Bitlocker and Active Directory

[ironsniper1]

Hey everyone, so in my new job one of the things I am teaching myself is AD and GPO and what I am wanting to do is change the GPO for the department I support and I am allowed to do so, to save the bitlocker keys for the computers into AD instead of into txt files which is not very secure,

 

i have it setup to do that in the GPO now but i didn't disable the save to file/folder option and was wondering if by having both enabled at the same time if it would cause it to not save to AD, I haven't disabled it yet but I have a computer that I am currently installing windows on and will try it out as soon as its done installing updates.

[viscero]

No, you can have both active and it will escrow to AD still.  Make sure you also have AD setup properly to receive the bitlocker info; it is more than just a GPO.

[viscero]

https://technet.microsoft.com/en-us/library/dd875529(v=ws.10).aspx

 

Here's the guide.

[ironsniper1]

No, you can have both active and it will escrow to AD still.  Make sure you also have AD setup properly to receive the bitlocker info; it is more than just a GPO.

other departments here have it setup to do so, so i would imagine ours would too just need to activate it in the GPO which i have done and i tried to manually save one that was already encrypted to AD but even know it said it did it, nothing shows up when i look at the computer in AD

Edited December 3, 2015 by luke9511