SafeGuard Encryption (Bit-Locker) 10.7.3 VE3.69.2 locking out keyboard on boot

Question

Hi everyone. Question we recently rolled out Sophos encryption to a small group (40 laptops). Model Lenovo Yoga 260 running Windows 10, the roll out seemed smooth at first but over a day or so users started calling saying that the keyboard on the laptop was locked out not allowing the PIN digits entry. We've tried several tricks such as press shift + 8 / enter upon the Lenovo splash screen / flipping to tablet mode then back / quick fix is plugging in an external usb keyboard or keypad. I would like to take advantage of the 'startup authentication' but under these circumstances I had to disable this feature and use the 'only used files encryption' . Anyone else experience this or is there another string of communications I missed? Thanks

This thread was automatically locked due to age.

Haridoss Sreenivasan · Answer

Hi Fred, 
 When starting an endpoint, some default hardware settings can lead to issues and potentially cause a system to hang or cause peripherals to stop working. The Power-on Authentication (POA) supports a number of hotkeys to change these settings. Please refer to the following articles: 
 1. SafeGuard Device Encryption: Hotkeys and the POA 
 2. SafeGuard Enterprise administrator help ( check the topic Supported Hotkeys in the SafeGuard Power-on Authentication ) 
 Let me know if this helps resolve your query.

MichaelMcLannahan · Answer

Hi Fred - I'm afraid it'll not remove the PIN. Sophos has applied the policy and in my experience it can't reverse that! 
 
 You'll need to... 
 
 Make sure you get the "correct" policy - TPM only. 
 Log onto the PC with local Admin rights. 
 Launch an ADMIN command prompt (assuming your HDD is C:) 
 Check what's been applied by Sophos first - (assuming your HDD is C...) 
 manage-bde -status c: 
 Note Key Protectors at bottom - You should see TPM+PIN 
 Then type - 
 manage-bde -protectors -add C: -tpm 
 This will remove the TPM+PIN and replace it with TPM only. 
 
 It's a bit of hassle but only takes a few mins each one. 
 
 Edit to add - If you do this prior to the correct "new" policy being applied you'll be able to remove the PIN but the same old policy will then reapply at client resync and you'll be forced to set a PIN again! 
 
 Hope this helps?