Problem with Bitlocker
Problem Bitlocker
During a Bitlocker project at a customer I had a problem with the storage of bitlocker recovery key in Active Directory
After you set up group policy which configured the desktop and laptop client (store in AD the recovery key, use tpm,…), I launched the script which enabled BitLocker on the system partition or opther partition.
The bitlocker has been actived and partition has crypted, however the recovery key was not stored in the Active Directory. After several tests, I realized that some partition encryption failed (error message when i try to initialize TPM chip) and this randomly. The project consisted to encrypt partitions systems from a laptop computer to decrypt the partition using the TPM chip.
How to solve the problem ?
Following research on the internet and many unsuccessful attempts, I found and corrected the problem. Following the attempt to initialize the TPM chip, an error message appeared :
Trusted Platform Module (TPM) Initialization failed.
Access is denied.
Error 0x80070005.
An ACL was missing. Indeed I’ve set up a delegation for “Self” at the level of the OU containing the computer account :
Open Active Directory Users and Computers console and select the OU (Organization Unit) where you have computers on which you want to enable bitlocker
Right Click on the OU select Delegate Control. Click on Next on the first page of the wizard
In the Users and Groups window, add the Self account using the Add button
Select option Create a custom task to delegate
Select Only the following objects in the folder and select Computer Objects
On the Permissions Windows, select select all 3 checkbox and select attributes Write msTPM-OwnerInformation.
click on Next then on Finish.
Subsequently all the tests were conclusive, TPM chips activated properly and the recovery key was present in the Active Directory.