Bitlocker recovery key didn't get uploaded to Active Directory

For some reason a laptop did not upload it's encryption key to Active Directory after bitlocker was enabled. I can only assume that it had lost network connectivity somehow.

So I needed to find a way to get the key into Active Directory manually after bitlocker was enabled and most of my google searches were of no help.

This is what I have come up with -
Start with a cmd prompt (ran as an administrator)
Enter the following command: manage-bde -protectors -adbackup C: -id {recoveryGUID}


You might be asking yourself what is the recoveryGUID???
The volume GUID can be found by executing the following:

1. Right click the volume (ex. C: drive) that is bitlocker'ed and choose Manage BitLocker
2. Choose save or print recovery key again
3. Choose save to file
4. We are looking for the "Full recovery key identification".  That is the GUID of the volume that you selected and is also the "id" used with the manage-bde command above.  Make sure you include the brackets with the ID

That should be it, double check in AD to make sure that the information for the recovery key has been populated in the computer object.

Setting Local Admin account to not expire

So I was using this command - 

net user username password /expires:never /passwordchg:no /comment:"Desktop Support" /add

- to create the local administrator account during OSD but the password was still set to expire.

I guess I misunderstood the /expires:never switch.  This sets the account to never expire not the password.

So in addition to the aforementioned net user command I added a wmic command that sets the password to never expire:

wmic path Win32_UserAccount WHERE Name="username" set PasswordExpires=False