SafeGuard Bitlocker - Disable Postpone option

Question

Hi, 
 
 I'm currently deplying SafeGuard client and a bitlocker policy in our company and i have a question regarding the password selection screen. 
 Standard it shows a postpone option, and about 25% of our users think its funny to keep clicking it, so they never have to choose a password, and thus keep bitlocker disabled. 
 
 I was wondering there is a built in option to disable the postpone button, or to keep popping up the windows every hour, to annoy users a bit so they have to set a password for the window to disappear. One notice after every reboot is not sufficient, as many users put their laptop in sleep/hibernate.

Jef Schoors · Accepted Answer

I have come up with a solution that i will post here for other people in similar situation. 
 
 I have created a startup powershell script wich will automaticly enable bitlocker after a specified deadline expires. The generated password is displayed in a popup and allso mailed to support. When using this method safeguard still prompts to choose another password after the automaticly generated one is set by the script, wich gives users the opportunity to still choose their own password after the auto generated one is set. 
 I think this is the most effective and least intrusive way to get companywide bitlocker activation. Still awaiting manager approval to use this though :). So in case i cant use it, i hope someone else taht finds this usefull can ;) 
 Script code is as follows: 
 
 Import-Module BitLocker; Get-BitlockerVolume $wmiDomain = Get-WmiObject Win32_NTDomain -Filter "DnsForestName = '$( (Get-WmiObject Win32_ComputerSystem).Domain)'" $domain = $wmiDomain.DomainName $OutputVariable = (Get-BitlockerVolume -MountPoint "C:") $SupportEmailAddress = "support@mycompany.com" #Deadline Date in YYYYMMDD $DeadLine = "20190415" $EmailAddress = $SupportEmailAddress 
 #Force Encryption on FullyDecrypted volumes If ($OutputVariable.volumestatus -Like "FullyDecrypted") { $date = Get-Date $datestr = $Date.ToString("yyyyMMdd") #Compare Current date to deadline #Deadline expired, force encryption if($datestr -gt $DeadLine){ #Generate Password $Password = Get-Random -Minimum 100000000000 -Maximum 999999999999 
 #Activate Bitlocker $SecureString = ConvertTo-SecureString $Password -AsPlainText -Force Enable-BitLocker -MountPoint "C:" -EncryptionMethod aes256 -UsedSpaceOnly -PasswordProtector -Password $SecureString 
 #Define/Send E-mail Message to support $email_subject = "Bitlocker activatie / wachtwoord voor $env:COMPUTERNAME" $email_body = "Bitlocker al enige tijd niet actief op $domain $env:COMPUTERNAME getest op $date, automatische encryptie is gestart. Het wachtwoord is $Password . Gelieve dit door te geven naar de gebruiker indien deze u hiervoor contacteerd. De gebruiker kan dan nadat hij/zij aangemeld heeft in windows zelf een nieuw wachtwoord kiezen ....." send-mailmessage -from "SafeGuard Status monitor <SafeGuard@yourcompany.com>" -to $EmailAddress -subject $email_subject -body $email_body -priority High -dno onSuccess, onFailure -smtpServer YOURCOMPANYMAILSERVER 
 #Set Messagebox Text [String[]]$Msg = @() $Msg += 'De wachttijd voor het zelf activeren van bitlocker is verstreken.' $Msg += 'Bitlocker is nu automatisch geactiveerd... ' $Msg += '' $Msg += 'Uw wachtwoord is: ' + $Password $Msg += '' $Msg += 'NOTEER DIT AUB, Uw wachtwoord is ook naar de Helpdesk gemaild.' $Msg += '' $Msg += 'Uw Computer zal binnen 3 minuten herstarten. Gebruik dan bovenstaande code om de schijf te ontsleutelen.' $Msg += 'Na het herstarten en aanmelden in windows kan u dan zelf een nieuw wachtwoord instellen.' [String]$MsgTxt = '' $Msg | ForEach-Object { $MsgTxt += $_ + "`n" } Add-Type -AssemblyName System.Windows.Forms [System.Windows.Forms.MessageBox]::Show($MsgTxt, 'Bitlocker activatie', 'OK', 'Information') | Out-Null } else{ #Deadline not reached yet, Display warning #Set Messagebox Text [String[]]$Msg = @() $Msg += 'Bitlocker is nog niet geactiveerd op uw computer.' $Msg += 'Gelieve voor 15/04/2019 een wachtwoord in te stellen' $Msg += '' $Msg += 'Na deze datum wordt Bitlocker automatisch geactiveerd en wordt er automatisch een wachtwoord gekozen.' $Msg += '' [String]$MsgTxt = '' $Msg | ForEach-Object { $MsgTxt += $_ + "`n" } Add-Type -AssemblyName System.Windows.Forms [System.Windows.Forms.MessageBox]::Show($MsgTxt, "Bitlocker activatie $env:COMPUTERNAME", 'OK', 'Information') | Out-Null 
 } 
 } Exit