I've got our MBAM environment up and running, I found an article that shows that Enhanced passwords really only beens Letters and Numbers so that is question 1 answered. Question #2 is is there a method to script turning on encryption through the MBAM client where we do not want the user to be prompted for a PIN, want it configured through a script. Does MBAM 2.0 solve any of these issues?

You could just create a new Group Policy with the MBAM template and configure so that it only uses TPM not TPM+Pin. Then assign that policy to the set of machines you wish to get this version of Bitlocker that does not require a Pin.PLEASE MARK ANY ANSWERS TO HELP OTHERS Blog: rorymon.com Twitter: @Rorymon

Thanks but the point is that we want to be able to use TPM+PIN and the push the install without the user intervention.

Hi, Based on my research, you can use the following command and make it as script to add PIN. manage-bde protectors add %systemdrive% -tpmandpin <4-20 digit numeric PIN> More information: Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled? Manage-bde.exe Parameter Reference Hope this helps. Jeremy Wu TechNet Community Support

Hi, Based on my research, you can use the following command and make it as script to add PIN. manage-bde protectors add %systemdrive% -tpmandpin <4-20 digit numeric PIN> More information: Is it possible to add an additional method of authentication without decrypting the drive if I only have the TPM authentication method enabled? Manage-bde.exe Parameter Reference Hope this helps. Jeremy Wu TechNet Community Support

Hi, Just check if this can help you. Best Regards. Jeremy Wu TechNet Community Support