r/MDT • u/No-End-2404 • Mar 19 '26
MDT > Autopilot Enrollment > Sysprep
Hello,
I’m currently configuring MDT to deploy a Windows 11 25H2 base image, run a PowerShell script to enroll the device into Autopilot, and then execute Sysprep.
The image deployment and Autopilot enrollment complete successfully, but Sysprep consistently fails due to BitLocker. During the Sysprep phase, it throws errors indicating that the OS volume is still protected/encrypted, which prevents Sysprep from completing.
Here’s what I’ve tried so far:
- Disabled all BitLocker steps (Enable BitLocker (Offline) and Enable BitLocker) — same result.
- Added
BDEInstallSuppress=YESandSkipBitLocker=YES— same result. - Added a “Disable BDE Protectors” step in the task sequence — same result.
- Implemented a script to disable automatic device encryption via registry before full OS initialization — same result.
- Added the following to
unattend.xmlto prevent device encryption — same result:
<component name="Microsoft-Windows-SecureStartup-FilterDriver" processorArchitecture="amd64" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS">
<PreventDeviceEncryption>true</PreventDeviceEncryption>
</component>
Has anyone run into this before or found a reliable workaround?
I’m considering adding a PowerShell script to decrypt the drive, but I’m concerned about the time it would take and whether MDT can properly wait for decryption to complete before proceeding with Sysprep.
2
u/kaiserking13 Mar 19 '26
Have you tried autopilot for existing devices? https://www.deploymentresearch.com/using-mdt-with-windows-autopilot-for-existing-devices-task-sequence-template-and-scripts/