1

Hello guys!

Made a decision that bitlocker is going to be a part of company security when it comes to computers. I have my own laptop which works very well with bitlocker. I got the recovery key uploaded to our AzureAD and everything. Tried to disable bitlocker a couple of times and reactivating it again with success. When I however try to do this on my colleagues computer which is the same model where I firstly save the recovery key to our networkdrive with success also but I dont get the option of storing it into our cloud domain account. Tried also doing it with an elevated prompt using cmdlet manage-bde -protectors c: -aadbackup -id but with a “catastrophic error” occuring instead. The computer itself is connected to the AzureAD with the right user and everything looks good from the Azureportal. What am I doing wrong? Any suggestions or things to troubleshoot with?

5 Spice ups
2

Are you enrolling these devices in Intune?

1 Spice up
3

No, we are not using intune in our organisation yet. Since we are only 60 people on prem I need to myself manually activate and load the keys into AAD.

1 Spice up
4

There is a registry key that has to be present to allow export of the key using that command you referenced.

That Registry key is detailed here

Report back if that registry key is in play on the problem workstation.

3 Spice ups
5

Can’t you create some group policies to save the recovery key straight into your AzureAD? I do that with my laptops but to an on-premises AD machine.

6

So let’s make sure we understand this, so is the bitlocker recovery key backup with AD or AzureAD?

7

Key is registered in HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE but when I try to execute the cmdlet manage-bde -protectors c: -aadbackup -id{xx} I just get a error message the says “Catastrophic error occured” and when I open the “manage bitlocker” UI I have only the option of either saving the recovery key to a USB,file or print it. I did place a GPO that is supposed to store the key in the on-prem AD but when I right click the computer object it isn’t listed. I also did check what policies the computer is affected (rsop.msc) by and bitlockeris listed among the other GPO:s. I did delegate the control of this OU to my user account but I cannot view any keys.

8

Don’t know if this can help you, but when I was implementing BitLocker with Group Policies at my work place, this is what I had to do to get it working first with TPM chip-sets.

To initialize the TPM successfully so that you can turn on BitLocker requires that the correct permissions for the SELF account in be set in AD DS for the ms-TPMOwnerInformation attribute. The following steps detail setting these permissions as required by BitLocker:

  1. Open Active Directory Users and Computers.

  2. Select the organizational unit (OU) which contains the computer accounts that will have BitLocker turned on.

  3. Right-click the OU and click Delegate Control to open the Delegation of Control wizard.

  4. Click Next to go to the Users or Groups page and then click Add.

  5. In the Select Users, Computers, or Groups dialog box, type SELF as the object name and then click OK. Click Next.

  6. On the Tasks to Delegate page, choose Create a custom task to delegate and then click Next.

  7. On the Active Directory Object Type page, choose Only the following objects in the folder and then check Computer Objects and then click Next.

  8. On the Permissions page, for Show these permissions, check General, Property-specific, and Creation/deletion of specific child objects. Scroll down the Permissions list and check both Write msTPM-OwnerInformation and Write msTPM-TpmInformationForComputer then click Next.

  9. Click Finish to apply the permissions settings.

9

Tried these steps without any success…any other suggestions?

10

You sure, because that’s what worked for me. And this is how I created my GPO afterwards, see if your settings match.

  1. Create new GPO and call it Default Workstations – Enable BitLocker.

  2. Next edit the GPO and go to Computer Configuration, Administrative Templates, Windows Component, BitLocker Drive Encryption.

  3. Within Fixed Data Drives, enable Choose how BitLocker-protected drives can be recovered. Specify to store recovery passwords and key packages and select option Do not enable BitLocker until recovery information is stored in AD DS.

  4. Also select Enforce drive encryption type on fixed data drives and select here if Full Encryption or Used Space Only Encryption is to be used. Recommend that Full Encryption to be used.

  5. Repeat Step 3 and Step 4 for the Operating System Drives.

  6. Now go to Computer Configuration, Administrative Templates, System, Trusted Platform Module Services and enable Turn on TPM backup to Active Directory Domain Services.

Now we are in a position where we can link the GPO to the correct AD Group and turn on BitLocker on the target machine

11

If you are still running into issues with GPO and want another option, I want to share an option for you that does not require dealing with GPO at all for BitLocker. You can deploy an agent to each machine and manage the endpoints and recovery keys directly from the portal. You can enroll AD and non-AD endpoints, it does not matter if you use Azure AD or local AD, and the endpoints don’t need to check into GPO to be enforced. You can also run compliance reports at any time. Quick video overview here if you are interested: https://youtu.be/cRqmGu9XZX8 .

If you don’t mind dealing with GPO, and want to consider some other tools Microsoft has…there is a Microsoft product called BitLocker Administration and Monitoring (MBAM). Depending o the size of your environment, it might be something to consider. It will still require using GPO though.

If you are interested, there is a high level overview of MBAM vs what we do…you can check it out here: Microsoft BitLocker Administration and Monitoring (MBAM) | TruGrid . You can also signup for a free trial.

12

Last step did the trick, stored the key successfully. Thanks for the quick replys!

13

No worries. Glad that it’s working for you now :slight_smile: