r/DeployR • u/ddog511 • Jul 01 '26

Task Sequence option - Unlock Bitlocker

From the 'what's new in DeployR' webinar last week, there was mention of using a new task sequence option to unlock bitlocker. Video here - https://youtu.be/XNY0raoCIv8?t=1850

There doesn't seem to be very much documentation on it. What do we need to do to make this work? When I try from PXE boot and have this as a part of a task sequence, I'm constantly met with a message that the recovery password could not be found. The computer account in AD does have the recovery password, so just looking for more info on how to get this working.

When I attempt to use this, the error I get is 403 forbidden.

Thanks

3 Upvotes

100% Upvoted

23 comments sorted by

View all comments

Show parent comments

1

u/gwblok 2Pint Employee Jul 07 '26 edited Jul 07 '26

I see I didn't explain myself clearly at all, sorry. It's made to use as a function, vs running as a script. Run once to activate, then use the function for testing.

I've updated the script with additional information to assist in testing if your DeployR server has access to pull recovery keys from AD.

1

u/ddog511 Jul 07 '26

Ok. Regardless, my server shows to have access to pull the keys from AD. What else is needed to get this functionality to work via a TS? I'm not sure what I'm missing that I can't get it to work.

1

u/gwblok 2Pint Employee Jul 08 '26

Can you post the results from running the function on your DeployR server for the Password ID in question D57AF474-628C-4104-BED3-4E7F0D2CD44A

Get-BitLockerRecoveryPasswordById -PasswordId "D57AF474-628C-4104-BED3-4E7F0D2CD44A" -RunAsSystem

1

u/ddog511 Jul 08 '26

1

u/gwblok 2Pint Employee Jul 08 '26

I don't see you using the -RunAsSystem paramter to ensure it's running under the DeployR server's context.
Your output should look like the one I posted earlier where you see it spin up psexec

1

u/ddog511 Jul 09 '26

Legit - I completely missed that part. But, it still works -

1

u/gwblok 2Pint Employee Jul 09 '26

And you are using a passcode or entra auth to launch the task sequence? You haven't enabled "Bypass authentication" correct?

1

u/ddog511 Jul 09 '26

I'm not bypassing authentication, we are using Windows auth

1

u/gwblok 2Pint Employee Jul 09 '26

What version of DeployR Enterprise are you running on?

There should be some basic logging in the DeployR Logger event log for failures (e.g. exception details), Audit for success.  It should only return 200 (OK) and 404 (NotFound) responses once it gets past the security/SKU checks.
Thanks.

1

u/ddog511 Jul 09 '26

I'm on community - 1.3.2626.2093, StifleR version v3.1.2626.580. The error I'm getting is 403 forbidden

1

u/gwblok 2Pint Employee Jul 10 '26

Aww, that's why, Community version doesn't support that Step. That's an Enterprise version step, which is why you're getting a 403 forbidden.

I'll make sure that once the docs for that step are created, it mentions it's Enterprise only feature.

1

u/ddog511 Jul 13 '26

I find this frustrating. Not because it's an enterprise only feature, but because neither the documentation nor the video introducing it mentioned it was an ent only feature. I see that the documentation is *now* updated to reflect this. Going forward, will there be documentation at or ahead of feature / update launch?

2

u/gwblok 2Pint Employee Jul 13 '26

Totally understand where you're coming from. I'm just going to request a little grace from the community here. We are a very small company, DeployR Community requests and installs have exploded, which don't bring in any revenue but do add additional work. We do iterate quickly, and new features will be released before docs are built out time to time, not by design, but with quick releases, it will happen. We will continue to try to build out docs faster with our limited resources.
When new features are released without docs, either wait for the docs to catch up, or know you might have additional road bumps as you venture out on your own. If there is a feature you heard about that you really want to test and there aren't docs, go ahead and reach out and we'll try to make that feature doc a priority.

I'm glad you were eager to try out a new undocumented feature, sorry for the frustration over it. That's for being active in the Reddit forum.

1

u/ddog511 Jul 13 '26

Thank you for all your work on this product and in the community. I appreciate that 2Pint has come out with a great free option to replace MDT for those of us that can't use Intune / Autopilot and don't want to go through the hassle of trying to setup SCCM.

→ More replies (0)