Bitlocker fails to store recovery key in AD

I am deploying Windows 8.1 with Bitlocker with TPM and PIN and recovery keys stored in AD.
This works fine for most deployments but rarely Manage-bde fails to store the Recovery key into AD. This only happened three times over about 200 deployments.
I have checked the ZTIBDE.WSF script and I have noticed that the command is launched but there is no check on its return code. I am not even sure if Manage-bde actually returns any. Therefore for the failed deployments I don't know why the recovery key wasn't
stored and also I din't get any report that it actually failed. The only reason we realised that is because one user had problems in getting the PIN to work and required the Recovery Key. To our surprises this was not in AD! This is then when we checked
all AD objects and found only three didn't have it. Looking at the deployment logs there are no errors for these.
Luckily the user then successfully managed to enter the PIN and could boot up his laptop (and, by the way, we could get his recovery key from C:\).
Questions:
1) Has anybody else experienced this?
2) Does Manage-BDE return anything at all? It seems strange to me that ZTIBDE.WSF doesn't check for its return code as the script checks for errors in a million places.
3) Is there any easy way I can check whether the AD info is actually stored? I was thinking to write some code to query AD for that computer and see if the BL info actually are there. Maybe Manage-BDE can provide that?
Many thanks.

Hi,
This link has all the information you need. And more importantly which policies to create.
I have managed to do this implementation myself, and can only state that it works like a charm.
See a copy/paste of the bit-locker section I have configured in the customsettings.ini when doing deployments with MDT:
[HP Elitepad 900]
SkipTaskSequence=YES
TaskSequenceID=OSD001
; Bitlocker Configuration
BDEInstallSuppress=NO
BDeWaitForEncryption=False
BDEDriveLetter=S:
BDEDriveSize=2000
BDEInstall=TPM
; OSDBitLockerCreateRecoveryPassword=AD
BDERecoveryKey=AD
BDEKeyLocation=C:\Windows\BDEKey
Hope this helps!
If this post is helpful please click "Mark for answer", thanks! Kind regards

Similar Messages

MBAM bitlocker-protected removable drives recovery keys saved on sql database not active directory

Hi Guys
I need help in saving bitlocker protected removable drives on the sql database instead of active directory .
I have tried to play around with the policy and I am not winning , currently my GPO : Choose how bitlocker-protected removable drives can be recovered has only the allow data recovery agent chosen and I have left out all the AD DS option unticked
Please point me in the right direction on how to achieve this , I want all my keys in a SQL database so the users can recover the keys themselves using the mbam helpdesk website

Under client management, define your endpoint URLs. You can see the help and the description section for that particular policy. Copy and paste the URL removing the port number and replace the name of the Server with that of your MBAM Web server.
Also, Disable or don't configure the policy "Choose how bitlocker protected removable Drives can
be recovered".
This will save your recovery keys to the MBAM DBs.
Gaurav Ranjan

Manage-bde command is not generating recovery key on network location

Hi,
I am trying to save the recovery key to the network share location and start up key in the USB drive while enabling bit locker.When the OS drive gets encrypted, the default folder for recovery password shows that it contains 1 file but not getting anything
inside it when i checked the properties of the folder.
i have already changed the group policy as "choose default folder for recovery password".
I am using the command to enable the bit-locker as "manage-bde.exe -on C: -rk
<network location to save recovery key> -sk <location of the USB drive>
-rp to enable the bit-locker. It is generating the start up key in the USB but not the recovery key on network share.
Can anyone suggest what i am missing or what else i should do to generate the recovery key on network share.
Does manage-bde process be able to save the recovery key on network share or it hand over to some other process to perform this task.
Thanks
Gaurav Ranjan

I got you Manoj, but I want to ask you one think that what if i lost the startup key or my USB stick. I have my recovery key on the network share. In order to log-in my machine I need the recovery password. From where i will get the recovery
password(48 digit). Surely from the recovery key on the network share. So how can i get the recovery password if only we have the recovery key.
I know both are different in context. Both are two different thing. I have lost my USB stick along with the recovery password and I have to log-in my machine. How can i do that i want to know that. Do there is any method to get recovery password from the
recovery key on network share. I have retrieved the recovery password when the recovery key in AD. But this time it is on network share.
Also one think which I need to solve is that the manage-bde -protectors -add command creates a new .bek file along with the older one. So the .bek file which get shown at the time of the start up of the machine is different from that stored in the network.
So i am getting confused as which .bek file is for which machine and hard to retrieve the password.
Is there any method to store recovery key on network without the -protectors -add command line so that both the .bek file should be matched and can easily be known for indiviual machine in an OU. As if both the .bek files will be different it would be difficult
to to retrieve the recovery password for the machines.
Please do inform if you need some more information about the scenario if i missed something.
Thanks
Gaurav Ranjan

Bitlocker enabled drive, recovery key needed during boot, PCS did not match, event id 24635, source bitlocker-driver

Hi
After rebooting one of our test machines, bitlocker wanted the recovery key.
There were no hardware modifications on that machine.
Error message in event log:
Bootmgr failed to obtain the bitlocker volume master key from the TPM because the PCRs did not match
Event id 24635, source bitlocker-driver
Each time the machine starts, the recovery key is needed.
Any idea how to solve that issue and why it happens?
update:
Second partition was created manually on that machine. So that's clear that bitlocker reacts...
But now: how can I confirm those changes so that the recovery key is not needed each time we boot?

Hi,
I would like to confirm if BitLocker accepts the recovery key?
Please update the BIOS to improve the stability for TPM first.
I also would like to suggest you disable and enable BitLocker again to reset the settings.
For more information, please refer to the following link:
http://technet.microsoft.com/en-us/library/dd835565(WS.10).aspx
Regards,
Arthur Li
TechNet Subscriber Support
in forum
If you have any feedback on our support, please contact
[email protected]
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Bitlocker requests recovery key every time

I have a T440s. The motherboard died and was replaced by Lenovo. I had Bitlocker drive encryption enabled. Now, ever time I reboot, I am required to enter the Bitlocker Recovery Key. I can't figure out how to fix this so I don't have to type it every time!
I've tried, to no avail:
1) In BitLocker Manager, I clicked on "Suspend Protection" and then "Resume Protection". When I reboot, I get prompted for recovery key again.
2) In BitLocker Manager, I clicked on "Suspend Protection", rebooted and wasn't asked for the Recovery Key. But, on subsequent reboots, I am asked for recovery key. I read that Protection is automatically enabled (after Suspend) on next boot.
3) Ran this commands at elevated command prompt:
Manage-bde -protectors -delete C: -type TPM
and I get this error msg:
Volume C: []
Key Protectors of Type TPM
ERROR: No key protectors found.
I've googled quite a bit and can't figure out what else try, short of decrypting the drive and reencrypting it.
Thank you!

I have Win 8.1. Yeah, I checked via tpm.msc and it looks like TPM is activated:
Status: "The TPM is ready for use."
And under TPM Manufacturer Info, it says Manf Name: TPM, Manf Version: 13.12, Specification Version: 1.2.
And in the Actions on right pane, "Prepare the TPM" is greyed out. And these actions are available: Turn TPM Off, Change Owner Password, Clear TPM, and Reset TPM Lockout.
I've been wondering about turning TPM off and on. Would that screw things up?

Bitlocker no recovery key, no access to computer.

During some standard automatic updating, bitlocker became active ( I dont know how ).
When I tried to log-on next time I was asked for the "Windows Bitlocker Drive Encryption Recovery Key", I don't have it.
Is there a way to access the laptop. I can prove it is mine and have all the required No's for the machine and the windows-7 OS.

Have a look at similar thread : https://social.technet.microsoft.com/Forums/en-US/594c3109-c800-4b3e-aac9-c93bccc38d4e/how-to-unlock-a-drive-protected-by-bitlocker-without-its-password-and-recovery-key-i-lost-my?forum=w7itprosecurity
Arnav Sharma | http://arnavsharma.net/ Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading
the thread.

BitLocker Drive Encryption Recovery Key

I have a Dell Optiplex 7010 running Windows 7 Enterprise 64-bit. Intermittently when booting the computer the Windows BitLocker Drive Encryption Recovery Key Entry screen shows up. Most of the time I can power off the computer and then turn it back on and
it loads Windows without that screen showing up. If powering it off and back on again doesn’t get me past the Windows BitLocker Drive Encryption Recovery Key screen, I will enter the recovery key.
I have already reimaged the computer, replaced the hard drive, cleared Bitlocker Cache in the BIOS and have updated the BIOS to the latest version.
Any ideas to keep the Windows BitLocker Drive Encryption Recovery Key Entry screen from showing up?

Hi,
I have already reimaged the computer, replaced the hard drive, cleared Bitlocker Cache in the BIOS and have updated the BIOS to the latest version.
Did you mean you have re-install the OS? Did you use another clean image rather than capturing the old OS?
Did you encrypt the OS partition?
Please use below command to check the status:
manage-bde -status
If there is any volume is encrypted, use below command to turn it off:
manage-bde -off C:
Karen Hu
TechNet Community Support

TS4036 where does icloud store my mac osx recovery key?

where does icloud store my mac osx recovery key for file vault?

Note that you have to have specifically chosen to store the key with Apple at the time you created the FileVault encryption, and chosen security questions so that you can identify yourself when you come to retrieve it. If you did not store it with Apple in this way and do not have a record of it elsewhere then you cannot proceed. All this has nothing to do with iCloud and the process is not automatic.

I can not access my hard disk protected by Bitlocker drive despite the right recovery key

I had locked my 1 TB harddisk 1 year back with BitLocker Drive. I have been using its recovery key to unlock it since then. But since 3 days back, it has been displaying the message " Error recovering disk. The recovery key entered is not correct, try
it again." And I am not able access my important documents despite of having the right key.
Please help me. Thanks alot in advance.

One of the greatest feature of MBAM is single-sign of Recovery Key which means if a recovery key is used once, it will be automatically re-generated. So, first match the 8 digit starting of Recovery ID with its associated recovery key.
Or re-request for the Recovery Key to your MBAM Administrator by providing him the starting 8 digit recovery ID. You can also get the recovery key again using the MBAM self-Service Portal.
Gaurav Ranjan

Bit Locker Recovery key lost

hi,
i recently formated my system. i lost my bit locker recovery key.
how to remove bit locker to the drive.
i tried these....
C:\Windows\System32>manage-bde -status J:
BitLocker Drive Encryption: Configuration Tool version 6.1.7600
Copyright (C) Microsoft Corporation. All rights reserved.
Volume J: [Label Unknown]
[Data Volume]
Size: Unknown GB
BitLocker Version: Windows 7
Conversion Status: Unknown
Percentage Encrypted: Unknown%
Encryption Method: AES 128 with Diffuser
Protection Status: Unknown
Lock Status: Locked
Identification Field: Unknown
Automatic Unlock: Disabled
Key Protectors:
Numerical Password
External Key
External Key
C:\Windows\System32>manage-bde -protectors j: -get
BitLocker Drive Encryption: Configuration Tool version 6.1.7600
Copyright (C) Microsoft Corporation. All rights reserved.
Volume J: [Label Unknown]
All Key Protectors
Numerical Password:
ID: {CA7EA469-38CE-4E7E-814D-292A06DF8819}
External Key:
ID: {D70EAC47-DEBB-480A-BFFC-E74479BDDBC1}
External Key File Name:
D70EAC47-DEBB-480A-BFFC-E74479BDDBC1.BEK
External Key:
ID: {2BD85A61-C76F-4433-8DE6-48651047AF6C}
External Key File Name:
2BD85A61-C76F-4433-8DE6-48651047AF6C.BEK
C:\Windows\System32>
how to solve these. help me

Hi，
If you lost recovery key and are unable to access the disk at this moment, then I'm sorry but I have to say that you're lost. If the data in that encrypted drive is very important for you, then you might need a data recovery center to help you.
Yolanda Zhu
TechNet Community Support

AD contains system Recovery Key, but not showing in MBAM.

I am in an environment with MBAM 1.0 installed. I built the MDT 2013 system here and am currently trying to figure out why the bitlocker keys are showing up in AD but not MBAM.
In MDT, I have disabled the "enable bitlocker" options so there shouldn't be a case where that the TPM ownership is wrong (I think). I do however set the
bios password with CCTK, then apply the default bios configuration with an ini via cctk. The bios sets and activates tpm just before the hard disk is formatted by LTI.
q1. Could setting the TPM without restarting cause the TPM ownership to be set to the PE in some weird way.
q1.1. would I clear the tpm if this is the issue?
So MBAM client is installed on the reference image and captured by MDT. The WIM is then deployed to a system using a standard TS with the bitlocker disabled like
I mentioned above. I do not make any changes to reg for mbam in the reference image. For testing, I tried adding the mbam recovery key location url to the reference image reg. I still need to test that but a few other tests I did makes me believe this
is not the case.
MDT binds the system to a default OU in the domain. After the system is configured, I start Bitlocker. (Sometimes I start bitlocker when the system is in the default
OU, sometimes I start it after I move them into the right ou for the role). I am almost positive the default OU has the mbam settings (I do not have access to this gpo), since the manage-bde -status comes back AES 128 with diffuser (as compared to regular
aes 128).
After bitlocker finishes, the key is found in AD but not mbam.
I think the major questions I have are:
How can I force MBAM to take ownership of the TPM after the os is bitlockered? (about 100/700 machines are not reporting to mbam but are to bitlocker because of this new deployment system)
If I turn TPM on and activate while I was in the PE, would that mean the PE has the TPM ownership? (or bitlocker in this case, since mbam is not installed on the PE)
- Could I install MBAM on the PE and use that to manage the tpm? (MDT 2013) (I have seen some documents that cover this but it largely comes from wanting a pre-provisioned bitlocker.)
** I think the most manual way of correcting the issue I am having, is to either clear the tpm and rebitlocker, or
.. when a system is about to image, turn tpm on but leave it deactivated. (If I leave the tpm deactivated, every system will need to be manually rebooted and f10 will need to be pressed to continue the bitlocker process. this includeds
a user login too)

Keep the MBAM out of the .wim! Install it in task sequence.
MBAM Client has its own log files in event viewer, there you perhaps find the reason why recovery key is not stored in DP. But fix your image first, keep it thin.

Escrow the recovery key in DB server and not in AD when removable drive is encrypted.

Is there any way to escrow the recovery key in the database server and not in AD when removable drive (USB drive) is encrypted via manage-bde command line? The data recovery agent is not enabled in our organization.
"Choose how bitlocker protected removable Drives can be recovered" for removable drives is disabled in our Group policy also.
Please advise. Thank you.

As far as I am concerned, you cannot do that when you are using the command line "Manage-bde".
The reason is because, the manage-bde command line parameters doesn't support saving recovery keys to databases. Also there is not any group policy defined for it.
I you want an option to save recovery keys in a database rather than the AD, I would recommend to use MBAM (Microsoft Bitlocker Administration and Monitoring).
Gaurav Ranjan

How do I take all the bookmarks on my android tablet and sync them with my desktop, if I've had to change my recovery key?

Anciallry to my profile During my attempts to when attempting to sync <pre><nowiki>1349979922766 1349979922789 Sync.Status 1349979922800 Sync.Status 1349979922809 Sync.Status 1349979922819 Sync.Status 1349979922819 Sync.Status 1349979925683 Sync.Status 1349979925704 Sync.ErrorHandler 1349979925705 Sync.Service 1349979925705 Sync.Service 1349979925706 Sync.SyncScheduler 1349979925706 Sync.Service 1349979925707 Sync.Status 1349979925707 Sync.Status 1349979925814 Sync.Resource 1349979925814 Sync.Resource 1349979925815 Sync.Service 1349979925815 Sync.Service 1349979925815 Sync.Service 1349979925815 Sync.Service 1349979925815 Sync.Service 1349979925815 Sync.CollectionKeys 1349979925815 Sync.Service 1349979925817 Sync.Engine.Clients 1349979925818 Sync.Engine.Clients 1349979925944 Sync.Collection 1349979925944 Sync.Collection 1349979925945 Sync.Engine.Bookmarks 1349979925945 Sync.Engine.Bookmarks 1349979926487 Sync.SyncScheduler 1349979926488 Sync.SyncScheduler 1349979926488 Sync.SyncScheduler the android device logs becoming corrupted on Desktop Computer A (windows 7), and a subsequent sync of the corrupt information to Desktop Computer B (OSX 10.6), I'm left with all 1400ish bookmarks residing on Mobile Device C (Android Tablet).
restore, I had firefox services generate a new Recovery Key, prior to my knowing that my bookmarks were stored in "C".
now, on the desktop, i see:
Sync.Service DEBUG Exception: Component returned failure code: 0x80070057 (NS_ERROR_ILLEGAL_VALUE) [nsINavBookmarksService.removeFolderChildren] Stack trace: BStore_wipe()@resource:///modules/services-sync/engines/bookmarks.js:1253 < <file:unknown> < Engine__wipeClient()@resource://services-sync/engines.js:498 < <file:unknown> < WrappedNotify()@resource://services-sync/util.js:142 < <file:unknown> < Engine_wipeClient()@resource://services-sync/engines.js:504 < <file:unknown> < resource:///modules/services-sync/service.js:1563 < <file:unknown> < WrappedNotify()@resource://services-sync/util.js:142 < <file:unknown> < WeaveSvc_wipeClient()@resource:///modules/services-sync/service.js:1548 < resource:///modules/services-sync/service.js:1246 < <file:unknown> < WrappedNotify()@resource://services-sync/util.js:142 < WrappedLock()@resource://services-sync/util.js:97 < <file:unknown> < _lockedSync()@resource:///modules/services-sync/service.js:1186 < resource:///modules/services-sync/service.js:1177 < <file:unknown> < WrappedCatch()@resource://services-sync/util.js:71 < <file:unknown> < sync()@resource:///modules/services-sync/service.js:1165 < <file:unknown> < <file:unknown>
DEBUG Status.service: success.status_ok => success.status_ok
DEBUG Status.service: success.status_ok => success.status_ok
DEBUG Status.service: success.status_ok => success.status_ok
DEBUG Status.service: success.status_ok => success.status_ok
DEBUG Status.service: success.status_ok => success.status_ok
DEBUG Status.service: success.status_ok => success.status_ok
DEBUG Beginning user-triggered sync.
DEBUG User-Agent: Firefox/15.0.1 FxSync/1.17.0.20120905151427.
INFO Starting sync at 2012-10-11 13:25:25
DEBUG Clearing sync triggers and the global score.
INFO In sync().
INFO Resetting Status.
DEBUG Status.service: success.status_ok => success.status_ok
DEBUG mesg: GET success 200 https://scl2-sync623.services.mozilla.com/1.1/vq5tgzklyepycf5agigiay47ime5ytho/info/collections
DEBUG GET success 200 https://scl2-sync623.services.mozilla.com/1.1/vq5tgzklyepycf5agigiay47ime5ytho/info/collections
DEBUG Fetching global metadata record
DEBUG Weave Version: 1.17.0 Local Storage: 5 Remote Storage: 5
INFO Sync key is up-to-date: no need to upgrade.
DEBUG Fetching and verifying -- or generating -- symmetric keys.
INFO Testing info/collections: {"passwords":1349979572.28,"tabs":1349979636.47,"clients":1349979114.63,"crypto":1349974699.42,"forms":1349979571.23,"meta":1349975849.38,"prefs":1349975802.81,"bookmarks":1349976817.63,"addons":1349979226.66,"history":1349979571.65}
INFO Testing for updateNeeded. Last modified: 1349974699.42
DEBUG Refreshing client list.
INFO 0 outgoing items pre-reconciliation
INFO Records: 0 applied, 0 successfully, 0 failed to apply, 0 newly failed to apply, 0 reconciled.
DEBUG mesg: GET success 200 https://scl2-sync623.services.mozilla.com/1.1/vq5tgzklyepycf5agigiay47ime5ytho/storage/bookmarks?full=1&sort=newest&limit=1
DEBUG GET success 200 https://scl2-sync623.services.mozilla.com/1.1/vq5tgzklyepycf5agigiay47ime5ytho/storage/bookmarks?full=1&sort=newest&limit=1
DEBUG Resetting bookmarks last sync time
DEBUG Deleting all local data
DEBUG Sync error count has exceeded 3; enforcing backoff.
DEBUG Starting client-initiated backoff. Next sync in 2777931 ms.
DEBUG Next sync in 2777931 ms.</nowiki></pre>
arent as friendly to export, but i see similar complaints about crypto.

It sounds like your desktop profile is (still?) corrupt; it's failing to process the wipe on bookmarks. So let's be super thorough: we'll clean up the desktop, then reconnect so the Android device's data will replace it.
My suggestion is to do the following. Read all of the steps before you start. I recommend that your Android device is on wifi.
# On your Android device, go to Settings > Accounts & sync. Remove your Sync account. Your Firefox profile will be unchanged.
# On your desktop, create a new profile.
# On the new profile, assuming you want to re-use your Sync account, follow the instructions below.
# Re-pair your Android device with the new desktop profile, and wait for it to finish syncing before syncing the desktop.
Connecting to an existing sync account:
# Set Up Sync
# I have an account
# I don't have the device with me
# Enter username and password, choose "I have lost my other device"
# You'll get a dialog with a new recovery key. Choose "Change recovery key".
Let me know if you have any problems!

Cannot set up Firefox sync on desktop - no recovery key and will not let me login to get it

I downloaded Firefox for my new android phone and wanted to sync my desktop with the mobile app. When I first went in it said I had an account already set up, but since I didn't remember any of the information about it I just ended up changing the password so I could login, and then deleted the whole account.
I went ahead and set up a new sync account, but it never gave me a recovery key. I didn't think anything of it, but then the initial sync failed and I got an error message saying the username or password was incorrect.
This happened twice and each time I went back and either ended up resetting the password or deleting the whole account. But whenever I did go through the steps of creating another account it still never gave me a recovery key.
I looked around and tried following the steps to get a recovery key, but I don't have the option to manage my account (maybe because one was never fully created and never went through an initial sync?), and I keep getting an error message saying the username and password is incorrect whenever I try to go through the steps to reset the recovery key. This is despite the fact that I can login with those same credentials on the Firefox sync webpage - for whatever reason it just doesn't accept them in the normal browser sync tab.
I'm running Windows 7 Home Premium, and version 13.0.1 of Firefox. Any help you can give me would be most appreciated as this has been driving me nuts for the last several hours as I try to work through this.

See also:
*https://support.mozilla.org/kb/ive-lost-my-firefox-sync-account-information

Locked out of Apple ID AND lost Recovery Key for two-step verification

Hey guys,
Firstly, as the title implies, this is a double-whammy of a problem, and obviously, it is very much my fault. The reason I'm bothering to post this, however, is to find out if anyone else has had this issue and where they are at with it.
The story:
I set up two-step verification on my Apple ID about a year ago as I thought it was a good idea. I wrote the Recovery Key down as it told you to, and put it in a folder full of other important documents. In a epic mental lapse, however, I now remember later throwing out that folder, forgetting about my Recovery Key. Ya, that is my fault, I'm and idiot. Anyways...
Fast forward to a few days ago, and I all of a sudden received messages on all my devices saying that my Apple ID had been disabled for security reasons, and that I had to reset the account in order to regain access to it. Scary, but no problem, right? Well, after entering my Apple ID into iForgot.com, the first thing it asked me for was my Recovery Key. This is around the time I was banging my head against the wall in realization that I had thrown it away, but I was relieved to see the "Lost your Recovery Key?" option at the bottom of the screen. I was even more relieved to discover that I had what I needed to reset it: my current password and a trusted Apple device. The catch was that to reset it, I needed to log into my Apple ID to initiate it, which of course I couldn't do because it had been disabled, and the only way for me to disable it is, again, to enter in my Recovery Key. This effectively put me in and endless loop, without any apparent way of gaining accesses to my account. I did contact Apple about it, and I was ultimately told that the lock on my account was so tight, that not even Apple could gain access to it.
I understand that this level of security is probably the whole reason for the two-step verification in the first place, and I again concede that it was extremely foolish of me for forgetting about and discarding my Recovery Key, but a few things still don't make sense...
1. Why would they put a "Lost your Recovery Key?" link on the password recovery page when a password is needed to reset the Recovery Key itself?
2. As far as I can remember, Apple, in their briefing of how two-step verification works, did not bring up this scenario, which is probably relatively common. They DO mention that they can't help when you don't have access to two of the three necessary things for recovery, but they never brought up the apparent exception of if the account is disabled, in which case having two of the three things needed is not enough. I don't understand how they couldn't have mentioned this scenario.
3. Given the above thought, how could Apple not have some sort of special contingency for this type of situation? I profess my ignorance of how these types of systems are set up, but I would feel that there should be a special method for recovery in place if the account has been locked, and the owner is able to verify that they have the password and trusted devices.
I didn't mean to make it sound like a rant. I ADORE Apple, but this system seems like it's less than perfect.
Has anyone else ran into this issue? If so, is your situation similar to mine?
Thanks for any response!

Hey everyone.
It's been awhile, but I wanted to share with anyone who is interested some general knowledge about this issue that I have learned while communicating with Apple support. Unsurprisingly, the issue is still unresolved, and I am under the impression that it will remain that way, but I'm still trying to get in touch with one of the senior representatives I spoke with a while ago who seemed to think that there might be a solution, so I suppose there is still a chance that things could turn out for the better.
Here's the rundown:
Anytime you are unable to sign in to or access your account because of "security reasons", your account is under what is called a "DS Lockout".
A DS Lockout on an Apple ID can be triggered for a few reasons, such as when too many failed logins to the Apple ID (using an incorrect password) are attempted, or when a purchase is made that Apple believes to be fraudulent.
Under normal circumstances, a DS Lockout only lasts for 8 hours, after which the lock is lifted and access to the account by inputting the correct password is re-enabled.
This is where the catch for anybody who set up two-step verification is.
According to one of Apple's security representatives, IF you have two-step verification enabled upon being inflicted with a DS Lockout, the 8-hour lockout period is extended indefinitely as an additional security measure (a feature, I suppose). Therefore, the only way to regain access to the account is by resetting the password, as waiting for the lockout to expire is no longer an option. And of course, resetting your password, as stated by Apple, is one of the situations in which you need your Recovery Key. EVEN IF YOU KNOW WHAT THE ACCOUNT'S CURRENT PASSWORD IS, the lockout prevents you from being able to input it as a means of authentication. You MUST reset your password in order to regain access, and you MUST input your recovery key in order to reset your password.
So, that seems to be the gist of it. It does make sense, but here's my problem:
Upon setting up two-step verification, Apple does warn you of many things, but they do not make any mention of this specific scenario. Indeed, it is very much my fault for loosing my verification key, but the thing is, I’m human, I make mistakes, and I know that I will continue to do so. One of the reasons I chose to take the risk of setting up two-step verification is because Apple explicitly stated that as long as I had access to two of the three required "keys" -- my Recovery Key, my password, and at least one of my trusted Apple devices -- I would always be able to gain access to my account. In other words, as long as I didn’t screw up so bad as to loose access to two of my keys, I’d be okay. Obviously, there is a huge exception to this case that, again, is not mentioned anywhere, hence all the confusion. Had I know that it was possible that it could come down to me needing a single, specific key to regain access to my account, I probably would have opted out of two-step verification, recognizing that as a busy college student who's constantly reorganizing and dealing with tons of forms, worksheets, and other various documents, it's not as easy to hold on to a slip of paper as it might be for others. I'm hoping that at some point, Apple adds a big, red warning to the setup process which reads something like:
"In the event that your Apple ID is locked due to a detected security risk, your Recovery key will be necessary to regaining access to your account; knowing your password and/or having access to any of your trusted devices will no longer be enough."
I really do appreciate how seriously Apple takes its security, but I think that there is still room for improvement. This should start with more clearly and fully stating the conditions of its security measures, as well as having its customer support be more educated on these conditions (they themselves stated that they had never been trained on issues revolving around two-step verification). Protecting someone's private information is important, but so too is making every possible effort to ensure that customers can't easily loose access to all the content and services that they have spent much time and money building up and using.
As stated above, I'm still trying to get a hold of the Apple representative who initially assisted me, so if I have any additional updates, I'll be sure to reply to this thread. I hope that anyone who is going through the same issue, or is simply curious, finds this information to be useful.

Bitlocker fails to store recovery key in AD

Similar Messages

Maybe you are looking for