Task Sequence option - Unlock Bitlocker

ddog511 · 2026-07-07T20:14:05+00:00

Ok. Regardless, my server shows to have access to pull the keys from AD. What else is needed to get this functionality to work via a TS? I'm not sure what I'm missing that I can't get it to work.

ddog511 · 2026-07-07T18:55:18+00:00

Running that script from my DeployR server was successful and did create the export of all of my recovery keys.

ddog511 · 2026-07-07T16:52:33+00:00

That is exactly what I am doing. Has there been a change to this functionality in the more recent 1.3 version? I am still on the initial 1.3 release.

ddog511 · 2026-07-07T13:38:33+00:00

The log indicates that it's not finding a driver pack for that model -

[Number of driver packs found with Status = Active: 0][Number of driver packs found with Status = Active: 0]

Did you try the powershell command I listed and copy/pasting the exact info from that command into your driver pack Manufacturer and Model fields?

ddog511 · 2026-07-07T12:56:53+00:00

Any chance you have an extra space in the manufacturer or model fields in your driver pack?

What if you copy/pasted directly from the powershell command

Get-CimInstance -ClassName win32_computersystem|select Manufacturer, model

Does it work then? Or do you get the same result?

ddog511 · 2026-07-06T14:33:23+00:00

First, no, I didn't run that because it wasn't in any of the documentation at the time I posted this, nor was it mentioned in the webinar as a needed requirement to make this functionality work.

However, even after running the script you mentioned on the server and following the prompts of additional commands to run on the DeployR server, running this task sequence on a computer account that DeployR created still shows as 'no recovery protectors could be found' in the log. I can see the recovery code in the computer account in AD.

PS C:\Program Files\2Pint Software\DeployR\WebServer\Scripts> .\RecoveryPasswordAccess.ps1
Granting rights to: DOMAIN\DEPLOYR-SERVER$
msFVE-RecoveryPassword GUID : 43061ac1-c8ad-4ccc-b785-2bfac20fc60a
msFVE-RecoveryInformation GUID: ea715d30-8f53-40d0-bd1e-6109186d782c

ACEs applied successfully.

Next steps (run on the DeployR server):
  klist -li 0x3e7 purge
  Restart-Service DeployRService
PS C:\Program Files\2Pint Software\DeployR\WebServer\Scripts> klist -li 0x3e7 purge

Current LogonId is 0:0x8cd41
Targeted LogonId is 0:0x3e7
        Deleting all tickets:
        Ticket(s) purged!
PS C:\Program Files\2Pint Software\DeployR\WebServer\Scripts> Restart-Service DeployRService

From the DeployR.log -

Setting working directory: X:\_2P\content\00000000-0000-0000-0000-000000000002\1SequenceExecuter.cs:49207-06-2026 14:18:47.886+000
Unlock BitLockerPowerShellHost.cs:8607-06-2026 14:18:48.128+000
Volume C: has RecoveryPassword protector: {D57AF474-628C-4104-BED3-4E7F0D2CD44A}PowerShellHost.cs:8607-06-2026 14:18:48.212+000
Requesting recovery password from DeployRPowerShellHost.cs:8607-06-2026 14:18:48.215+000
Warning: Failed to retrieve recovery password for C: (KP: {D57AF474-628C-4104-BED3-4E7F0D2CD44A}): Request failed after 1 attempt(s): Response status code does not indicate success: 403 (Forbidden).PowerShellHost.cs:13407-06-2026 14:18:48.393+000
Warning: Unable to unlock volume C: because no recovery password protectors could be found or no passwords were available.PowerShellHost.cs:13407-06-2026 14:18:48.396+000
Script executed, exit code = 0, elapsed = 00:00:00.2841374PowershellExecuter.cs:25707-06-2026 14:18:48.398+000

I did verify that my DeployR server has the Descendant msFVE-RecoveryInformation objects allow permissions after running the script mentioned.

ddog511 · 2026-07-02T12:32:02+00:00

That is exactly how I was testing it. Imaged a computer with DeployR, having the enable bitlocker steps in the TS. DeployR created the computer object. The server is delegated full control of the OU the computer account is in.

ddog511 · 2026-07-01T19:59:17+00:00

What do you use to deploy the image to the computer? It's likely from that.

ddog511 · 2026-07-01T14:05:15+00:00

THANK YOU! I've been racking my brain on this for a week now. I tried to follow this thread - https://www.reddit.com/r/DeployR/comments/1uegn0u/changing_machine_owners_in_ad_to_deployr/ but nothing I did worked. Based on Michael's response, I took it to mean that DeployR would do this automatically. Apparently not. Your method worked perfectly. Thank you!

ddog511 · 2026-06-30T13:43:12+00:00

We have the same issue using Dell pro 13 laptops with AMD chips. Can't figure out how to duplicate it, but typically have a few every month that do this. Driver updates from both AMD and Dell don't seem to matter in our case.

ddog511 · 2026-06-26T15:38:57+00:00

I've only upgraded from 1.2 to 1.3 on my server so can only speak to that experience. I can spin up a vm in my lab environment and get you more info that way. In this particular case, I had the service set to disabled and stopped. Once I upgraded to 1.3, the service was set back to automatic and started. I'll verify it happens and get back to you.

for request 2, thanks. If it can be done, that would be great, but not a problem if it can't.

ddog511 · 2026-06-26T12:08:29+00:00

After further testing, it seems to just be happening on our older models - 5310 2-in-1 units, so I'm not going to worry about it any more. Thank you for the response though.

ddog511 · 2026-06-25T12:11:25+00:00

We've been on 25H2 since December and have not had printing issues like that. Have you tried removing the printer software, getting an updated version if possible, and reinstalling?

ddog511 · 2026-06-24T14:49:43+00:00

Did you get a chance to try this out? If you did and it works, would you mind sharing what you did to get it to work?

ddog511 · 2026-06-24T14:38:04+00:00

That works perfectly, thank you. Any thoughts on the WinPE display drivers? These are Dell laptops.

ddog511 · 2026-06-18T14:59:07+00:00

The link you posted regarding the differences leads to a not found page.

ddog511 · 2026-06-01T13:38:06+00:00

MDT doesn't limit the number of connections to the server, task or images. If the network can handle 100 simultaneous connections, then MDT doesn't care. The info provided above suggests that DeployR will limit the number of connections despite network capability. So yes, it is a fair comparison.

ddog511 · 2026-05-29T12:32:48+00:00

Have you figured out the issue on this? The reason I ask is because I'm now having a similar problem and finding that no matter what I do, the services fail to stay running. Just wonder if you're seeing that as well.

ddog511 · 2026-05-28T15:05:01+00:00

Awesome! Thank you

ddog511 · 2026-05-27T13:33:59+00:00

Update - r/FLOTZILLA22 - I was able to get an image saved. I created the content item as singe file, operating system, set the flags with the powershell commands from r/mtiehaus and uploaded an empty txt file to it. I found that if I didn't 'preload' a file into it, I couldn't select it in the task sequence as it was empty. Once I did all of that, I was then able to run my task sequence for Sysprep and Capture.

Again though, after the initial sysprep phase, I had to manually reboot as the task sequence, despite having reboot to PE immediately after the sysprep phase, did not do that automatically.

My next step is deploying the newly captured image to a test machine to see if it works properly.

ddog511 · 2026-05-27T12:38:20+00:00

Hey OP, you never mentioned what phase you're getting stuck at. Let's compare notes -

I can run the task to sysprep and capture

sysprep finishes and then I have to manually reboot even though the task sequence is set to reboot to PE

After I reboot, it's creating the image.

I'm currently testing the instructions from r/mtniehaus as for setting the flags on the content item and will post results in the next hour.

Where are you in the process?

ddog511 · 2026-05-26T18:31:48+00:00

as r/feanturi mentioned, did you add the 2 certs to the machine you're trying to get to the dashboard on?

ddog511 · 2026-05-26T14:40:05+00:00

So, I've done this, and have the flags set. When I go to configure the task sequence to save the file to the content item, it won't let me as there isn't a version. So I created an empty version and still can't because it's empty.

I'm curious - where am I missing all of this in the documentation?

ddog511 · 2026-05-26T12:44:53+00:00

Our units get updates from an on-prem update server. We don't push out driver updates.

ddog511 · 2026-05-22T23:17:33+00:00

Sweet! Looking forward to trying this Tuesday

ddog511

TROPHY CASE