AD contains system Recovery Key, but not showing in MBAM.

Question

I am in an environment with MBAM 1.0 installed. I built the MDT 2013 system here and am currently trying to figure out why the bitlocker keys are showing up in AD but not MBAM.
In MDT, I have disabled the "enable bitlocker" options so there shouldn't be a case where that the TPM ownership is wrong (I think). I do however set the
bios password with CCTK, then apply the default bios configuration with an ini via cctk. The bios sets and activates tpm just before the hard disk is formatted by LTI.
q1. Could setting the TPM without restarting cause the TPM ownership to be set to the PE in some weird way.
q1.1. would I clear the tpm if this is the issue?
So MBAM client is installed on the reference image and captured by MDT. The WIM is then deployed to a system using a standard TS with the bitlocker disabled like
I mentioned above. I do not make any changes to reg for mbam in the reference image. For testing, I tried adding the mbam recovery key location url to the reference image reg. I still need to test that but a few other tests I did makes me believe this
is not the case.
MDT binds the system to a default OU in the domain. After the system is configured, I start Bitlocker. (Sometimes I start bitlocker when the system is in the default
OU, sometimes I start it after I move them into the right ou for the role). I am almost positive the default OU has the mbam settings (I do not have access to this gpo), since the manage-bde -status comes back AES 128 with diffuser (as compared to regular
aes 128).
After bitlocker finishes, the key is found in AD but not mbam.
I think the major questions I have are:
How can I force MBAM to take ownership of the TPM after the os is bitlockered? (about 100/700 machines are not reporting to mbam but are to bitlocker because of this new deployment system)
If I turn TPM on and activate while I was in the PE, would that mean the PE has the TPM ownership? (or bitlocker in this case, since mbam is not installed on the PE)
- Could I install MBAM on the PE and use that to manage the tpm? (MDT 2013) (I have seen some documents that cover this but it largely comes from wanting a pre-provisioned bitlocker.)
** I think the most manual way of correcting the issue I am having, is to either clear the tpm and rebitlocker, or
.. when a system is about to image, turn tpm on but leave it deactivated. (If I leave the tpm deactivated, every system will need to be manually rebooted and f10 will need to be pressed to continue the bitlocker process. this includeds
a user login too)

Answer 1

Keep the MBAM out of the .wim! Install it in task sequence.
MBAM Client has its own log files in event viewer, there you perhaps find the reason why recovery key is not stored in DP. But fix your image first, keep it thin.