Long title but pretty much explains it all. Thread about this here [social.technet.microsoft.com]
So you’ve got Windows 7 clients and a Windows Server 2003 domain. All the domain preparation has been completed (schema extensions for Vista, etc) and all your Group Policy settings in place to require a machine to backup its recovery keys / recovery passwords to Active Directory before enabling BitLocker, but it isn’t working.
First, try running:
manage-bde -protectors -adbackup c: -id <numerical_id>
I was getting a group policy permission denied error which matched the situation in this thread [social.technet.microsoft.com]
I initially tried setting the necessary GPO options via local policy, see here [blogs.technet.com] – refers to Group Policy, but use local policy (gpedit.msc) on the target Windows 7 machine. This will work, but because you have Windows Server 2003 domain controllers and even trying to set Group Policy on a Windows 7 machine with RSAT installed, the Windows 7 group policy options are not available (i.e. the Fixed Data drive, Operating System drive, etc options). They are only available in the ADMX templates which Windows 2003 can’t read. So, you need to set them using Extra Registry Settings instead.
Also, it turns out that the backup to AD registry settings that get applied have changed from Windows Vista to Windows 7 (because Windows 7 extends upon BitLocker beyond what Vista offered). In Vista the policy created keys called:
- ActiveDirectoryBackup, REG_DWORD (1)
- ActiveDirectoryInfoToStore, REG_DWORD (1)
- RequireActiveDirectoryBackup, REG_DWORD (1)
Windows 7 does not recognise these as they are now on a drive type basis. So, create in your GPO Extra Registry Settings as follows (this is for enabling FVE on an OS drive):
- OSActiveDirectoryBackup, REG_DWORD (1)
- OSActiveDirectoryInfoToStore, REG_DWORD (1)
- OSRequireActiveDirectoryBackup, REG_DWORD (1)
These registry settings should be created in HKLM\SOFTWARE\Policies\Microsoft\FVE
Remove the local settings (if you chose to test that way) and once Group Policy is updated, the correct settings will be applied and AD backup of BitLocker recovery info will work. Note that backup of recovery info is only ever attempted once during the BitLocker enable process. It can be retried with the manage-bde command as shown above though.
Popularity: 18% [?]
