Inconsistent behaviour when setting BitLocker PIN as required

[GrayW]

Fleet version: 4.76.1 (customer-deebradel) | 4.77.0 (@GrayW Render)

---

💥  Actual behavior

When enabling Require BitLocker PIN under Disk Encryption advanced options, hosts do not behave as expected.

Behaviour 1: (deebradel and grayw)

• Some hosts do not receive the configuration profile to enforce the PIN settings despite meeting the TPM requirements and the disk being 100% encrypted
• The banner in self-service is present with instructions on how to set the PIN
• There is no option to Change how the drive is unlocked at startup

Behaviour 2: (deebradel only)

• Some hosts receive the configuration profile
• The banner in self-service is present
• There is an option to Change how the drive is unlocked at startup
• There is no option to set a PIN
• deviceenroller.exe is repeatedly attempting to set the registry value to 2 (optional), rather than 1 (required)

🛠️ To fix

TODO

🧑‍💻  Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Enable Require BitLocker PIN for a Team
2. Sync host with Fleet

🕯️ More info (optional)

So far, this issue has only been reported by customer-deebradel. But, it is also showing inconsistencies on my test instance.

These issues were present and tested on Windows devices that had only ever enrolled to Fleet, and no other MDM services. All were clean installations. A mixture of physical and virtual machines.

• BitLocker CSP
• bitlocker_csp.go

[Sampfluger88]

Linked to Unthread ticket:

Inquiry about Bitlocker PIN solution functionality and prerequisites #10793

[JordanMontgomery]

Timeboxing this at a 3 to try to understand and if simple, implement a fix. If not simple the engineer should come back with enough information to try to help us estimate this further.

See here for possible repro steps for scenario 2 #38304

[Sampfluger88]

Linked to Unthread ticket:

Multiple users experiencing recurring issue #11518