Category: Active Directory

Posted on

BitLocker – AD setup for BitLocker Recovery Key Management

Like most other posts in this blog, this is pieced together to make sense to me.

Especially in older domains, verify that the AD schema has the appropriate attributes using PowerShell window as administrator:

Get-ADObject -SearchBase ((GET-ADRootDSE).SchemaNamingContext) -Filter {name -like 'ms-FVE-*'}

On a domain controller, install the BitLocker Feature to display the BitLocker recovery information:

Install-WindowsFeature BitLocker -IncludeAllSubFeature -IncludeManagementTools -Restart

To see the BitLocker tab containing the BitLocker recovery key from an admin workstation, the RSAT “BitLocker Drive Encryption Administration Utilities” needs to be installed on the workstation.

GPO Settings

On a domain controller: Server Manger>Tools>Group Policy Management

Edit the following:

Computer Configuration>Policies>Administrative Templates>Windows Components>BitLocker Drive Encryption

"Store BitLocker recovery information in Active Directory":
	Select "Enabled"
	Check "Require BitLocker backup to AD DS"
	Select "Recovery passwords and key packages"


NOTE – At the bottom of the GPO “Help” it states that the TPM information also needs to be backed up. This, however, no longer appears to be the case after Windows 10 version 1607.

"Choose how users can recover BitLocker-protected drives":
        Select "Enabled"

Select “Operating System Drives”

"Choose how BitLocker-protected operating system drives can be recovered":
	Select "Enabled"

        Check "Save BitLocker recovery information to AD DS for operating system drives"
        Select "Store Recovery passwords and key packages"

        Check "Do not enable BitLocker until recovery information is stored to AD DS for operating system drives"

Select “Fixed Data Drives”

"Choose how BitLocker-protected fixed data drives can be recovered":
        Select "Enabled"

        Check "Save BitLocker recovery information to AD DS for fixed data drives"
	Select "Backup recovery passwords and key packages"

        Check "Do not enable BitLocker until recovery information is stored to AD DS for fixed data drives"
Posted on

Transferring FSMO Roles in Active Directory

Transferring the AD roles are easy using PowerShell. One important issue needs to met in order to be able to transfer the “SchemaMaster” role. The admin who is performing the “SchemaMaster” role transfer needs to be in the “Schema Admins” group. Being in the “Enterprise Admins” and “Domain Admins” groups are not enough.

Move-ADDirectoryServerOperationMasterRole -Identity “dc2” –OperationMasterRole DomainNamingMaster,PDCEmulator,RIDMaster,SchemaMaster,InfrastructureMaster

Earlier post on Active Directory FSMO roles:

Active Directory FSMO Roles

Posted on

Active Directory FSMO Roles

Knowing which Active Directory server(s) holds the following five roles is important for a number of reasons, the most important of which is that decommissioning a server that holds one or more of these roles may cause serious operational issues within a functioning domain.

The five FSMO (Flexible Single Master Operation) roles are:

Schema Master
Domain Naming Master
Infrastructure Master
Relative ID (RID) Master
PDC Emulator

Find the server(s) that holds the roles from the command line:

netdom query fsmo

Or using PowerShell:

Get-ADForest | Select-Object DomainNamingMaster, SchemaMaster

– and –

 Get-ADDomain | Select-Object RIDMaster, PDCEmulator, InfrastructureMaster

A follow-up article on transferring the roles can be found here:

Transferring FSMO Roles in Active Directory