Appendix D - Microsoft Intune Wipe and Windows Reset with Full Disk Encryption

Overview

Microsoft Intune Wipe and Windows Reset this PC are operating system–level reset mechanisms. When Check Point Full Disk Encryption (FDE) is enabled, encryption and authentication operate below the operating system, in the pre‑boot environment.

Because of this separation, Windows reset and wipe operations do not remove or manage FDE.

Notes and Limitations

  • Windows reset and wipe operations do not manage Full Disk Encryption.

  • The required encryption state must be planned before performing a reset.

  • Unsupported reset methods can result in inaccessible devices.

Reset Behavior with Full Disk Encryption

When Full Disk Encryption is enabled:

  • Disk encryption remains enabled after a reset or wipe.

  • The pre‑boot authentication environment is preserved.

  • Encryption keys and policies are not modified by reset operations.

Windows reset and wipe mechanisms cannot:

  • Remove Full Disk Encryption.

  • Remove the pre‑boot authentication environment.

  • Change the encrypted disk state.

Supported Reset and Wipe Configurations

The following table shows supported and unsupported reset and wipe configurations for devices protected with FDE.

Operation

Configuration

Supported

Reset this PC

Keep my files – Restore preinstalled apps = Yes

Yes

Reset this PC

Keep my files – Restore preinstalled apps = No

No

Reset this PC

Remove everything – Clean data = Yes

Yes

Reset this PC

Remove everything – Clean data = No

Yes

Intune Wipe

Keep enrollment state

Yes

Intune Wipe

Continue wipe if device loses power

Yes

Autopilot Reset

-

No

Intune Wipe

Remove enrollment state

No

Windows Fresh Start

-

No

Reset Without Full Disk Encryption

Use this reset approach when the device must not remain encrypted after the reset or wipe.

In this case:

  • Full Disk Encryption must be uninstalled.

  • All encrypted disks must be fully decrypted.

After decryption:

  • Microsoft Intune Wipe is supported.

  • Windows Reset this PC is supported.

Note:

If Full Disk Encryption is not removed before the reset, the device can become inaccessible.

Reset with Full Disk Encryption Enabled

Use this reset approach when the device must remain encrypted after the reset or wipe.

In this case:

  • Disk encryption remains enabled throughout the reset.

  • Pre‑boot authentication remains enabled.

  • The Full Disk Encryption blade must be redeployed after the reset.

After redeployment, the same Full Disk Encryption policy must be applied.

Autopilot Reset (Not Supported)

Autopilot Reset is not supported on devices protected with Full Disk Encryption.

Using Autopilot Reset on an encrypted device can result in:

  • Boot failures.

  • Inaccessible encrypted disks.

  • Pre‑boot authentication issues.

Intune Wipe with Enrollment Removal (Not Supported)

Intune Wipe with enrollment removal is not supported on devices protected with Full Disk Encryption.

When enrollment is removed:

  • The device management context is lost.

  • Full Disk Encryption components remain active.

  • The encryption state cannot be managed or recovered automatically.

Trusted Platform Module (TPM) Considerations

If the reset operation clears the TPM, TPM usage must be disabled in the Full Disk Encryption policy before the reset.

If TPM usage is not disabled:

  • SafeBoot authentication may fail.

  • Password‑based authentication may fail.