Bitlocker Saving Data Drive Info To Active Directory

Question

hello. i have complete success with enabling Bitlocker on system drives and saving keys to AD. however today i attempted to enable a data drive (E) encryption and it does not save to AD. the command "manage-bde -protectors -get e:" returns the Numerical Password. then i use the command "manage-bde -protectors -adbackup c: -id {NUMERICAL_PASSWORD}". the command returns "Recovery information was successfully backed up to Active Directory." however looking at computer object, the key is not saved. it still only shows the system drive information. any ideas? thanks

Answer 1

Hi

The problem probably is an issue with replication , not bitlocker.
Bitlocker recovery keys tab for some devices in AD were updated instantly. However , others did not.

It seems that some devices just take more time for the key to appear.
It just depends on whether the backup chooses to use the same Domain Controller that Active Directory Users & Computers is connected to.
If they are the same, you'll see the change instantly. If not, you won't see it until it replicates.

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

The syntax is wrong. It should be
manage-bde -protectors -adbackup c: -id {The ID you found, not the numerical password itself}

Please retry. If that was just a typo, maybe Miles is right, that's the only possible explanation.

Answer 3

Hi
If you resolved it using our solution, please click "Accept Answer" on a reply to help other community members find the helpful reply quickly.
If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.

Answer 4

hello. thanks for both responses. i did have a typo in my second command. should be E: instead of C: it also says success. its been 5 days and still nothing DCs are syncing okay.

Answer 5

There's nothing that could possibly go wrong if it says success, it has arrived in AD.
Hm, please rule out that it's a refresh problem. Also look in ADSIedit below your computer object should be msFVERecoverykey objects - is it seen there?