Cover
Photo: StockSnap (CC0)
What you are probably seeing
You see compliance reports spike Monday mornings with devices marked noncompliant even though encryption is actively running. The alert volume increases after weekend maintenance windows when encryption tasks pause or extend beyond the default timeout.
Your help desk receives tickets from users whose laptops are in limbo, waiting for the encryption process to finish, while the console shows a persistent red status that does not clear immediately after the task completes.
Why it happens
Intune enforces a strict time window for encryption completion. If the BitLocker task exceeds this threshold, the system flags the device as noncompliant to signal that the security policy is not met, regardless of whether the process is still progressing.
Network congestion or heavy disk I/O on Monday mornings often slows down the data transformation required for full volume encryption. The default grace period may be too short for large drives or slow connections, causing a mismatch between the expected completion time and reality.
What changed recently
Step by step
1. Review the Intune device compliance policy to identify the specific BitLocker encryption timeout threshold currently in effect. Adjust the grace period in the encryption task to account for slower performance on older hardware. Monitor the encryption progress on a test group of devices before pushing the policy to the entire fleet. Configure notifications to alert IT staff when encryption tasks exceed 80 percent completion so they can intervene before the deadline. Verify that the network connection speed on affected devices supports the required throughput for timely encryption completion.
Ways to go further
Affiliate links: CHEAPUNO may earn a commission if you buy through them, at no extra cost to you.
Other problems readers raise
Does Claude’s Google sidebar beat built-in Gemini?
Is a 42% off HP laptop with Office 365 a good deal?
How to tell if basic IT tasks consume over 10 hours weekly