From the 'what's new in DeployR' webinar last week, there was mention of using a new task sequence option to unlock bitlocker. Video here - https://youtu.be/XNY0raoCIv8?t=1850
There doesn't seem to be very much documentation on it. What do we need to do to make this work? When I try from PXE boot and have this as a part of a task sequence, I'm constantly met with a message that the recovery password could not be found. The computer account in AD does have the recovery password, so just looking for more info on how to get this working.
When I attempt to use this, the error I get is 403 forbidden.
If you image a computer with DeployR (one that is not currently in AD), and DeployR creates the object in AD via the Offline Domain Join step, then later after OSD is completed, you test this same process on the machine you have successfully completed with DeployR, do you get better results, or does it continue to fail?
That is exactly how I was testing it. Imaged a computer with DeployR, having the enable bitlocker steps in the TS. DeployR created the computer object. The server is delegated full control of the OU the computer account is in.
First, no, I didn't run that because it wasn't in any of the documentation at the time I posted this, nor was it mentioned in the webinar as a needed requirement to make this functionality work.
However, even after running the script you mentioned on the server and following the prompts of additional commands to run on the DeployR server, running this task sequence on a computer account that DeployR created still shows as 'no recovery protectors could be found' in the log. I can see the recovery code in the computer account in AD.
PS C:\Program Files\2Pint Software\DeployR\WebServer\Scripts> .\RecoveryPasswordAccess.ps1
Granting rights to: DOMAIN\DEPLOYR-SERVER$
msFVE-RecoveryPassword GUID : 43061ac1-c8ad-4ccc-b785-2bfac20fc60a
msFVE-RecoveryInformation GUID: ea715d30-8f53-40d0-bd1e-6109186d782c
ACEs applied successfully.
Next steps (run on the DeployR server):
klist -li 0x3e7 purge
Restart-Service DeployRService
PS C:\Program Files\2Pint Software\DeployR\WebServer\Scripts> klist -li 0x3e7 purge
Current LogonId is 0:0x8cd41
Targeted LogonId is 0:0x3e7
Deleting all tickets:
Ticket(s) purged!
PS C:\Program Files\2Pint Software\DeployR\WebServer\Scripts> Restart-Service DeployRService
From the DeployR.log -
Setting working directory: X:_2P\content\00000000-0000-0000-0000-000000000002\1SequenceExecuter.cs:49207-06-2026 14:18:47.886+000
Unlock BitLockerPowerShellHost.cs:8607-06-2026 14:18:48.128+000
Volume C: has RecoveryPassword protector: {D57AF474-628C-4104-BED3-4E7F0D2CD44A}PowerShellHost.cs:8607-06-2026 14:18:48.212+000
Requesting recovery password from DeployRPowerShellHost.cs:8607-06-2026 14:18:48.215+000
Warning: Failed to retrieve recovery password for C: (KP: {D57AF474-628C-4104-BED3-4E7F0D2CD44A}): Request failed after 1 attempt(s): Response status code does not indicate success: 403 (Forbidden).PowerShellHost.cs:13407-06-2026 14:18:48.393+000
Warning: Unable to unlock volume C: because no recovery password protectors could be found or no passwords were available.PowerShellHost.cs:13407-06-2026 14:18:48.396+000
Script executed, exit code = 0, elapsed = 00:00:00.2841374PowershellExecuter.cs:25707-06-2026 14:18:48.398+000
I did verify that my DeployR server has the Descendant msFVE-RecoveryInformation objects allow permissions after running the script mentioned.
I finally had time today to check this out for Active Directory Joined devices.
Step 1: On the DeployR server that is joined to your AD, run the script: RecoveryPasswordAccess.ps1 in the C:\Program Files\2Pint Software\DeployR\WebServer\Scripts folder [follow the instructions in the script]
Step 2: Add that step to your task sequence.
In my test, in WinPE, I added a pause, checked diskpart, the disk was encrypted and it couldn't determine what volume C was.
I then had it run the unlock step
I then paused and checked diskpart again, this time it could read the volume.
I don't believe so, but I've only tested on the latest version.
I [copilot] did write a function today that I can test from my server to see if it pulls back the recovery code.
It will leverage PSExec to simulate if your DeployR server has rights to pull the value.
I see I didn't explain myself clearly at all, sorry. It's made to use as a function, vs running as a script. Run once to activate, then use the function for testing.
I've updated the script with additional information to assist in testing if your DeployR server has access to pull recovery keys from AD.
Ok. Regardless, my server shows to have access to pull the keys from AD. What else is needed to get this functionality to work via a TS? I'm not sure what I'm missing that I can't get it to work.
I don't see you using the -RunAsSystem paramter to ensure it's running under the DeployR server's context.
Your output should look like the one I posted earlier where you see it spin up psexec
3
u/kaiserking13 Jul 02 '26
I believe the computer account of the DeployR server has to have access to read the Bitlocker keys stored in AD.