> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.trugrid.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Deploying TruGrid BitLocker IoT Agent via GPO

# Deploying TruGrid BitLocker IoT Agent via GPO

Please follow the steps outlined below to deploy the TruGrid BitLocker Device Management (IoT) Agent to your domain-joined Windows endpoints using a Group Policy startup script. This allows you to enroll many machines at once, instead of running the installer on each computer.
Note for Administrators: This guide is intended for IT Administrators or Service Providers. If you are a non-technical user, please contact your IT department or service provider for assistance.
Please follow this [link](https://help.trugrid.com/en/article/how-to-use-trugrid-bitlocker-device-management-video-fy5bd8/) if you prefer to watch a video overview of TruGrid BitLocker Management. If you only need to install the agent on a single machine, or your deployment tool accepts a command line, please see this [article](https://help.trugrid.com/en/article/trugrid-bitlocker-command-for-silent-installation-14bqmzr/) instead.

### In this article

[Requirements](#3-requirements)
[Remove any existing BitLocker policy](#3-remove-any-existing-bitlocker-policy)
[Download the Enrollment File](#3-download-the-enrollment-file)
[Create the deployment share](#3-create-the-deployment-share)
[Create the Group Policy Object](#3-create-the-group-policy-object)
[Verify the installation](#3-verify-the-installation)
[Turn on encryption](#3-turn-on-encryption)
[Troubleshooting](#3-troubleshooting)

### Requirements

An Active Directory domain, and access to Group Policy Management on a domain controller
Windows endpoints joined to that domain, each with a TPM chip
Microsoft .NET Framework 4.7.1 or later on each endpoint. Please see this article for the full list of dependencies
Your TruGrid Device Management Enrollment File for the customer domain
| Please note that endpoints enrolled for BitLocker Management do not need to be AD-joined. Active Directory is only required for this particular deployment method.

### Remove any existing BitLocker policy

TruGrid manages BitLocker directly through the agent. Any BitLocker setting delivered by Group Policy will compete with the agent and should be removed from the endpoints you intend to enroll.
1\. On one of your endpoints, open an elevated **Command Prompt** and run:
```
gpresult /r /scope:computer
```
2\. Review the policies listed under **Applied Group Policy Objects**.
3\. Check whether BitLocker settings are already applied to the endpoint:
```
reg query HKLM\SOFTWARE\Policies\Microsoft\FVE
```
4\. If that key exists, open **Group Policy Management** (gpmc.msc) and inspect each applied policy under Computer Configuration\Polices\Administrative Tempates\Windows Components\Bitlocker Drive Encryption
5\. Move your endpoints to an OU that the BitLocker policy does not reach, or exclude them in that policy's **Security Filtering**. Then run
```
gpupdate /force
```
on an endpoint and check the registry key again.
| Note: If an endpoint was already encrypted by the previous policy, please decrypt it before you enroll it, using manage-bde -off C:

### Download the Enrollment File

1\. Sign in to the TruGrid Admin Portal.
2\. Go to **Company** > **BitLocker Management** > **Devices**.
3\. Click **Enrollment File** and select **Download**:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_tarflz.png)


Please refer to this [article](https://help.trugrid.com/en/article/device-management-enrollment-file-for-a-customer-domain-yooxg0/) for more details on the Enrollment File.

### Create the deployment share

1\. On your domain controller or a file server, create a folder to hold the installer, for example C:\TruGridDeploy
2\. Right-click the folder, select **Properties** > **Sharing** > **Advanced Sharing**, tick **Share this folder**, and give it a share name. Click **Permissions** and give **Domain Computers** the Read permission:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_ov293p.png)


3\. On the **Security** tab of the same folder, add **Domain Computers** as well. Share permissions and NTFS permissions are checked separately, and the installation fails quietly if this one is missing:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_1nkrwhe.png)


4\. Copy the Enrollment File (.msi) you downloaded into that folder.
| Please note that the startup script runs as the computer account, not as the logged-on user. This is why Domain Computers needs Read access, and why the share must be reachable from every endpoint at startup, for example \\\SERVER01\TruGridDeploy$

### Create the Group Policy Object

1\. On your domain controller, open **Group Policy Management** (gpmc.msc).
2\. Right-click the OU that contains your endpoints and select **Create a GPO in this domain, and Link it here**:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_1g0d04f.png)


3\. Give the GPO a name, for example TruGrid IoT Agent - Deploy, and click **OK**:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_90xa2t.png)


4\. Right-click the new GPO, select **Edit**, and go to Computer Configuration\Polices\Windows Settings\Scripts (Startup/Shutdown):

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_qxrghx.png)

5\. Double-click **Startup**, then click **Show Files**. In the folder that opens, create a text file named InstallTruGridAgent.cmd containing one line, using your own server and file names:
```
msiexec.exe /i "\\SERVER01\TruGridDeploy$\TruGrid-IoT-Installer-.msi" /qn /norestart
```
6\. Close the folder, click **Add**, then **Browse**, and select InstallTruGridAgent.cmd. Leave **Script Parameters** empty:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_1gsa96d.png)


7\. Click **OK**. The script now appears in the Startup Properties window. Click **OK** again to save it to the GPO:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_1kofj65.png)


8\. In the same editor, go to COMPUTER CONFIGURATION\POLICIES\ADMINISTRATIVE TEMPLATES\SYSTEM\LOGON and set **Always wait for the network at computer startup and logon** to **Enabled**. This makes sure the deployment share is reachable when the script runs:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_19takm.png)

9\. Close the Group Policy editor, then run
```
gpupdate /force
```
on your endpoints and reboot them. The agent installs during startup, before the user signs in.

### Verify the installation

1\. On an endpoint that has rebooted, open **Services** (services.msc) and confirm that the **TruGrid IoT Agent** service is Running:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_14b8hnr.png)

2\. You can also confirm the installation in **Settings** > **Apps** > **Installed apps**, where it is listed as **TruGrid IoT Agent**.
3\. In the TruGrid Admin Portal, go to **Company** > **BitLocker Management** > **Devices**. Your endpoint appears with the status **Installed** within a few minutes of the reboot:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_i2zq5i.png)

### Turn on encryption

1\. Go to **Company** > **BitLocker Management** > **Encryption**.
2\. Find your endpoint and switch **Protection Status** to **ON**:

![](https://storage.crisp.chat/users/helpdesk/website/-/f/4/7/3/f473d72e7d7c5000/image_ktblr3.png)

3\. Your users see the standard Windows BitLocker encryption process and nothing else. Recovery passwords are stored in your TruGrid portal, where you can retrieve them at any time.
| Note: BitLocker cannot activate while a bootable CD/DVD or a mounted ISO is attached to the machine. Please remove it before you turn protection on. An endpoint that has never had BitLocker turned on may also show as BitLocker suspended until you enable protection, which is normal.

### Troubleshooting

The endpoint does not appear under Devices. Confirm that the GPO applies to the computer with
```
 gpresult /r /scope:computer
```
and that the computer account can read the deployment share.
Remember that NTFS permissions are separate from share permissions.
The agent reports in at reboot and every few hours.
Encryption does not start after you switch Protection Status ON, and the toggle keeps spinning.
The most common cause is a bootable CD/DVD or a mounted ISO attached to the machine, which prevents BitLocker from activating. Remove the media, then switch Protection Status off and on again.
The second most common cause is an existing BitLocker Group Policy still applying to the endpoint. 
For any other issue, please collect the agent logs from the endpoint and contact TruGrid support. This [article](https://help.trugrid.com/en/article/how-to-export-error-logs-from-a-trugrid-bitlocker-managed-windows-machine-1amw18d/) explains where the logs are stored.