I am not able to get BitLocker recovery information to back up to Active Directory. My understanding is that the BitLocker and TPM recovery information should show up in the BitLocker Recovery tab of the computer object in AD, but it isn't. Here is what I've done:
- Set up a GPO with the following:
Computer/Policies/Administ
rative Templates/System/Trusted Platform Module Services: Turn on TPM backup to Active Directory Domain Services - enabled
Computer/Policies/Administ
rative Templates/Windows Components/BitLocker Drive Encryption: Store BitLocker recovery information in Active Directory Domain Services (Server 2008 and Vista)
Computer/Policies/Administ
rative Templates/Windows Components/BitLocker Drive Encryption/Operating System Drives: Choose how BitLocker-protected system Drives can be recovered
Allow Data recovery agent: Enabled
Configure user storage of BitLocker recovery information: Allow 48-digit recovery password, Allow 256-bit recovery key
Omit recovery options from the BitLocker setup wizard: Disabled
Save Bitlocker recovery information to AD DS for operating system drives: Enabled
Configure Storage of BitLocker recovery information to AD DS: Store recovery passwords and key packages
Do not enable BitLocker until recovery information is stored to AD DS for operating system drives: Disabled
Computer/Policies/Administ
rative Templates/Windows Components/BitLocker Drive Encryption/Operating System Drives: Require Additional authentication at Startup: Enabled
Allow Bitlocker without a compatible TPM: enabled
Settings for computers with a TPM:
Configure TPM startup: allow TPM
Configure TPM startup pin: Allow startup PIN with TPM
COnfigure TPM startup key: allow startup key with TPM
Configure TPM startup key and PIN: Allow startup key and PIN with TPM
- Set AD permissions to give SELF Write msTPM-OwnerInformation and Write msTPM-TpmInformationForCom
puter per
https://technet.microsoft.com/en-us/library/jj592683.aspx
We are running 2012 R2 DCs running at 2012 R2 domain and forest functional levels, so my understanding is there aren't any required schema extensions. The computer is running Windows 8.1 Pro. I have verified that the computer is applying the GPO and I have double-checked that these permissions are applying to my test machine, but still no recovery information in AD. I have decrypted and encrypted the machine multiple times. What am I doing wrong?