Safeguard on windows 10?

Question

I'm not sure why this is so complicated. 
 
 I'm just trying to install Safeguard on windows 10. We have Safeguard Management Center 8.00.2.13 and client version is 8.00.0.251 
 I had a windows 7 machine with safeguard, I uninstalled safeguard/decrypted the drive first and then upgraded my windows to 10. 
 After installing windows 10, I enabled bitlocker first and then installed safeguard. 
 This is what I have installed. 
 Sophos Safeguard Client 8.00.0.251 
 Sophos Safeguard Client Configuration 8.00.0.280 
 Sophos Safeguard Preinstall 8.00.0.251 
 I can sync with the server just fine but the drive is not encrypting. I read somewhere that bitlocker must be enabled in order to install safeguard which is what I did but its still not encrypting the drive. Under the management center, under computer Encrypted drives number read 0. 
 What steps am I missing?

sabdul · Answer

Michael, 
 Thank you for your help. I finally figured out the god damn issue. It was the parameters I was using which were not installing the bitlocker support feature when the client was installed. 
 So Windows 7, I was using SGNClient_x64.msi /passive /norestart ADDLOCAL=Client,CredentialProvider,BaseEncryption,SectorBasedEncryption /norestart which worked fine for windows 7, 
 However I needed to add BitLockerSupport,BitLockerSupportCR to the script to install the feature in. Or the other way is from program and feature, modify safeguard client and check the boxes for Bitlocker 
 
 So the script is now SGNClient_x64.msi /passive /norestart ADDLOCAL=Client,CredentialProvider,BaseEncryption, BitLockerSupport,BitLockerSupportCR ,SectorBasedEncryption /norestart 
 For anyone looking here is the list of all the parameters 
 https://community.sophos.com/kb/en-us/108426 
 
 Thank you again for all your help. I can't believe it ended up being something so stupid!

MichaelMcLannahan · Answer

Yes - Sadly it would as you now know, if Win7 wasn't set up to use BL! :) 
 
 That's set in the policy. It won't remove that option from appearing but as they try to decrypt it will do about 0.1% and then encrypt again! 
 
 I also have my policy to prevent the removal of the client AND decryption. Then create a group for your admin purposes if you do want to remove or decrypt a PC. I've a post here on this if you want some help there. 
 https://community.sophos.com/products/safeguard-encryption/f/sophos-safeguard-products/90787/uninstallation-is-not-possible-because-a-policy-does-not-allow-it-error-25200 
 
 So to prevent decryption (by the user) modify your device protection policy here...

And to prevent them uninstalling the client it's here under machine settings!

Hope that helps? 
 
 All the best