Bitlocker and FDE Decryption issue.

Sorry Nam - I've confused?

You've created an encryption policy and the PC has encrypted as expected?

What are you now trying to achieve? Prevent decryption?

What OS is the client please?

You've created an encryption policy and the PC has encrypted as expected?

Pc is encrypted, but when i am doing decrption system again start automatic encryption..how can resolve this?

Thanks Nam - Understood.

You have applied a policy to the machine that encrypts the machine - This is working well. You try to decrypt the machine and the machine starts decrypting and then encrypts again - This is also working well!

The policy the machine is running is preventing decryption (and potentially uninstallation too) and that is why is it encrypting again. This is the way you'd want it to be honest - otherwise your users will just decrypt your machine.

What is best to do is create a decryption group on the SSG console.

You then create a policy that allows decryption.

You then add the PC to this group.

You resync the client.

You should now be able to decrypt the machine now it has the correct policy.

This guide will help you complete this - It's a little out of date (v7) but it's still roughly the same in v8x.

https://sophserv.sophos.com/repo_kb/108411/file/108411-Decrypting%20a%20SafeGuard%20Enterprise%20client.pdf

Thanks. This is helpful. I will check and update the same.

You're very welcome - good luck!