Deploying TruGrid BitLocker IoT Agent via GPO

Please follow the steps outlined below to deploy the TruGrid BitLocker Device Management (IoT) Agent to your domain-joined Windows endpoints using a Group Policy startup script. This allows you to enroll many machines at once, instead of running the installer on each computer.
Note for Administrators: This guide is intended for IT Administrators or Service Providers. If you are a non-technical user, please contact your IT department or service provider for assistance.
Please follow this link if you prefer to watch a video overview of TruGrid BitLocker Management. If you only need to install the agent on a single machine, or your deployment tool accepts a command line, please see this article instead.

In this article

Requirements
Remove any existing BitLocker policy
Download the Enrollment File
Create the deployment share
Create the Group Policy Object
Verify the installation
Turn on encryption
Troubleshooting

Requirements

An Active Directory domain, and access to Group Policy Management on a domain controller
Windows endpoints joined to that domain, each with a TPM chip
Microsoft .NET Framework 4.7.1 or later on each endpoint. Please see this article for the full list of dependencies
Your TruGrid Device Management Enrollment File for the customer domain

Remove any existing BitLocker policy

TruGrid manages BitLocker directly through the agent. Any BitLocker setting delivered by Group Policy will compete with the agent and should be removed from the endpoints you intend to enroll.
1. On one of your endpoints, open an elevated Command Prompt and run:

gpresult /r /scope:computer

2. Review the policies listed under Applied Group Policy Objects.
3. Check whether BitLocker settings are already applied to the endpoint:

reg query HKLM\SOFTWARE\Policies\Microsoft\FVE

4. If that key exists, open Group Policy Management (gpmc.msc) and inspect each applied policy under Computer Configuration\Polices\Administrative Tempates\Windows Components\Bitlocker Drive Encryption
5. Move your endpoints to an OU that the BitLocker policy does not reach, or exclude them in that policy's Security Filtering. Then run

gpupdate /force

on an endpoint and check the registry key again.

Download the Enrollment File

1. Sign in to the TruGrid Admin Portal.
2. Go to Company > BitLocker Management > Devices.
3. Click Enrollment File and select Download:

Please refer to this article for more details on the Enrollment File.

Create the deployment share

1. On your domain controller or a file server, create a folder to hold the installer, for example C:\TruGridDeploy
2. Right-click the folder, select Properties > Sharing > Advanced Sharing, tick Share this folder, and give it a share name. Click Permissions and give Domain Computers the Read permission:

3. On the Security tab of the same folder, add Domain Computers as well. Share permissions and NTFS permissions are checked separately, and the installation fails quietly if this one is missing:

4. Copy the Enrollment File (.msi) you downloaded into that folder.

Create the Group Policy Object

1. On your domain controller, open Group Policy Management (gpmc.msc).
2. Right-click the OU that contains your endpoints and select Create a GPO in this domain, and Link it here:

3. Give the GPO a name, for example TruGrid IoT Agent - Deploy, and click OK:

4. Right-click the new GPO, select Edit, and go to Computer Configuration\Polices\Windows Settings\Scripts (Startup/Shutdown):

5. Double-click Startup, then click Show Files. In the folder that opens, create a text file named InstallTruGridAgent.cmd containing one line, using your own server and file names:

msiexec.exe /i "\\SERVER01\TruGridDeploy$\TruGrid-IoT-Installer-.msi" /qn /norestart

6. Close the folder, click Add, then Browse, and select InstallTruGridAgent.cmd. Leave Script Parameters empty:

7. Click OK. The script now appears in the Startup Properties window. Click OK again to save it to the GPO:

8. In the same editor, go to COMPUTER CONFIGURATION\POLICIES\ADMINISTRATIVE TEMPLATES\SYSTEM\LOGON and set Always wait for the network at computer startup and logon to Enabled. This makes sure the deployment share is reachable when the script runs:

9. Close the Group Policy editor, then run

gpupdate /force

on your endpoints and reboot them. The agent installs during startup, before the user signs in.

Verify the installation

1. On an endpoint that has rebooted, open Services (services.msc) and confirm that the TruGrid IoT Agent service is Running:

2. You can also confirm the installation in Settings > Apps > Installed apps, where it is listed as TruGrid IoT Agent.
3. In the TruGrid Admin Portal, go to Company > BitLocker Management > Devices. Your endpoint appears with the status Installed within a few minutes of the reboot:

Turn on encryption

1. Go to Company > BitLocker Management > Encryption.
2. Find your endpoint and switch Protection Status to ON:

3. Your users see the standard Windows BitLocker encryption process and nothing else. Recovery passwords are stored in your TruGrid portal, where you can retrieve them at any time.

Troubleshooting

The endpoint does not appear under Devices. Confirm that the GPO applies to the computer with

 gpresult /r /scope:computer

and that the computer account can read the deployment share.
Remember that NTFS permissions are separate from share permissions.
The agent reports in at reboot and every few hours.
Encryption does not start after you switch Protection Status ON, and the toggle keeps spinning.
The most common cause is a bootable CD/DVD or a mounted ISO attached to the machine, which prevents BitLocker from activating. Remove the media, then switch Protection Status off and on again.
The second most common cause is an existing BitLocker Group Policy still applying to the endpoint.
For any other issue, please collect the agent logs from the endpoint and contact TruGrid support. This article explains where the logs are stored.

Updated on: 28/10/2026