Once the Group Policy is configured, you’ll want to make sure that you add permissions in AD so that all computers can write their TPM info to Active Directory. Do this by running the add-tpmselfwriteace.vbs script, which can be downloaded here. Documentation is also included. Next, configure the BitlockerKeyBackup GPO per the screenshots below. Once the BitLockerComputers group is created, deploy a GPO called BitlockerKeyBackup and link it to the root of the domain. However, be sure to remove “Authenticated Users” from the filtering and add your BitLockerComputers group. By making this change, you are ensuring that you do not mistakenly roll out your new Group Policy to everyone in the company before you’ve had a chance to pilot it.

Start your Group Policy configuration by creating a local group in AD called BitLockerComputers. You will see why momentarily. To ensure all machines with BitLocker backup their associated BitLocker and TPM recovery keys to AD, it’s best to incorporate a Group Policy. For me, it’s always best practice to deploy stuff to some test machines first.

To install the BitLocker Recovery Password Viewer feature, open Server Manager on your DC and click Features. Click Add Features, expand Remote Server Administration Tools, expand Feature Administration Tools, and then BitLocker Drive Encryption Administration Utilities. Once you’ve done that, check the BitLocker Recovery Password Viewer option and click Next.Ĭlick the Add Required Roles and Services button if prompted and click Next or Install (whichever you are prompted for).

Bitlocker recovery password viewer