Run .bat from GPO

Question

Hi,

I'm trying to run a .bat from the machine gpo to save the bitlocker key in AD but it doesn't work.

If I run it locally it works perfectly. All users are local administrators of their machines.

What may be failing?? Other .bat files work without problems

manage-bde -protectors -get c:  
for /f "skip=4 tokens=2 delims=:" %%g in ('"manage-bde -protectors -get c:"') do set MyKey=%%g  
manage-bde -protectors -adbackup c: -id%MyKey%  

Thanks!!!

Answer 1

In the end I have achieved it by doing an immediate task as suggested by partner MotoX80

1 copy the .bat to a folder on the hard disk with a GPO
2 I schedule an immediate task that executes that script only once and then deletes it

Thank you very much everyone for the help and forgive all the questions I ask you!!!!!

I mark this answer as the correct one because it does not let me mark the one of the partner MotoX80 for being a comment.

Answer 2

Thank you very much for the answers and sorry for the delay in answering!!!

MotoX80: I copied the code but the folder c: \ temp does not appear. I don't think the bat is running.

HannahXiong: Yes, the gpo appears within GPOs applied at the computer level

MTG-6756: I didnt know this, I am going to read your article to see if that could be the problem.

Thanks!!!!!

Answer 3

To sum up:

The bat works locally and works remotely with psexec.

gpresult shows the gpo correctly and rsop tb

I don't know what else to check

Thanks!!!

Answer 4

MTG: 29963-image.png

Works perfectly

MotoX80: I don't understand your question, the script runs every time the pc starts up.

I have copied the .bat you wrote and it gives me a syntax error, but at least it creates the temp folder and the .log.
So what I did was add to my .bat the creation of the temp folder and it works and creates it, but the rest still does not work, it does not save the key in AD

md c:\temp
manage-bde -protectors -get c:
for /f "skip=4 tokens=2 delims=:" %%g in ('"manage-bde -protectors -get c:"') do set MyKey=%%g
manage-bde -protectors -adbackup c: -id%MyKey%

Answer 5

The result of the code that the partner Motox80 wrote is:

Starting 02/10/2020 21:30:39,47
Cifrado de unidad BitLocker: versi¢n de la herramienta de configuraci¢n 10.0.18362
Copyright (C) 2013 Microsoft Corporation. Todos los derechos reservados.
Volumen C: []
Todos los protectores de clave
ERROR: error (c¢digo 0x80070522):
El cliente no dispone de un privilegio requerido.
Cifrado de unidad BitLocker: versi¢n de la herramienta de configuraci¢n 10.0.18362
Copyright (C) 2013 Microsoft Corporation. Todos los derechos reservados.
ERROR: sintaxis no v lida.
No se entendi¢ "(c¢digo".
Escriba "manage-bde -?" para usarla.
Ending 02/10/2020 21:30:39,79

Looks like a permission issue....