BITLOCKER KEY RETRIEVE & SET UP in ACTIVE DIRECTORY
The retrieval method:
x.com/MPECSInc/status/181441…
NOTE: This requires an admin level account to log on and make the necessary changes!
Once in, retrieve the BitLocker key with a little PowerShell (Elevated):
Get-BitLockerVolume | Select-Object -ExpandProperty KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword' } | Select-Object -ExpandProperty RecoveryPassword
To set up BitLocker and TPM backup to Active Directory
-> Group Policy Management Console
-> Create and link a Group Policy Object to the OU the AD Computers objects reside in and name it "Default Domain BitLocker Policy"
-> Edit the new policy and add the date in Comments
-> Disable USER Objects in the GPO
->Open Computer Configuration,
->open Administrative Templates,
->open Windows Components
->open BitLocker Drive Encryption.
-> In the right pane, double-click Turn on BitLocker backup to Active Directory.
->Select the Enabled option.
->Verify that the Require BitLocker backup to AD DS check box is selected.
Enable Group Policy setting to back up TPM recovery information to Active Directory
-> Open Computer Configuration, open Administrative Templates, open System, and then open Trusted Platform Module Services.
-> In the right pane, double-click Turn on TPM backup to Active Directory.
-> Select the Enabled option.
-> Verify that the Require TPM backup to AD DS check box is selected.
NOTE: Already BitLocker encrypted devices need their existing keys to be pushed to Active Directory
-> Elevated CMD:
-> manage-bde -protectors -get c:
RESULT:
Numerical Password:
ID: {GUID}
Password: (will be blank)
-> manage-bde -protectors -adbackup c: -id "{GUID-From-Above}"
-> Verify the Computer AD Object BitLocker tab in Active Directory Users and Computers.
Tags
.
@WindowsServer
#CrowdStrike #ActiveDirectory #GroupPolicy
#BitLocker #BitLockerRecovery
#DisasterRecovery #DisasterRecoveryPlanning #DRP
This is the method to get passed the BitLocker key prompt. I just tested it on a BitLocker encrypted device here in the shop. The caveat is the need for the password.
1️⃣Cycle through BSODs until you get the recovery screen.
2️⃣Navigate to Troubleshoot > Advanced Options > Startup Settings.
3️⃣Press “Restart”.
4️⃣Skip the first BitLocker recovery key prompt by pressing Esc.
5️⃣Skip the second BitLocker recovery key prompt by selecting Skip This Drive in the bottom right.
6️⃣Navigate to Troubleshoot > Advanced Options > Command Prompt.
7️⃣Type bcdedit /set {default} safeboot minimal, then press Enter.
8️⃣ Go back to the WinRE main menu and select Continue.
9️⃣ It may cycle 2-3 times.
🔟 If you booted into safe mode, log in as normal.
1️⃣1️⃣ Open Windows Explorer, navigate to C:\Windows\System32\drivers\Crowdstrike.
1️⃣2️⃣ Delete the offending file (starts with C-00000291* and has a .sys file extension).
1️⃣3️⃣ Open Command Prompt (as administrator).
1️⃣4️⃣ Type bcdedit /deletevalue {default} safeboot, then press Enter.
1️⃣5️⃣ Restart as normal and confirm normal behavior.