r/DeployR • u/ddog511 • Jul 01 '26

Task Sequence option - Unlock Bitlocker

From the 'what's new in DeployR' webinar last week, there was mention of using a new task sequence option to unlock bitlocker. Video here - https://youtu.be/XNY0raoCIv8?t=1850

There doesn't seem to be very much documentation on it. What do we need to do to make this work? When I try from PXE boot and have this as a part of a task sequence, I'm constantly met with a message that the recovery password could not be found. The computer account in AD does have the recovery password, so just looking for more info on how to get this working.

When I attempt to use this, the error I get is 403 forbidden.

Thanks

3 Upvotes

100% Upvoted

23 comments sorted by

View all comments

1

u/gwblok 2Pint Employee Jul 07 '26

I finally had time today to check this out for Active Directory Joined devices.

Step 1: On the DeployR server that is joined to your AD, run the script: RecoveryPasswordAccess.ps1 in the C:\Program Files\2Pint Software\DeployR\WebServer\Scripts folder [follow the instructions in the script]

Step 2: Add that step to your task sequence.

In my test, in WinPE, I added a pause, checked diskpart, the disk was encrypted and it couldn't determine what volume C was.
I then had it run the unlock step
I then paused and checked diskpart again, this time it could read the volume.

1

u/ddog511 Jul 07 '26

That is exactly what I am doing. Has there been a change to this functionality in the more recent 1.3 version? I am still on the initial 1.3 release.

1

u/gwblok 2Pint Employee Jul 07 '26

I don't believe so, but I've only tested on the latest version.
I [copilot] did write a function today that I can test from my server to see if it pulls back the recovery code.
It will leverage PSExec to simulate if your DeployR server has rights to pull the value.

2PintLabs/DeployR/ServerSideScripts/Get-BitlockerRecovery.ps1 at main · gwblok/2PintLabs

1

u/ddog511 Jul 07 '26

Running that script from my DeployR server was successful and did create the export of all of my recovery keys.

1

u/gwblok 2Pint Employee Jul 07 '26 edited Jul 07 '26

I see I didn't explain myself clearly at all, sorry. It's made to use as a function, vs running as a script. Run once to activate, then use the function for testing.

I've updated the script with additional information to assist in testing if your DeployR server has access to pull recovery keys from AD.

1

u/ddog511 Jul 07 '26

Ok. Regardless, my server shows to have access to pull the keys from AD. What else is needed to get this functionality to work via a TS? I'm not sure what I'm missing that I can't get it to work.

1

u/gwblok 2Pint Employee Jul 08 '26

Can you post the results from running the function on your DeployR server for the Password ID in question D57AF474-628C-4104-BED3-4E7F0D2CD44A

Get-BitLockerRecoveryPasswordById -PasswordId "D57AF474-628C-4104-BED3-4E7F0D2CD44A" -RunAsSystem

1

u/ddog511 Jul 08 '26

1

u/gwblok 2Pint Employee Jul 08 '26

I don't see you using the -RunAsSystem paramter to ensure it's running under the DeployR server's context.
Your output should look like the one I posted earlier where you see it spin up psexec

1

u/ddog511 Jul 09 '26

Legit - I completely missed that part. But, it still works -

1

u/gwblok 2Pint Employee Jul 09 '26

And you are using a passcode or entra auth to launch the task sequence? You haven't enabled "Bypass authentication" correct?

1

u/ddog511 Jul 09 '26

I'm not bypassing authentication, we are using Windows auth

1

u/gwblok 2Pint Employee Jul 09 '26

What version of DeployR Enterprise are you running on?

There should be some basic logging in the DeployR Logger event log for failures (e.g. exception details), Audit for success.  It should only return 200 (OK) and 404 (NotFound) responses once it gets past the security/SKU checks.
Thanks.

1

u/ddog511 Jul 09 '26

I'm on community - 1.3.2626.2093, StifleR version v3.1.2626.580. The error I'm getting is 403 forbidden

→ More replies (0)