Dogfood: Require BitLocker PIN

[rachaelshaw]

Related user story

• Require BitLocker PIN #28133

[allenhouchins]

The option to "Enforce a PIN (recommended)" is not available at Step 3. The user has to first click "Change how the drive is unlocked at startup". If this option doesn't show up, the user should wait a minute and relaunch Manage BitLocker. After clicking "Change how the drive is unlocked at startup", the option to "Enforce a PIN (recommended)" will be available.

Everything else works as expected. One question that could use some clarity, what happens if the user forgets their PIN? It doesn't look like the PIN is escrowed in any way.

[allenhouchins]

@noahtalerman FYI ^^

[noahtalerman]

The user has to first click "Change how the drive is unlocked at startup". If this option doesn't show up, the user should wait a minute and relaunch Manage BitLocker. After clicking "Change how the drive is unlocked at startup", the option to "Enforce a PIN (recommended)" will be available.

Thanks @allenhouchins!

@rachaelshaw sounds like we have some copy updates to make. Can you please track a follow up user story for this? And bring it in to the current sprint please. While it's still fresh.

One question that could use some clarity, what happens if the user forgets their PIN? It doesn't look like the PIN is escrowed in any way.

My current understanding is the PIN is like another local password. I think it's not escrowed in any other MDM solutions.

Like when the end user forgets their local password, the disk encryption recovery key is used if the user forgets their PIN. End user lets IT know. IT gives walks them through disk encryption recovery key.

@rachaelshaw is this^ covered in a guide? If not, I think we want it to be.

This raised another question...what's the best practice for creating a new PIN after you forgetting the old one and using the recovery key?

[lukeheath]

@rachaelshaw Reminder ^

[rachaelshaw]

Story here: #33726