Bitlocker D drive and Recovery after Restart

Question

Hello, I am starting to create an Intune policy to encrypt devices with full disk encryption using BitLocker. So far, The policy works fine for the C drive but not the D drive.&nbsp;Second issue is that upon restart for an encrypted device, A recovery screen shows up and user should use the recovery key to use the device.I need some more understanding about the policy template settings to see what could be causing those behaviors.&nbsp;Current policy settings for reference:&nbsp;BitLockerRequire Device Encryption&nbsp;&nbsp;Enabled&nbsp;Allow Warning For Other Disk Encryption&nbsp;&nbsp;Disabled&nbsp;Allow Standard User Encryption&nbsp;&nbsp;Enabled&nbsp;Configure Recovery Password Rotation&nbsp;&nbsp;Refresh on for both Azure AD-joined and hybrid-joined devices&nbsp;Administrative TemplatesWindows Components &gt; BitLocker Drive Encryption&nbsp;Choose drive encryption method and cipher strength (Windows 10 [Version 1511] and later)&nbsp;&nbsp;Enabled&nbsp;Select the encryption method for removable data drives:&nbsp;AES-CBC 128-bit (default)&nbsp;Select the encryption method for operating system drives:&nbsp;XTS-AES 128-bit (default)&nbsp;Select the encryption method for fixed data drives:&nbsp;XTS-AES 128-bit (default)&nbsp;Provide the unique identifiers for your organization&nbsp;&nbsp;Not configured&nbsp;Windows Components &gt; BitLocker Drive Encryption &gt; Operating System Drives&nbsp;Enforce drive encryption type on operating system drives&nbsp;&nbsp;Enabled&nbsp;Select the encryption type: (Device)&nbsp;Full encryption&nbsp;Require additional authentication at startup&nbsp;&nbsp;Disabled&nbsp;Configure minimum PIN length for startup&nbsp;&nbsp;Not configured&nbsp;Allow enhanced PINs for startup&nbsp;&nbsp;Not configured&nbsp;Disallow standard users from changing the PIN or password&nbsp;&nbsp;Not configured&nbsp;Allow devices compliant with InstantGo or HSTI to opt out of pre-boot PIN.&nbsp;&nbsp;Not configured&nbsp;Enable use of BitLocker authentication requiring preboot keyboard input on slates&nbsp;&nbsp;Not configured&nbsp;Choose how BitLocker-protected operating system drives can be recovered&nbsp;&nbsp;Enabled&nbsp;Omit recovery options from the BitLocker setup wizard&nbsp;FalseAllow data recovery agent&nbsp;False&nbsp;Allow 256-bit recovery key&nbsp;Configure storage of BitLocker recovery information to AD DS:&nbsp;Store recovery passwords and key packages&nbsp;Do not enable BitLocker until recovery information is stored to AD DS for operating system drives&nbsp;TrueSave BitLocker recovery information to AD DS for operating system drives&nbsp;TrueConfigure user storage of BitLocker recovery information:&nbsp;&nbsp;Allow 48-digit recovery password&nbsp;Configure pre-boot recovery message and URL&nbsp;&nbsp;Enabled&nbsp;Select an option for the pre-boot recovery message:&nbsp;Use default recovery message and URL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Custom recovery URL option:Custom recovery message option:Windows Components &gt; BitLocker Drive Encryption &gt; Fixed Data Drives&nbsp;Enforce drive encryption type on fixed data drives&nbsp;&nbsp;Enabled&nbsp;Select the encryption type: (Device)&nbsp;Full encryption&nbsp;Choose how BitLocker-protected fixed drives can be recovered&nbsp;&nbsp;Enabled&nbsp;Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives&nbsp;TrueAllow data recovery agent&nbsp;TrueConfigure storage of BitLocker recovery information to AD DS:&nbsp;Backup recovery passwords and key packages&nbsp;&nbsp;Allow 256-bit recovery key&nbsp;Save BitLocker recovery information to AD DS for fixed data drives&nbsp;TrueOmit recovery options from the BitLocker setup wizard&nbsp;TrueConfigure user storage of BitLocker recovery information:&nbsp;&nbsp;Allow 48-digit recovery password&nbsp;Deny write access to fixed drives not protected by BitLocker&nbsp;&nbsp;Not configured&nbsp;Windows Components &gt; BitLocker Drive Encryption &gt; Removable Data Drives&nbsp;Control use of BitLocker on removable drives&nbsp;&nbsp;Not configured&nbsp;Deny write access to removable drives not protected by BitLocker&nbsp;&nbsp;Not configured&nbsp;Review + save&nbsp;

ahmad29660 · Answer

&nbsp;To resolve the issues with BitLocker encryption and recovery prompts, ensure the policy settings are correctly configured. Specifically, review settings related to drive encryption method, recovery options, and storage of recovery information to AD DS. Adjust settings as needed to enable encryption for both C and D drives and streamline the recovery process to minimize disruptions for users during restarts. Testing the policy on a few devices can help validate its effectiveness.&nbsp;&nbsp;AhmedSHMK&nbsp;

ahmedshmk · Answer

Cant figure out if something in the settings was in correct as I have compared the settings for system drive and fixed data drive as mentioned in the post above. C drive is encrypted just fine.
What I mostly notice is this error in event viewer,

Error: Group Policy prevents you from backing up your recovery password to Active Directory for this drive type. For more info. contact your system administrator.

ahmedshmk · Answer

&nbsp;Regarding D drive encryption, It did not work until I created a GPO for Fixed Data drives as mentioned in the below article.https://www.burgerhout.org/the-bitlocker-haadj-nightmare/-Had to later on add another to avoid the error aboveDo not forcefully unload the user registry at user logoffLogon to the application server as an administratorRun "gpedit.msc"Navigate to&nbsp; Computer Configuration | Administrative Templates | System | UserProfilesDouble-click on "Do not forcefully unload the user registry at user logoff" and change the setting from “Not Configured” to “Enabled”Reboot the server&nbsp;

Forum Discussion

Bitlocker D drive and Recovery after Restart

Share

Resources