Manage-bde Status states "Protection Status: Protection Off"

Question

I have many machines that are encrypted, but say "Protection Off" and are therefore failing compliance in MBAM 1.0.  Here is what their status looks like:
P:\>manage-bde -status -cn AAAAAA
BitLocker Drive Encryption: Configuration Tool version 6.1.7601
Copyright (C) Microsoft Corporation. All rights reserved.
Computer Name: AAAAAA
Disk volumes that can be protected with
BitLocker Drive Encryption:
Volume C: [OSDisk]
[OS Volume]
Size: 297.60 GB
BitLocker Version: Windows 7
Conversion Status: Fully Encrypted
Percentage Encrypted: 100%
Encryption Method: AES 256 with Diffuser
Protection Status: Protection Off
Lock Status: Unlocked
Identification Field: None
Key Protectors:
Numerical Password
TPM And PIN
If I run the command: manage-bde -on c: -cn AAAAAA
....it seems to fix the problem.  See how now the protection is on?
P:\>manage-bde -on c: -cn AAAAAA
BitLocker Drive Encryption: Configuration Tool version 6.1.7601
Copyright (C) Microsoft Corporation. All rights reserved.
Computer Name: AAAAAA
Volume C: [OSDisk]
[OS Volume]
NOTE: This command did not create any new key protectors. Type
"manage-bde -protectors -add -?" for information on adding more key protectors.
NOTE: Encryption is already complete.
Turned on BitLocker protection by enabling key protectors.
P:\>manage-bde -status -cn AAAAAA
BitLocker Drive Encryption: Configuration Tool version 6.1.7601
Copyright (C) Microsoft Corporation. All rights reserved.
Computer Name: AAAAAA
Disk volumes that can be protected with
BitLocker Drive Encryption:
Volume C: [OSDisk]
[OS Volume]
Size: 297.60 GB
BitLocker Version: Windows 7
Conversion Status: Fully Encrypted
Percentage Encrypted: 100%
Encryption Method: AES 256 with Diffuser
Protection Status: Protection On
Lock Status: Unlocked
Identification Field: None
Key Protectors:
TPM And PIN
Numerical Password
My question is: Why are so many machines in this state, and is it safe for me to just run the "manage-bde -on c: -cn AAAAAA" on them or could it cause problems?

Answer 1

I mean to say, it's the MBAM agent who sends information to the MBAM Server about the recovery keys and TPM information. So when you are using manage-bde commands for encryption, the recovery keys will not get stored to the MBAM DBs.
What you need to do is to start the encryption with manage-bde and then at the next client wake up frequency which you have set in your environment, MBAM Agent will send the recovery information to the MBAM web servers an dthen the recovery keys will be
stored to the MBAM DBs.
But in this case also, TPM ownership information will not get stored to the MBAM DBs. For that you need to run a script if you have saved the TPM information in Active Directory. I have posted the script on Technet Gallery.
Let me know if you have any more issues.
Gaurav Ranjan