_DETAILS|1.0")]
class Win32_BitLockerEncryptionDetails : SMS_Class_Template
{
    [ SMS_Report (TRUE), key ]
    String     DeviceId;
    [ SMS_Report (TRUE) ]
    String     BitlockerPersistentVolumeId;
    [ SMS_Report (TRUE) ]
    String     MbamPersistentVolumeId;
    [ SMS_Report (TRUE) ]
    //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3
    SInt32     MbamVolumeType;
    [ SMS_Report (TRUE) ]
    String     DriveLetter;
    [ SMS_Report (TRUE) ]
    //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2
    SInt32     Compliant;
    [ SMS_Report (TRUE) ]
    SInt32     ReasonsForNonCompliance[];
    [ SMS_Report (TRUE) ]
    SInt32     KeyProtectorTypes[];
    [ SMS_Report (TRUE) ]
    SInt32     EncryptionMethod;
    [ SMS_Report (TRUE) ]
    SInt32     ConversionStatus;
    [ SMS_Report (TRUE) ]
    SInt32     ProtectionStatus;
    [ SMS_Report (TRUE) ]
    Boolean     IsAutoUnlockEnabled;
    [ SMS_Report (TRUE) ]
    String     NoncomplianceDetectedDate;
    [ SMS_Report (TRUE) ]
    String     EnforcePolicyDate;
};

#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL)
[ SMS_Report(TRUE),
  SMS_Group_Name("BitLocker Policy"),
  SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0")]
Class Win32Reg_MBAMPolicy: SMS_Class_Template
{
    [SMS_Report(TRUE),key]
    string KeyName;
    
    //General encryption requirements
    [SMS_Report(TRUE)]
    UInt32    OsDriveEncryption;
    [ SMS_Report (TRUE) ]
    UInt32    FixedDataDriveEncryption;
    [ SMS_Report (TRUE) ]
    UInt32    EncryptionMethod;

    //Required protectors properties
    [ SMS_Report (TRUE) ]
    UInt32    OsDriveProtector;
    [ SMS_Report (TRUE) ]
    UInt32    FixedDataDriveAutoUnlock;
    [ SMS_Report (TRUE) ]
    UInt32    FixedDataDrivePassphrase;
    
    //MBAM Agent fields
    //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3)
    [SMS_Report(TRUE)]
    Uint32    MBAMPolicyEnforced;
    [SMS_Report(TRUE)]
    string    LastConsoleUser; 
    //Date of the exemption request of the last logged on user,
    //or the first date the exemption was granted to him on this machine.
    [SMS_Report(TRUE)]
    datetime  UserExemptionDate;
    //Errors encountered by MBAM agent.
    [ SMS_Report (TRUE) ]
    UInt32    MBAMMachineError;
    [ SMS_Report (TRUE) ]
    string    EncodedComputerName;
};

//Read Win32_OperatingSystem.SKU WMI property in a new class - because SKU is not available before Vista.
#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL)
[ SMS_Report     (TRUE),
  SMS_Group_Name ("Operating System Ex"),
  SMS_Class_ID   ("MICROSOFT|OPERATING_SYSTEM_EXT|1.0") ]
class CCM_OperatingSystemExtended : SMS_Class_Template
{
    [SMS_Report (TRUE), key ]
        string     Name;
    [SMS_Report (TRUE) ]
        uint32     SKU;
};

//Read Win32_ComputerSystem.PCSystemType WMI property in a new class - because PCSystemType is not available before Vista.
#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL)
[ SMS_Report     (TRUE),
  SMS_Group_Name ("Computer System Ex"),
  SMS_Class_ID   ("MICROSOFT|COMPUTER_SYSTEM_EXT|1.0") ]
class CCM_ComputerSystemExtended : SMS_Class_Template
{
    [SMS_Report (TRUE), key ]
    string     Name;
    [SMS_Report (TRUE) ]
    uint16     PCSystemType;
};

//=======================================================
// Microsoft BitLocker Administration and Monitoring end
//=======================================================
1.	Import the Sms_def.mof file by doing the following:
a.	Open the System Center 2012 Configuration Manager console and select the Administration tab.
b.	On the Administration tab, select Client Settings.
c.	Right-click Default Client Settings and then select Properties.
d.	In the Default Settings window, select Hardware Inventory.
e.	Click Set Classes, and then click Import.
f.	In the browser that opens, select .mof file, and click Open. The Import Summary window opens.
g.	In the Import Summary window, ensure that the option to import both hardware inventory classes and class settings is selected, and then click Import.
h.	In both the Hardware Inventory Classes window and the Default Settings window, click OK.
2.	Enable the Win32_Tpm class as follows:
a.	Open the System Center 2012 Configuration Manager console and select the Administration tab.
b.	On the Administration tab, select Client Settings.
c.	Right-click Default Client Settings and then select Properties.
d.	In the Default Settings window, select Hardware Inventory.
e.	Click Set Classes.
f.	In the main window, scroll down, and then select the TPM (Win32_Tpm) class.
g.	Under TPM, ensure that the SpecVersion property is selected.
h.	In both the Hardware Inventory Classes window and the Default Settings window, click OK.
To edit the sms_def.mof file for Configuration Manager 2007
1.	On the Configuration Manager Server, browse to the location of the sms_def.mof file: CMInstallLocation>\Inboxes\clifiles.src\hinv\
On a default installation, the installation location is %systemdrive% \Program Files (x86)\Microsoft Configuration Manager.
2.	Copy the following code, and then append it to Sms_def.mof file to add the following required MBAM classes to the file:
Copy
//===================================================
// Microsoft BitLocker Administration and Monitoring 
//===================================================

#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("Win32_BitLockerEncryptionDetails", NOFAIL)
[ SMS_Report (TRUE),
  SMS_Group_Name ("BitLocker Encryption Details"),
  SMS_Class_ID ("MICROSOFT|BITLOCKER_DETAILS|1.0")]
class Win32_BitLockerEncryptionDetails : SMS_Class_Template
{
    [ SMS_Report (TRUE), key ]
    String     DeviceId;
    [ SMS_Report (TRUE) ]
    String     BitlockerPersistentVolumeId;
    [ SMS_Report (TRUE) ]
    String     MbamPersistentVolumeId;
    [ SMS_Report (TRUE) ]
    //UNKNOWN = 0, OS_Volume = 1, FIXED_VOLUME = 2, REMOVABLE_VOLUME = 3
    SInt32     MbamVolumeType;
    [ SMS_Report (TRUE) ]
    String     DriveLetter;
    [ SMS_Report (TRUE) ]
    //VOLUME_NOT_COMPLIANT = 0, VOLUME_COMPLIANT = 1, NOT_APPLICABLE = 2
    SInt32     Compliant;
    [ SMS_Report (TRUE) ]
    SInt32     ReasonsForNonCompliance[];
    [ SMS_Report (TRUE) ]
    SInt32     KeyProtectorTypes[];
    [ SMS_Report (TRUE) ]
    SInt32     EncryptionMethod;
    [ SMS_Report (TRUE) ]
    SInt32     ConversionStatus;
    [ SMS_Report (TRUE) ]
    SInt32     ProtectionStatus;
    [ SMS_Report (TRUE) ]
    Boolean     IsAutoUnlockEnabled;
    [ SMS_Report (TRUE) ]
    String     NoncomplianceDetectedDate;
    [ SMS_Report (TRUE) ]
    String     EnforcePolicyDate;
};

#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("Win32Reg_MBAMPolicy", NOFAIL)
[ SMS_Report(TRUE),
  SMS_Group_Name("BitLocker Policy"),
  SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0"),
  SMS_Context_1("__ProviderArchitecture=32|uint32"),
  SMS_Context_2("__RequiredArchitecture=true|boolean")]
Class Win32Reg_MBAMPolicy: SMS_Class_Template
{
    [SMS_Report(TRUE),key]
    string KeyName;
    
    //General encryption requirements
    [SMS_Report(TRUE)]
    UInt32    OsDriveEncryption;
    [ SMS_Report (TRUE) ]
    UInt32    FixedDataDriveEncryption;
    [ SMS_Report (TRUE) ]
    UInt32    EncryptionMethod;

    //Required protectors properties
    [ SMS_Report (TRUE) ]
    UInt32    OsDriveProtector;
    [ SMS_Report (TRUE) ]
    UInt32    FixedDataDriveAutoUnlock;
    [ SMS_Report (TRUE) ]
    UInt32    FixedDataDrivePassphrase;
    
    //MBAM Agent fields
    //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3)
    [SMS_Report(TRUE)]
    Uint32    MBAMPolicyEnforced;
    [SMS_Report(TRUE)]
    string    LastConsoleUser; 
    //Date of the exemption request of the last logged on user,
    //or the first date the exemption was granted to him on this machine.
    [SMS_Report(TRUE)]
    datetime  UserExemptionDate;
    //Errors encountered by MBAM agent.
    [ SMS_Report (TRUE) ]
    UInt32    MBAMMachineError;
    // Encoded Computer Name
    [ SMS_Report (TRUE) ]
    string    EncodedComputerName;
};

#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("Win32Reg_MBAMPolicy_64", NOFAIL)
[ SMS_Report(TRUE),
  SMS_Group_Name("BitLocker Policy"),
  SMS_Class_ID("MICROSOFT|MBAM_POLICY|1.0"),
  SMS_Context_1("__ProviderArchitecture=64|uint32"),
  SMS_Context_2("__RequiredArchitecture=true|boolean")]
Class Win32Reg_MBAMPolicy_64: SMS_Class_Template
{
    [SMS_Report(TRUE),key]
    string KeyName;
    
    //General encryption requirements
    [SMS_Report(TRUE)]
    UInt32    OsDriveEncryption;
    [ SMS_Report (TRUE) ]
    UInt32    FixedDataDriveEncryption;
    [ SMS_Report (TRUE) ]
    UInt32    EncryptionMethod;

    //Required protectors properties
    [ SMS_Report (TRUE) ]
    UInt32    OsDriveProtector;
    [ SMS_Report (TRUE) ]
    UInt32    FixedDataDriveAutoUnlock;
    [ SMS_Report (TRUE) ]
    UInt32    FixedDataDrivePassphrase;
    
    //MBAM Agent fields
    //Policy not enforced (0), enforced (1), pending user exemption request (2) or exempted user (3)
    [SMS_Report(TRUE)]
    Uint32    MBAMPolicyEnforced;
    [SMS_Report(TRUE)]
    string    LastConsoleUser; 
    //Date of the exemption request of the last logged on user,
    //or the first date the exemption was granted to him on this machine.
    [SMS_Report(TRUE)]
    datetime  UserExemptionDate;
    //Errors encountered by MBAM agent.
    [ SMS_Report (TRUE) ]
    UInt32    MBAMMachineError;
    // Encoded Computer Name
    [ SMS_Report (TRUE) ]
    string    EncodedComputerName;
};

//Read Win32_OperatingSystem.SKU WMI property in a new class - because SKU is not available before Vista.
#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("CCM_OperatingSystemExtended", NOFAIL)
[ SMS_Report     (TRUE),
  SMS_Group_Name ("Operating System Ex"),
  SMS_Class_ID   ("MICROSOFT|OPERATING_SYSTEM_EXT|1.0") ]
class CCM_OperatingSystemExtended : SMS_Class_Template
{
    [SMS_Report (TRUE), key ]
        string     Name;
    [SMS_Report (TRUE) ]
        uint32     SKU;
};

//Read Win32_ComputerSystem.PCSystemType WMI property in a new class - because PCSystemType is not available before Vista.
#pragma namespace ("\\\\.\\root\\cimv2\\SMS")
#pragma deleteclass("CCM_ComputerSystemExtended", NOFAIL)
[ SMS_Report     (TRUE),
  SMS_Group_Name ("Computer System Ex"),
  SMS_Class_ID   ("MICROSOFT|COMPUTER_SYSTEM_EXT|1.0") ]
class CCM_ComputerSystemExtended : SMS_Class_Template
{
    [SMS_Report (TRUE), key ]
    string     Name;
    [SMS_Report (TRUE) ]
    uint16     PCSystemType;
};

//=======================================================
// Microsoft BitLocker Administration and Monitoring end
//=======================================================
3.	Modify the Win32_Tpm class as follows:
o	Set SMS_REPORT to TRUE in the class attributes.
o	Set SMS_REPORT to TRUE in the SpecVersion property attribute.