Hallo Christoph,
nein, ich habe eine Windows 2012 Domäne. Da das Problem nur beim Surface auftaucht, wird das Problem nicht am AD liegen.
Vom Microsoft-Support habe ich eine Antwort erhalten, bin aber noch nicht dazu gekommen zu testen, ob das die Lösung ist:
Check if your device is binding to PCR[7]
-
On the Start screen, type msinfo32. The msinfo32 app appears in the Search bar, with a computer icon next to it.
- Right click on the msinfo32 app in the Search results and click
Run as administrator.
If you aren't using an administrator account, you will need to supply the user name and password for an administrator account.
-
Click Yes on the User Account Control dialog box.
-
In the System Summary view, locate the PCR7 Configuration item and check the value.
If the value of PCR7 Configuration is Bound or
Binding possible, then no further action is required.
- If the value of PCR7 Configuration is
Binding not possible, follow the steps under
Enable binding to PCR[7].
Enable binding to PCR[7]
-
If BitLocker is enabled, save your BitLocker recovery key and then suspend BitLocker:
-
Save your BitLocker recovery key to a USB flash drive:
-
Have a USB drive available that you don't use for anything else.
-
On the Start screen type BitLocker, and in the search results tap or click
Manage BitLocker. This opens the BitLocker Drive Encryption Control Panel window.
-
Tap or click Back up your recovery key and follow the instructions to save your recovery key to a file on an external drive.
-
Temporarily suspend BitLocker:
.
While still in the BitLocker Drive Encryption Control Panel window, Tap or click
Suspend protection
-
When asked "Do you want to suspend BitLocker protection?" click
Yes.
-
Follow these steps to reboot Surface into the UEFI configuration menu:
-
Swipe from the right edge of the screen and tap or click Settings.
-
Tap or click Change PC settings.
-
Tap or click Update and recovery.
-
Tap or click Recovery.
-
Under Advanced Startup, tap or click Restart now.
-
When Surface restarts, tap or click Troubleshoot.
-
Tap or click Advanced Options.
-
Tap or click UEFI Firmware Settings.
-
Tap or click Restart.
-
The system will restart and boot into the UEFI configuration menu.
-
Under Secure Boot Control, click Delete All Secure Boot Keys. The system will ask you to confirm.
-
Tap or click Yes to confirm.
-
Under Secure Boot Control, tap or click Install All Factory Default Keys.
-
In the popup menu, tap or click Windows & 3rd-party UEFI CA (Default).
-
Tap or click Exit Setup.
-
Tap or click Yes to save the configuration and reset the device.
The system will restart and boot into Windows.
Confirm that BitLocker can bind to PCR[7]
Following the steps under Check
if your device is binding to PCR[7], above.
Enable BitLocker or bring out of suspension
-
At the Start screen, type BitLocker.
-
In the search results, tap or click Manage BitLocker.
-
Tap or click Resume protection, or if BitLocker is turned off tap or click
Turn on BitLocker.
Falls damit das Problem bei Dir behoben werden konnte, würde ich mich über eine Rückmeldung freuen.
LG
Klaus
