Backup-BitLockerKeyProtector : backup error

Question

Hi, We have several older Windows 10 systems (no tpm) that have sensitive data on a non system drive. We are able to encrypt data drives, but Bitlocker recovery is not getting saved to AD. The error we are getting states that GPO does not allow storage, however this is not true. Backup-BitLockerKeyProtector : Group policy does not permit the storage of recovery information to Active Directory. The operation was not attempted. I see many posts on the internet with people having the same problem and none of the offered solutions have worked for us. What could be the next troubleshooting step?

Answer 1

Hello, You can try use below steps to save bitlocker recovery key to AD: Click the Search icon in the taskbar and type “group policy“. You can then click Group Policy Management to launch it. Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> BitLocker Drive Encryption, and then double-click the policy “Store BitLocker recovery information in Active Directory Domain Services“. Make sure the “Require BitLocker backup to AD DS” option is checked, and select to store both recovery passwords and key packages. select Fixed Data Drives and double-click the policy “Choose how BitLocker-protected fixed drives can be recovered“. Set it to Enabled. Check the options “Save BitLocker recovery information to AD DS for fixed drives” and then click OK.