How to Recover a Moved Drive
Tuotteet: Microsoft BitLocker Administration and Monitoring 2.5
This topic explains how to use the Administration and Monitoring Website (also referred to as the Help Desk) to recover an operating system drive that was moved after being encrypted by Microsoft BitLocker Administration and Monitoring (MBAM). When a drive is moved, it no longer accepts the PIN that was used in the previous computer because the Trusted Platform Module (TPM) chip has changed. To recover the moved drive, you must obtain the recovery key ID to retrieve the recovery password.
To recover a moved drive, you must use the Drive Recovery area of the Administration and Monitoring Website. To access the Drive Recovery area, you must be assigned the MBAM Helpdesk Users role or the MBAM Advanced Helpdesk Users role. For more information about these roles, see Administration and Monitoring Website (Help Desk) accounts.
Huomautus
You may have given these roles different names when you created them. For more information, see Access accounts for the Administration and Monitoring Website (Help Desk).
To recover a moved drive
On the computer that contains the moved drive, start the computer in Windows Recovery Environment (WinRE) mode, or start the computer by using the Microsoft Diagnostic and Recovery Toolset (DaRT).
After the computer has been started with WinRE or DaRT, MBAM will treat the moved operating system drive as a fixed data drive. MBAM will then display the drive’s recovery password ID and ask for the recovery password.
Huomautus
In some cases, you may be able to click I forgot the PIN during the startup process, and then enter the recovery mode to display the recovery key ID.
Use the recovery key ID to retrieve the recovery password and unlock the drive from the Administration and Monitoring Website. For instructions, see How to Recover a Drive in Recovery Mode.
If the moved drive was configured to use a TPM chip on the original computer, complete the following additional steps. Otherwise, the recovery process is complete.
After unlocking the drive and completing the start process, open a command prompt in WinRE mode and use the
manage-bdecommand to decrypt the drive. Using this tool is the only way to remove the TPM plus the PIN protector without the original TPM chip. For information about themanage-bdecommand, see Manage-bde.When the removal is completed, start the computer normally. The MBAM agent will now enforce the policy to encrypt the drive with the new computer’s TPM plus the PIN.
Got a suggestion for MBAM? Add or vote on suggestions here.
Got a MBAM issue? Use the MBAM TechNet Forum.