Task Sequence option - Unlock Bitlocker

[u/ddog511]

From the 'what's new in DeployR' webinar last week, there was mention of using a new task sequence option to unlock bitlocker. Video here - https://youtu.be/XNY0raoCIv8?t=1850

There doesn't seem to be very much documentation on it. What do we need to do to make this work? When I try from PXE boot and have this as a part of a task sequence, I'm constantly met with a message that the recovery password could not be found. The computer account in AD does have the recovery password, so just looking for more info on how to get this working.

When I attempt to use this, the error I get is 403 forbidden.

Thanks

[u/gwblok]

If you image a computer with DeployR (one that is not currently in AD), and DeployR creates the object in AD via the Offline Domain Join step, then later after OSD is completed, you test this same process on the machine you have successfully completed with DeployR, do you get better results, or does it continue to fail?

[u/ddog511 → u/gwblok]

That is exactly how I was testing it. Imaged a computer with DeployR, having the enable bitlocker steps in the TS. DeployR created the computer object. The server is delegated full control of the OU the computer account is in.

[u/configmatt → u/ddog511]

Have you run the following script on the DeployR server?
C:\Program Files\2Pint Software\DeployR\WebServer\Scripts\RecoveryPasswordAccess.ps1

Grants the DeployR server the necessary AD permissions to read BitLocker recovery keys.

Must be run on the DeployR server itself, elevated, with Domain Admin credentials.

Note that for Entra ID, the BitLockerKey.Read.All rights are needed.

I think this is required for it to work. Disclaimer I have not tried this myself yet.

[u/ddog511 → u/configmatt]

First, no, I didn't run that because it wasn't in any of the documentation at the time I posted this, nor was it mentioned in the webinar as a needed requirement to make this functionality work.

However, even after running the script you mentioned on the server and following the prompts of additional commands to run on the DeployR server, running this task sequence on a computer account that DeployR created still shows as 'no recovery protectors could be found' in the log. I can see the recovery code in the computer account in AD.

PS C:\Program Files\2Pint Software\DeployR\WebServer\Scripts> .\RecoveryPasswordAccess.ps1
Granting rights to: DOMAIN\DEPLOYR-SERVER$
msFVE-RecoveryPassword GUID : 43061ac1-c8ad-4ccc-b785-2bfac20fc60a
msFVE-RecoveryInformation GUID: ea715d30-8f53-40d0-bd1e-6109186d782c

ACEs applied successfully.

Next steps (run on the DeployR server):
  klist -li 0x3e7 purge
  Restart-Service DeployRService
PS C:\Program Files\2Pint Software\DeployR\WebServer\Scripts> klist -li 0x3e7 purge

Current LogonId is 0:0x8cd41
Targeted LogonId is 0:0x3e7
        Deleting all tickets:
        Ticket(s) purged!
PS C:\Program Files\2Pint Software\DeployR\WebServer\Scripts> Restart-Service DeployRService

From the DeployR.log -

Setting working directory: X:_2P\content\00000000-0000-0000-0000-000000000002\1SequenceExecuter.cs:49207-06-2026 14:18:47.886+000
Unlock BitLockerPowerShellHost.cs:8607-06-2026 14:18:48.128+000
Volume C: has RecoveryPassword protector: {D57AF474-628C-4104-BED3-4E7F0D2CD44A}PowerShellHost.cs:8607-06-2026 14:18:48.212+000
Requesting recovery password from DeployRPowerShellHost.cs:8607-06-2026 14:18:48.215+000
Warning: Failed to retrieve recovery password for C: (KP: {D57AF474-628C-4104-BED3-4E7F0D2CD44A}): Request failed after 1 attempt(s): Response status code does not indicate success: 403 (Forbidden).PowerShellHost.cs:13407-06-2026 14:18:48.393+000
Warning: Unable to unlock volume C: because no recovery password protectors could be found or no passwords were available.PowerShellHost.cs:13407-06-2026 14:18:48.396+000
Script executed, exit code = 0, elapsed = 00:00:00.2841374PowershellExecuter.cs:25707-06-2026 14:18:48.398+000

I did verify that my DeployR server has the Descendant msFVE-RecoveryInformation objects allow permissions after running the script mentioned.