The Microsoft BitLocker Administration and Monitoring (MBAM) client enables administrators to enforce and monitor BitLocker drive encryption on computers in the enterprise. The BitLocker client can also be distributed through an electronic software distribution system, such as Active Directory Domain Services or Microsoft System Center Configuration Manager or as part of the imaging process for a new deployment. Here are some interesting guides: BitLocker Recovery Mode prompted? Unable to find my BitLocker Recovery Key, how to fix the MBAM Client Deployment is only supported on MBAM 2.5 SP1, What are the effects of renaming an MBAM or BitLocker-protected Computer, and how to deploy Microsoft BitLocker Administration and Monitoring Tool. In this guide, you will learn how to fix the following error “MBAM Policy was detected: Verify the OU used for pre-deployment does not apply MBAM policy”.
By the way, what is an OU? Organizational units (OUs) in an Active Directory Domain Services (AD DS) managed domain that enables you to logically group objects such as user accounts, service accounts, computer accounts etc, and apply group policy to enforce targeted configuration settings. Here is a comprehensive guide on how to deploy an MBAM Client as part of a Windows Deployment.
Reason for the error
It is a very straightforward error. As we can see from the deployment summary below, an OU linking this device had BitLocker/MBAM policies applied and when the device was joined to the AD and the policies got applied, this policy was detected during the installation of MBAM.
Resolution
In order to resolve this issue, you will need to move the device out of this OU having BitLocker and MBAM policies linked to it, and move it to an OU that does not have this policy linked. When this is done, start the deployment process again and it should succeed with errors as shown below.
Note: As you can see from the image below, the encryption is in progress wbven when the deployment has completed (succeeded).
As you can see the Computer Compliance Report below shows the encryption status for this device.
When the encryption is complete, you can now move the device to the right OU.
Note: I would recommend actually having the automatic MBAM client deployment managed by a software deployment system when the device is connected to the domain. I hope you found this blog post helpful. Please let me know in the comment session if you have any questions.