Enabling bitlocker encryption via group policy

Your tests show that the TPM and BitLocker stack work when encryption is started locally as SYSTEM, so the failure is more likely in the domain-policy path than in the hardware. The recovery-key error is especially important: if Group Policy requires recovery information to be stored in Active Directory before BitLocker starts, Windows blocks encryption when it cannot reach a writable domain controller or cannot write the recovery object. Generate a gpresult report and confirm that only the intended BitLocker policies apply. Then check the BitLocker-API event log at the failed time, verify domain-controller connectivity, and confirm that the computer account can back up recovery information in AD DS. Also compare startup-authentication and recovery settings for conflicts. After correcting the policy or directory issue, refresh policy, restart, and test on one device before wider deployment. Do not bypass escrow unless your organization explicitly accepts losing centralized recovery.