Manage-bde command is not generating recovery key on network location

Hi,
I am trying to save the recovery key to the network share location and start up key in the USB drive while enabling bit locker.When the OS drive gets encrypted, the default folder for recovery password shows that it contains 1 file but not getting anything
inside it when i checked the properties of the folder.
i have already changed the group policy as "choose default folder for recovery password".
I am using the command to enable the bit-locker as "manage-bde.exe -on C: -rk
<network location to save recovery key> -sk <location of the USB drive>
-rp to enable the bit-locker. It is generating the start up key in the USB but not the recovery key on network share.
Can anyone suggest what i am missing or what else i should do to generate the recovery key on network share.
Does manage-bde process be able to save the recovery key on network share or it hand over to some other process to perform this task.
Thanks
Gaurav Ranjan

I got you Manoj, but I want to ask you one think that what if i lost the startup key or my USB stick. I have my recovery key on the network share. In order to log-in my machine I need the recovery password. From where i will get the recovery
password(48 digit). Surely from the recovery key on the network share. So how can i get the recovery password if only we have the recovery key.
I know both are different in context. Both are two different thing. I have lost my USB stick along with the recovery password and I have to log-in my machine. How can i do that i want to know that. Do there is any method to get recovery password from the
recovery key on network share. I have retrieved the recovery password when the recovery key in AD. But this time it is on network share.
Also one think which I need to solve is that the manage-bde -protectors -add command creates a new .bek file along with the older one. So the .bek file which get shown at the time of the start up of the machine is different from that stored in the network.
So i am getting confused as which .bek file is for which machine and hard to retrieve the password.
Is there any method to store recovery key on network without the -protectors -add command line so that both the .bek file should be matched and can easily be known for indiviual machine in an OU. As if both the .bek files will be different it would be difficult
to to retrieve the recovery password for the machines.
Please do inform if you need some more information about the scenario if i missed something.
Thanks
Gaurav Ranjan

Similar Messages

Manage Account does not appear in the options sync tab. How do I manage my account to get the recovery key?

I cannot sync my Firefox 18 desktop with iPad or iPhone browsers. I have tried everything suggested on the Web and have tried safe mode as well. When I enter the three-line synch code, I get a sync failure. I have deleted my account and then set up a new account without success. Manage Account does not appear in the options sync tab. How do I manage my account to get the recovery key?
I’ve spent hours on this and am considering using Chrome as my regular browser since I have no trouble syncing Chrome with apps. Help appreciated.

You can only inspect the sync key via manage account if this device is has been setup and is connected to the sync server.
You can find the sync account password and the sync (recovery) key in the password manager on computers where a sync account with a specific e-mail address has been set up.
Look for:
* chrome://weave (Mozilla Services Password)
* chrome://weave (Mozilla Services Encryption Passphrase)
You can look at this version of the about:synckey extension that I have modified to show the sync key in current Firefox versions (desktop and mobile).
* http://www.freefilehosting.net/aboutsynckey-11-fnfx
* [[/questions/942893]]

Jheadstart oes not generate NLS key in resource bundle for Static domains

Hello
according to jhsdevguide1013 on section 6.5.2 about "Translation of static domains" when I check "Generate NLS-enabled prompts and tabs" and run application generator , Jheadstart oes not generate NLS key in resource bundle for Static domains.
Does anybody can help us for this problem?

Thank you for reporting this, I have logged it as a bug.
As a workaround, you can customize the Generator Template default/item/staticDomainOptions.vm
See http://blogs.oracle.com/jheadstart/2006/11/30#a108 for an example how to let a template generate extra resource bundle keys.
Hope this helps,
Sandra Muller
JHeadstart Team
Oracle Consulting

Rescue and Recovery failed destination network location can no longer be reached

W510, running Windows 7 Pro SP1, updated with ThinkVantage including BIOS 1.37 along with Rescue and Recovery 4.31 yesterday. Using Backup locations "Local hard drive" had not problem, but when it was set to "Network", it gave me "The backup failed because the destination network location can no longer be reached.". Prior to running RR, I manually mounted the shared drive on W510 and could read and write files. The user that mounted the shared drive was not "Administrator" but has Administrator privilege. The network shared drive was a folder on an Windows XP SP3 computer.The shared drive had Full Control granted to Everyone as well as for Sharing. I rebooted W510 before starting RR. After the "network location can no longer be reached" error popped up, a long while later, RR actually wrote some files in the shared drive and then finally it aborted. It created on the shared drive RRBackups\SZ\<UUID>\... (among other folders and files); under <UUID> there's a common\rr.log with:
Sun May 22 01:56:39 2011 RescueRecovery: Running: C:\Program Files (x86)\Lenovo\
Rescue and Recovery\br_funcs.exe backup level=0 destination="\\192.168.0.1\W510_
backup\RRbackups\SZ\D0D186C05DAE11E0-9303F5C431248DAC" drive=C: location=16 nice
=0 pw=0 uuid=0 compress encrypt
Sun May 22 02:04:15 2011 RescueRecovery: br_funcs returned error code 0x501
Sun May 22 02:04:15 2011 RescueRecovery: Running: C:\Program Files (x86)\Common
Files\Lenovo\mnd\mapdrv.exe *
Sun May 22 02:04:15 2011 RescueRecovery: Get the shutdown flag from service is 0
Sun May 22 02:04:48 2011 RescueRecovery: CRRBackup::removeLevel() - DeleteFile(\
\192.168.0.1\W510_backup\RRbackups\SZ\D0D186C05DAE11E0-9303F5C431248DAC\common\b
t0.dat) failed. Error 3
Sun May 22 02:04:48 2011 RescueRecovery: In GetBackupFolderName, UUID is D0D186C
05DAE11E0-9303F5C431248DAC!
Sun May 22 02:04:48 2011 RescueRecovery: In CreateSpecialBackupFolder, get szBackupFolder is C:\RRbackups\SZ\D0D186C05DAE11E0-9303F5C431248DAC
Sun May 22 02:04:48 2011 RescueRecovery: CreateSpecialBackupFolder: szBackupFolder= C:\RRbackups, szMidiumFolder = C:\RRbackups\SZ
The events don't make sense:
a) Why would RR says "network location can no longer be reached" - the wording suggests that it was OK, but now it isn't.
b) The br_funcs returns Error 0x501 (NOT_IMPLEMENTED or NOT_SUPPORTED), but RR still attempted to call mapdrv.
c) Apparently mapdrv was successful otherwise it shouldn't try to delete the t0.dat on the shared drive (which didn't exist - hence Error 3 (PATH_NOT_FOUND)) and unless it has reached the remote computer, it wouldn't know the file wasn't there.
I'm curious to find out if anyone has run into this problem and how to fix it.

It errored out after it has already created some folders and files as indicated in the first post.Tried the same steps several times just make sure it was repeatable by closing Rescue and Restore app and starting it again. The network between the share host and my W510 was a direct RJ45 cable connection, so zero hop. In the end I used Windows 7 Backup and Restore to do full backup, using the same \\server\sharename, the network share was mapped without a problem. But then Windows 7 Restore CD wasn't able to map network share - giving me 0x800704cf. Googling shows lots questions raised on this but no fix.
Update:
Last night, I gave it a shot again. For some reason, RR was able to mapped the network share using \\IPaddress\sharename (this time I used a different folder and a diferent sharename). OK great, but after 10 hrs it's at 88% completion, did my math, estimated elasped time is 12 hrs, Wow! The image backup with Windows 7 Backup took 5 hr 51 min with 132GB in the WindowsImageBackup folder. RR is 2x slower!
On the other hand, as it's still running, the est. backup folder size is 106GB. RR does a better job in compression - a 20% reduction in size compared with Windows' at the cost of 2x time.
Going back to the Windows 7 Restore CD 0x80704cf error when mapping the network share, found an Internet user posting that he succeede by providing a NIC driver.

Rescue and recovery destination network location can no longer be reached

T61, Windows XP, R&R 4.21.
R&R always worked. Several months ago, I pointed it to the network and a NAS unit. That worked too. And several backups were made.
The last backup was 11/05/2011 (ie 11th of may). Since then backups and deletes of backups have failed with
Destination network location can no longer be found.
I can mount the drive and browse it so the drive is available. The previous R&R backups are there.
Any ideas what the fix is on this?
regards,
john

While we are waiting for someone with a reasonable answer...
I've seen something similar (with a USB drive) when the maximum backup space limit set it R&R advanced is hit. At least in the R&R/XP version I was using, all backups simply became invisible until the limit was increased.
Your error message doesn't really indicate this, but maybe it's worth a try.
Z.
The large print: please read the Community Participation Rules before posting. Include as much information as possible: model, machine type, operating system, and a descriptive subject line. Do not include personal information: serial number, telephone number, email address, etc. The fine print: I do not work for, nor do I speak for Lenovo. Unsolicited private messages will be ignored. ... GeezBlog
English Community Deutsche Community Comunidad en Español Русскоязычное Сообщество

Managed Ports in DFM not generating alert

I've just added a new 3750 switch in DFM. It is in known status and the ports that I want to managed are set to TUE. However, I do not get any alert in DFM console whenever one of the managed ports go down. I have tried to delete and rediscover this device from DFM but still the same.

I missed that you said you "typed" the shutdown command. This won't work. If a managed port/interface is shutdown, then DFM considers that a healthy state. That is, the administrator has said, "this port is not being used." No event will be generated. To really test DFM, you need to "no shut" the port, then unplug it. That should generate an event after about four minutes.

MDX command does not generate records: "NO RECORDS GENERATED"

Dear Experts,
I am testing MDX command we are going to use in Cashflow calculation. Although I am aware this is not typical way to do this (usually account-based calculation business rule does the job) but there are some other factors and we really want to do that in script.
I created a very simple script:
// CASHFLOW TEST
*XDIM_MEMBERSET TIME = 2014.JAN
*XDIM_MEMBERSET ENTITY = DK10
*XDIM_MEMBERSET CATEGORY = ACTUAL
*XDIM_MEMBERSET CONSOSCOPE = G_NONE
*XDIM_MEMBERSET AUDITID = IMPORT_LPM
[ACCOUNT].[#12220_F220] = ([ACCOUNT].[12220],[FLOW].[F220])
*COMMIT
but the script does not behave as I am expecting it to behave. Basically no single record gets generated by the script.
I am attaching the log. I have triple-checked the data region in question for the account 12220 and it is populated with the value.
Am I doing someting wrong?
Thank You!
Marek

Hello Marek,
I understand. If you need any documentation on MDX and Script Logic please let mw know.
You should take a look at this Performance Analysis and Optimization for BPC 10 , in particular to this part:
MDX and RSDRI query
As already recommended for BPC 7.5 splitting the report into MDX and RSDRI(SQL) queries has an positive impact on performance. By using one MDX query (as small as possible) and one RSDRI query (as large as possible) the best performance improvements were achieved. RSDRI queries are much faster, but can only be used for base level members (without aggregation). For the examples mentioned above the best performance was achieved with a split into two reports and Europe rows and 2012-Total columns as Local Members. The DB query time was reduced from about 20 seconds to 2.3 seconds while the client rendering time doubled from about 1 second to nearly 2 seconds.
Figure 10: Measurements of split reports
Thank you.
Best regards,
Raquel

Manage-bde Status states "Protection Status: Protection Off"

I have many machines that are encrypted, but say "Protection Off" and are therefore failing compliance in MBAM 1.0. Here is what their status looks like:
P:\>manage-bde -status -cn AAAAAA
BitLocker Drive Encryption: Configuration Tool version 6.1.7601
Copyright (C) Microsoft Corporation. All rights reserved.
Computer Name: AAAAAA
Disk volumes that can be protected with
BitLocker Drive Encryption:
Volume C: [OSDisk]
[OS Volume]
Size: 297.60 GB
BitLocker Version: Windows 7
Conversion Status: Fully Encrypted
Percentage Encrypted: 100%
Encryption Method: AES 256 with Diffuser
Protection Status: Protection Off
Lock Status: Unlocked
Identification Field: None
Key Protectors:
Numerical Password
TPM And PIN
If I run the command: manage-bde -on c: -cn AAAAAA
....it seems to fix the problem. See how now the protection is on?
P:\>manage-bde -on c: -cn AAAAAA
BitLocker Drive Encryption: Configuration Tool version 6.1.7601
Copyright (C) Microsoft Corporation. All rights reserved.
Computer Name: AAAAAA
Volume C: [OSDisk]
[OS Volume]
NOTE: This command did not create any new key protectors. Type
"manage-bde -protectors -add -?" for information on adding more key protectors.
NOTE: Encryption is already complete.
Turned on BitLocker protection by enabling key protectors.
P:\>manage-bde -status -cn AAAAAA
BitLocker Drive Encryption: Configuration Tool version 6.1.7601
Copyright (C) Microsoft Corporation. All rights reserved.
Computer Name: AAAAAA
Disk volumes that can be protected with
BitLocker Drive Encryption:
Volume C: [OSDisk]
[OS Volume]
Size: 297.60 GB
BitLocker Version: Windows 7
Conversion Status: Fully Encrypted
Percentage Encrypted: 100%
Encryption Method: AES 256 with Diffuser
Protection Status: Protection On
Lock Status: Unlocked
Identification Field: None
Key Protectors:
TPM And PIN
Numerical Password
My question is: Why are so many machines in this state, and is it safe for me to just run the "manage-bde -on c: -cn AAAAAA" on them or could it cause problems?

I mean to say, it's the MBAM agent who sends information to the MBAM Server about the recovery keys and TPM information. So when you are using manage-bde commands for encryption, the recovery keys will not get stored to the MBAM DBs.
What you need to do is to start the encryption with manage-bde and then at the next client wake up frequency which you have set in your environment, MBAM Agent will send the recovery information to the MBAM web servers an dthen the recovery keys will be
stored to the MBAM DBs.
But in this case also, TPM ownership information will not get stored to the MBAM DBs. For that you need to run a script if you have saved the TPM information in Active Directory. I have posted the script on Technet Gallery.
Let me know if you have any more issues.
Gaurav Ranjan

Bitlocker fails to store recovery key in AD

I am deploying Windows 8.1 with Bitlocker with TPM and PIN and recovery keys stored in AD.
This works fine for most deployments but rarely Manage-bde fails to store the Recovery key into AD. This only happened three times over about 200 deployments.
I have checked the ZTIBDE.WSF script and I have noticed that the command is launched but there is no check on its return code. I am not even sure if Manage-bde actually returns any. Therefore for the failed deployments I don't know why the recovery key wasn't
stored and also I din't get any report that it actually failed. The only reason we realised that is because one user had problems in getting the PIN to work and required the Recovery Key. To our surprises this was not in AD! This is then when we checked
all AD objects and found only three didn't have it. Looking at the deployment logs there are no errors for these.
Luckily the user then successfully managed to enter the PIN and could boot up his laptop (and, by the way, we could get his recovery key from C:\).
Questions:
1) Has anybody else experienced this?
2) Does Manage-BDE return anything at all? It seems strange to me that ZTIBDE.WSF doesn't check for its return code as the script checks for errors in a million places.
3) Is there any easy way I can check whether the AD info is actually stored? I was thinking to write some code to query AD for that computer and see if the BL info actually are there. Maybe Manage-BDE can provide that?
Many thanks.

Hi,
This link has all the information you need. And more importantly which policies to create.
I have managed to do this implementation myself, and can only state that it works like a charm.
See a copy/paste of the bit-locker section I have configured in the customsettings.ini when doing deployments with MDT:
[HP Elitepad 900]
SkipTaskSequence=YES
TaskSequenceID=OSD001
; Bitlocker Configuration
BDEInstallSuppress=NO
BDeWaitForEncryption=False
BDEDriveLetter=S:
BDEDriveSize=2000
BDEInstall=TPM
; OSDBitLockerCreateRecoveryPassword=AD
BDERecoveryKey=AD
BDEKeyLocation=C:\Windows\BDEKey
Hope this helps!
If this post is helpful please click "Mark for answer", thanks! Kind regards

Escrow the recovery key in DB server and not in AD when removable drive is encrypted.

Is there any way to escrow the recovery key in the database server and not in AD when removable drive (USB drive) is encrypted via manage-bde command line? The data recovery agent is not enabled in our organization.
"Choose how bitlocker protected removable Drives can be recovered" for removable drives is disabled in our Group policy also.
Please advise. Thank you.

As far as I am concerned, you cannot do that when you are using the command line "Manage-bde".
The reason is because, the manage-bde command line parameters doesn't support saving recovery keys to databases. Also there is not any group policy defined for it.
I you want an option to save recovery keys in a database rather than the AD, I would recommend to use MBAM (Microsoft Bitlocker Administration and Monitoring).
Gaurav Ranjan

How to avoid the recovery key

I deployed MBAM2.5 and have a tricky issue: Recovery Key keep prompt after OS partition encrypted. If I
Open Control Panel - BitLocker Drive Encryption
Click Suspend protection
Once protection has been suspended, click Resume protection
Reboot
the issue resolved. I'm going to deploy Bitlocker to 3000 over computers and can't afford manual work. Anyone have any idea can help me to get ride of this prompt?
Jason

Jason, you´re right By suspend -> resume you only create a workaround of your main issue, and not having end resolution of your problem. Normally, after encryption you should not get recovery key promt. The behavior of yours is not normal. I´m not sure,
if the way of starting encyption is the problem here. But you should enforce MBAM client to initiate encryption process By group policies.
Usually recovery key promt comes after hardware change, sometimes it can be huge change of OS as well. I couldn´t find the right path to track down changes which causes this. One way is to low TPM profile with selecting only option 11 of all, but it´s bad
practise.

Remote Access Management Console - configuration issue with Network Location Server

2012 Std R2
The remote Access management console operation status shows all green except for network location server .
Error: There is no response from the network location server URL. DirectAccess connectivity might not work as expected, and DirectAccess clients located inside the corporate network might not be able to reach internal resources.
Resolution listed as:
1. Configure the network location server on a server that is highly available to clients on the internal network.
2. If the network location server is running on the Remote Access server, ensure that IIS is running, and that the URL is available.
The remote access server is located on this server. IIS is running. What URL: show I be looking at?
Any other thoughts so I can get remote access working.
l also am getting a remote access error for IPV6, could this be a cause:
RoutingDomainID- {00000000-0000-0000-0000-000000000000}: Unable to add the interface {D37062B2-A3E0-4496-A459-9E0BBCE5423C} with the Router Manager for the IPV6 protocol. The following error occurred: Cannot complete this function.
John Lenz

Hi John,
please follow the steps to reinstall TCP/IP stack.
1.Restart your PC into Safe Mode with Networking.
2.
Edit your registry. Delete the following keys:
HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Winsock
HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services/Winsock2
3.
Open the nettcpip.inf file in your %winroot%/inf folder
(%winroot% is usually c:/windows).
Find the [MS_TCPIP.PrimaryInstall] section. Change the Characteristics value from 0xA0 to 0x80.
Open the properties of the network connection you want to fix. In the General tab, click on the Install button. Click on the Have Disk button, and point the location to %winroot%/inf. After that select TCP/IP (not version 6).
4.
Now you would notice that you can uninstall TCP/IP!
Do that, then restart the PC.
Go back to your network connection, and install TCP/IP again as per the above. After another reboot, you should be up and running.
I also noted that the XP network repair tool may yank out the ISA 2004 firewall client stuff. Just run the firewall clinet repair or install it again to fix that problem after you did your reboot. Before you do this kind of crazy stuff.
5.
This along with a TCP/IP reset using the netsh command:
netsh int ip reset resetlog.txt
wish you have a nice thanksgiving too
Regards,
Mike
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

My Options- Sync does not offer a manage account so I cannot find a "recovery key" to sync with my Galaxy note III android.

I run firefox browser on Windows 7. I am trying to synch with my android Galaxy note 3. When I am asked for a recovery key I am directed to pull down the "sync" option an use the choices. But all I pull down is a menu to set up synch. How do I find my recovery? I have tried rebooting with no effect. Thank you

thanks for the answer but not only can I not obtain my security Key. That is half of the problem. Also when I go thru the motions of entering a 12 digit key on both my computer and android I get a "progress" bar on the android and the screen says "waiting for device" and eventually firefox on the android crashes.
This is not well set up by mozilla.

AD contains system Recovery Key, but not showing in MBAM.

I am in an environment with MBAM 1.0 installed. I built the MDT 2013 system here and am currently trying to figure out why the bitlocker keys are showing up in AD but not MBAM.
In MDT, I have disabled the "enable bitlocker" options so there shouldn't be a case where that the TPM ownership is wrong (I think). I do however set the
bios password with CCTK, then apply the default bios configuration with an ini via cctk. The bios sets and activates tpm just before the hard disk is formatted by LTI.
q1. Could setting the TPM without restarting cause the TPM ownership to be set to the PE in some weird way.
q1.1. would I clear the tpm if this is the issue?
So MBAM client is installed on the reference image and captured by MDT. The WIM is then deployed to a system using a standard TS with the bitlocker disabled like
I mentioned above. I do not make any changes to reg for mbam in the reference image. For testing, I tried adding the mbam recovery key location url to the reference image reg. I still need to test that but a few other tests I did makes me believe this
is not the case.
MDT binds the system to a default OU in the domain. After the system is configured, I start Bitlocker. (Sometimes I start bitlocker when the system is in the default
OU, sometimes I start it after I move them into the right ou for the role). I am almost positive the default OU has the mbam settings (I do not have access to this gpo), since the manage-bde -status comes back AES 128 with diffuser (as compared to regular
aes 128).
After bitlocker finishes, the key is found in AD but not mbam.
I think the major questions I have are:
How can I force MBAM to take ownership of the TPM after the os is bitlockered? (about 100/700 machines are not reporting to mbam but are to bitlocker because of this new deployment system)
If I turn TPM on and activate while I was in the PE, would that mean the PE has the TPM ownership? (or bitlocker in this case, since mbam is not installed on the PE)
- Could I install MBAM on the PE and use that to manage the tpm? (MDT 2013) (I have seen some documents that cover this but it largely comes from wanting a pre-provisioned bitlocker.)
** I think the most manual way of correcting the issue I am having, is to either clear the tpm and rebitlocker, or
.. when a system is about to image, turn tpm on but leave it deactivated. (If I leave the tpm deactivated, every system will need to be manually rebooted and f10 will need to be pressed to continue the bitlocker process. this includeds
a user login too)

Keep the MBAM out of the .wim! Install it in task sequence.
MBAM Client has its own log files in event viewer, there you perhaps find the reason why recovery key is not stored in DP. But fix your image first, keep it thin.

Windows 8.1 Pro Shows me (Identifier) Key ID FCB##### & I have the Recovery Key File with 48 digits - It Will Not Unlock!!

And the password, I have tried unlocking the Gold Key Locked drive by right clicking on it in file explorer and also going to the control panel, In both area's I have tried the password phrase and the Recovery Key 48 digits I have in both the Cloud and on
a secondary HD, so what I am saying is I have all the information and I am still unable to unlock the drive.
Any suggestions?
The only thing I did, was when I signed back into the drive I recreated the file, but it shpould not have done a thing because I used the same password phrase.
I also so have that written down on a piece of paper, so I have it on paper, in a digital file and in the Cloud and it just will not open the drive.
I need help, I have also use the command prompt all to no avail. it gives me a "Wrong Password", there's no way because I was using the same phrase P/W and I was going in and out of the drive. It wasn't until the next day that I was unable to get
back in.
Any help, suggestion would be greatly appreciated.

Hello Encryptionist,
Do you mean that you can’t use the password and recovery key to unlock the BitLocker encrypted volume?
Have you made any changes before this issue?
Do you receive any error message when you use the password to unlock the volume?
Please double check if you have input the right password and recovery key.
Please check if you have forget that you change the password and recovery key.
Additionally, we could run the command repair-bde to repair drive.
The following example attempts to repair drive C and write the content on drive C to drive D by using the 48-digit recovery password specified. The recovery password should be typed in eight blocks of six digits with a hyphen separating each block.
repair-bde C: D: -rp 111111-222222-333333-444444-555555-666666-777777-888888
For more information, please take a look at the following article.
http://technet.microsoft.com/en-us/library/ff829851.aspx
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support

Manage-bde command is not generating recovery key on network location

Similar Messages

Maybe you are looking for