Is it possible to backup BitLocker recovery keys to Azure AD without an elevated privilege? Because right now, we have several devices that do not have recovery keys uploaded.
There is a Powershell script to upload this but it still requires to run as administrator. I want to deploy a script to a group of devices. I don't want to go to each one and backup their recovery keys manually.
I had a similar problem. We are using Intune and the recovery keys would not get uploaded. In my scenario I had more than one account registered under the Accounts section I think AD did not know which one to back up to. Once I removed one the backup of the recovery key to AD worked
Uploading the recovery keys is done as part of having the device (Hybrid) Azure AD Joined and managed in Microsoft Endpoint Manager (Intune), and should not require any additional permissions. I found a blog which may contain some more information that could be helpful.
Thanks. Need help with one step.
How do I "3. Choose to run the script as SYSTEM then assign it to the devices for which you need to save the recovery key."?
You're basically looking for the highlighted setting below. If this is set to YES - the script will run as the signed in user, if it's set to NO - the script will run under the system context.
Alright, I did this and status for every device I applied the script to says Succeeded. However, even after a few days waiting, I still don't see BitLocker Recovery Keys uploaded. Did I do something wrong?
In my experience the recovery keys are only uploaded to Azure AD if you join the computers via Autopilot or do that before you Bitlocker them. If you already have Bitlockered them and that (manually) add them to Azure AD the recovery keys are not saved to Azure AD.
We created a policy for that.
What's the policy you created to go around this issue?
I have not seen any positive results with the script although it says Succeeded in every devices I added and deployed to.
we use a configuration profile (the endpoint protection template (see also my answer below)
You can also use the Endpoint protection template for that I think.
Configuration settings > Windows Encryption
7 people are following this question.
