Windows 10: Bitlocker Device Encryption enabled after imaging

I am trying to create a Windows 10 image for my organization, and cannot figure out one particular issue with Bitlocker. It seems that after I sysprep, and throw the image on a new computer, it then has BitLocker partially enabled. What I mean is that when going to the About page in System in the settings it shows in red "You need a Microsoft account to finish encrypting this device". The C: drive also shows an opened lock with a warning icon (exclamation point in a triangle).

When going to the Manage Bitlocker page is shows an option to turn on bitlocker. Searching various sites on google has led me to the idea of turning on bitlocker, then turning it off again before sysprep. This does in fact disable BitLocker, however it appears to turn on again after imaging on a new computer.

While it's not a huge pain to disable BitLocker afterwards it does take several minutes to decrypt and multiplied that by many computers does eat up a bit of time in the end. Is there something I'm missing here to make sure BitLocker remains disabled after imaging? These are generally on Microsoft Surface Pro 4 computers that this happens on, it did not do the same thing on an HP laptop I tested.

:)

 

Lumia 920 Encryption

I know with WP8, encryption is pretty much built throughout the device from secure boot, sandboxed encrypted apps and data encryption is supported, but, enabled by EAS or via a MDM policy.. Not sure if there is a way the user can toggle this feature or not.



This is from the Windows Phone 8 Security Whitepaper:



Device encryption

To help keep everything from documents to passwords safe, Windows Phone 8
6 encrypts the internal storage of the device, including the operating system and

data partitions. Device encryption is enabled by EAS or device management policy.

Device encryption in Windows Phone 8 uses BitLocker technology to encrypt all internal data storage on the phone. Once enabled, BitLocker conversion automatically starts encrypting the internal storage. With both PIN-lock and BitLocker enabled, the
combination of data encryption and device lock would make it extremely difficult for an attacker to recover sensitive information from a device.

 

Windows 10 Pro deployment using WDS and eDrive

I'm deploying Windows 10 PC's using WDS and want to make use of eDrive. The SSD installed in the PC supports hardware encryption. When I deploy a Windows 10 Pro image to a system and then turn on BitLocker it uses software encryption.

If I take that same system install Windows 10 Pro using a CD turn on BitLocker it uses Hardware encryption. Again on the same PC I deploy Windows 10 Pro using WDS enable BitLocker it uses hardware encryption.

To do this across a number of devices is time consuming and defeats the point of WDS.

Any suggestions?