Okta Reports the Windows Disk Encryption Type as NONE With BitLocker Enabled

Okta reports the disk encryption type as NONE for Windows machines, even when BitLocker encrypts the primary drive. This occurs because Okta requires all internal drives, including system recovery and vendor maintenance partitions, to have encryption to recognize the machine as encrypted. Verify the encryption status of all internal drives using a PowerShell script to identify unencrypted partitions.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Authentication Policy
• Device Assurance Policy
• Windows
• Multi-Factor Authentication (MFA)

Okta recognizes a Windows machine as encrypted only when BitLocker encrypts all internal drives. Okta does not distinguish between standard data drives and system recovery or PC vendor maintenance partitions. If an unencrypted recovery or maintenance partition exists, Okta reports the disk encryption type as NONE.

How do administrators verify the encryption status of all internal drives?

Execute a PowerShell script to identify any unencrypted partitions and verify the encryption status of all internal Windows drives.

1. Verify the encryption status of all internal drives by executing a PowerShell script to identify any unencrypted partitions:

   # Map logical drives to their physical disk drives  
   $logicalToPhysicalMap = @{}  
   Get-CimInstance Win32_DiskDrive | ForEach-Object {  
       $disk = $_  
       $partitions = Get-CimAssociatedInstance -InputObject $disk -ResultClassName Win32_DiskPartition  
       foreach ($partition in $partitions) {  
           $logicalDrives = Get-CimAssociatedInstance -InputObject $partition -ResultClassName Win32_LogicalDisk  
           foreach ($logicalDrive in $logicalDrives) {  
               $logicalToPhysicalMap[$logicalDrive.DeviceID] = $disk  
           }  
       }  
   }  
   $drives = [System.IO.DriveInfo]::GetDrives()  
   foreach ($drive in $drives) {  
       # BitLocker encryption check  
       $encryptionLevel = (New-Object -ComObject Shell.Application).NameSpace($drive.Name).Self.ExtendedProperty('System.Volume.BitLockerProtection')  
       $isEncrypted = $encryptionLevel -eq 1 -or $encryptionLevel -eq 6  
       # Fixed or Removable check  
       $isFixedDrive = $drive.DriveType -eq [System.IO.DriveType]::Fixed  
       # Retrieve the corresponding disk for the current logical drive  
       $physicalDisk = $logicalToPhysicalMap[$drive.Name.TrimEnd("\")]  
       # Check InterfaceType for USB  
       $isUSB = $false  
       if ($physicalDisk) {  
           $interfaceType = $physicalDisk.InterfaceType  
           $isUSB = $interfaceType -eq "USB"  
       }  
       Write-Host "Drive:" $drive.Name               `", Fixed drive:" $isFixedDrive`  
                  ", Connected via USB:" $isUSB `  
                  ", Encrypted:" $isEncrypted  
   }

2. Review the output to determine which internal drives lack encryption:

   Drive: C:\ , Fixed drive: True , Connected via USB: False , Encrypted: True
   Drive: D:\ , Fixed drive: False , Connected via USB: False , Encrypted: False
   Drive: Z:\ , Fixed drive: False , Connected via USB: False , Encrypted: False

In the provided example, the C, D, and Z drives are internal, but BitLocker only encrypts the C drive. Because the D and Z drives lack encryption, Okta reports the disk encryption type as NONE.

NOTE: Okta does not distinguish system recovery partitions and partitions for PC vendor maintenance. These partitions lack encryption capabilities and cause Okta to report the machine as unencrypted.