Windows 10: Enable defender alerts for disabling bitlocker?

I have been trying to get this alert configured for any time bitlocker is disabled on a device in our environment, but when I try to find anything related to bitlocker in Advanced Hunting, I don't get all the devices where it is enabled. I even tested the device timeline and found a bunch of powershell activations, but nothing specifically points to bitlocker. There is no name in the log showing bitlocker. If anyone can assist that would be much appreciated.

:)

 

Bitlocker Randomly Enabled

Hi,

On my personal Lenovo laptop, Bitlocker somehow randomly was enabled. I have not enabled it, and I followed the recovery steps without luck. It seems that it was enabled during an update. I logged into my Microsoft account, see that the laptop is listed, but there is no bitlocker key listed. I am at a loss on what the next steps might be for me to be able to log into my computer at this point.

Carl

 

BitLocker won't enable on Windows 10 after update on Aug 9

Hi Brenda,

I would be happy to assist you.

Before I assist you I would like to know the information below,

• 
  Do you have a Windows 10 copy of the operating system?
  

I suggest you check whether the Bit locker is ON or OFF using the steps below.

Can you verify if BitLocker is enabled or disabled on your device? You can Enable/disable BitLocker by going to Desktop and follow these steps:

• 
  Swipe Right to Left to bring up the Charm.
  
• 
  Choose Settings.
  
• 
  Choose Control Panel.
  
• 
  Select BitLocker Drive Encryption.
  
• 
  Verify whether BitLocker is on or off on each device.
  

Also I suggest you to enable the WinRE so that you can enter the bit locker key and proceed.

When WinRE is disabled, you cannot enable BitLocker, and you receive an error message that resembles the following.

This PC doesn't support entering a BitLocker recovery password during startup. Ask your administrator to configure Windows Recovery Environment so that you can use BitLocker.

The solution would be to manually enable the windows recovery environment:

• 
  Copying the winre.wim file from c:\windows\system32\recovery\ to a folder on a recovery partition. (The partition need to have a drive letter at this point.)
  
• 
  Set the RE Image path. Example: reagentc /setreimage /path r:\recovery\windowsre
  
• 
  Enable RE with command: reagentc /enable
  
• 
  (You may remove the drive letter for the recovery partition after you have done this.)
  
• 
  Bit locker will be enabled.
  

If the issue still persists, suggest you to post your query on the below link.

https://technet.microsoft.com/en-us/library/hh831507(v=ws.11).aspx

Hope this information was helpful and do let us know if you need further assistance. We will be glad to assist.

Thank you.

 

Disabling Avira

Muchomurka - your Windows Defender suggestion sounded promising to me. I found three AVIRA entries listed in Inbound Rules in Advanced Security, whose ENABLED status I could change to DISABLED. I can but hope that that does the job.

Incidentally it has alerted me to the possibility of disabling the numerous other entries that are irrelevant to me, but presumably consuming resources.