MBAM 2.5 - SelfService Portal Not Working - Invalid Key ID

Question

Really odd issue I've run into here guys. Any help is greatly appreciated as this issue is holding my client back from releasing MBAM BitLocker management to his company. 
We've setup a two-server MBAM solution. IIS sites are hosted on a server on the domain and the SQL database on another. Clients are deployed to the pilot group, GPO's are configured and deployed, machines are encrypting, the database is filling with Recovery
Key ID's and Recovery Keys. The issue we have here is when a user needs to perform a recovery on his/her drive, the SelfService site is never able to issue a Recovery Key. Each time a user enters the 8 characters from the Recovery Key ID, it returns with
Invalid Key ID.
However, if you enter the same key into the HelpDesk portal, a key is returned. 
I've checked the database, and the Key ID and the accompanying Recovery Key match. Within the reports for this machine, the user attempting to perform the recovery is listed as a user on the device. This seems to be a pattern for any systems managed with
BitLocker, so I'm thinking there's a bigger issue. We've went over the SelfService web.config file with a fine-comb and compared it to a working SelfService portal (different domain, different implementation) and have been unable to find anything that stands
out as being an issue.
Aside from some kind of obscure configuration, I'm thinking this might be access-related, but I've been unable to prove or disprove this theory. Any assistance on this issue would be greatly appreciated, as I've mentioned, this is preventing my client from
rolling this implementation out to his company because without giving the ability to users to perform recoveries on their own systems, there's no real benefit to having MBAM to manage BitLocker. 
Michael B Courville

Answer 1

ok... I found a post:
I believe this will resolve the issue. I do recall now (i'm at home) that i was using my machine which the user has never logged into but is requesting the password for. I will test this theory tomorrow. good luck!!
https://support.microsoft.com/en-us/kb/2870853?wa=wsignin1.0
In MBAM 2.0, the Recovery Key ID is only shown to the user, if the user who is requesting the key has logged on to the machine at least once. Also, in MBAM 2.0, SQL database maintains the list of logon user after MBAM 2.0 agent is installed and always verifies
if the user has logged in to the machine or not.
For Example:
User A logins to Computer A.
Computer A asks for BitLocker Recovery Key due to some changes done on the machine.
User A goes to Computer B and logins to Windows.
Open MBAM 2.0 Self Service Portal, http://mbamserver/selfservice
Enters the first 8 digits of recovery key id and MBAM 2.0 SSP page will show him the recovery key.
Let's say if user A never logged in to computer A, then we will not show him the key and will throw the above message.
Raymond Peng
Raymond, I realize this. The user(s) that are attempting to get recovery keys are listed as users on the machines. Regardless of that fact, any user(s) assigned to any machine(s) are not able to get a recovery key from the SSP. My client and I are planning
to dig more into the security aspect of this. It's odd that since I've posted this question, I've seen two or three people show up and now have this issue as well. There must be some commonality here. We're going to make sure that the users are in the DB-ReadOnly
group and maybe even overshoot the access they need - like giving them Full Admin rights just to see if that fixes the issue. 
Michael B Courville