Microsoft Intune - BitLocker: Client-driven recovery password rotation error 0x87d1fde8 Remediation failed

Question

Hello!

I'm trying to silently encrypt devices via Intune Device Configuration profile.
The endpoints are on-prem domain-joined + azureAD-registered Windows 10 machines (10.0.19042)
The error I'm getting is Client-driven recovery password rotation Fails with -2016281112 (Remediation failed) error code 0x87d1fde8

Event log on the endpoint shows that configure recovery password rotation URI request is not supported:

The Device configuration profile settings are:

Could you please help figure out how this can be fixed?

Answer 1

Same issue here. The device does encrypt but the password rotation is not supported. Same as in the screenshot made by the OP.

Answer 2

@Jarvis Sun-MSFT I am having the same issue as @Yevhenii Bozhenko . How would I check a OMA-URI value for a setting pushed via a Endpoint Protection template?

Answer 3

@Yevhenii Bozhenko Thanks for posting in our Q&A.
Based on my experience, it could be caused by CSP URI. Could you please confirm the URI settings as below and try again to see if it is working?
OMA-URI:
./Device/Vendor/MSFT/BitLocker/ConfigureRecoveryPasswordRotation

If it doesn't work, we need to do further log analysis. With the limitation of Q&A, it is better to create an online support ticket to handle this issue. It is free. Here is the online support link and hope it will be resolved as soon as possible.
https://learn.microsoft.com/en-us/mem/intune/fundamentals/get-support
Thanks for your understanding.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

adding my name to the "same issue here" pile

Answer 5

Also running into this issue now using the same configuration template. The device is not automatically encrypting and is prompting for encryption. Upon clicking the promt, getting the "Warning for other disk encryption" popup, which it shouldn't be because that is Blocked in the configuration profile template.