Friday, June 22, 2012

Bitlocker recovery key didn't get uploaded to Active Directory

For some reason a laptop did not upload it's encryption key to Active Directory after bitlocker was enabled. I can only assume that it had lost network connectivity somehow.

So I needed to find a way to get the key into Active Directory manually after bitlocker was enabled and most of my google searches were of no help.

This is what I have come up with -
Start with a cmd prompt (ran as an administrator)
Enter the following command: manage-bde -protectors -adbackup C: -id {recoveryGUID}


You might be asking yourself what is the recoveryGUID???
The volume GUID can be found by executing the following:

  1. Right click the volume (ex. C: drive) that is bitlocker'ed and choose Manage BitLocker
  2. Choose save or print recovery key again
  3. Choose save to file
  4. We are looking for the "Full recovery key identification".  That is the GUID of the volume that you selected and is also the "id" used with the manage-bde command above.  Make sure you include the brackets with the ID
That should be it, double check in AD to make sure that the information for the recovery key has been populated in the computer object.


No comments:

Post a Comment

Remote Mailboxes - Hybrid Config - Missing

The Remote Mailbox exists on the On Prem Exchange server and linked to the Office 365 mailbox. Without one of these for each Office 365 mail...