So my task is to implement BDE on System drives in my company for TPM computers. All computers are AD-joined (no AzureAD). All computers are W11 Pro 25H2
I need key protectors:
- TPM protector
- Recovery code protector stored in AD
- DRA certificate in case of decryption of computer that was removed from AD by accident
I got working solution with TPM + Recovery Code, but I can not get DRA working.
To generate cert I use:
$Cert = New-SelfSignedCertificate -Type Custom -Subject "CN=Bitlocker DRA" -TextExtension @("2.5.29.37={text}2.23.133.8.3,1.3.6.1.4.1.311.21.6,1.3.6.1.4.1.311.67.1.1,1.3.6.1.4.1.311.67.1.2") -CertStoreLocation "Cert:CurrentUserMy" -HashAlgorithm sha512 -KeySpec KeyExchange
$Cert | Export-Certificate -FilePath cert.cer
Then i add it through GPO using SecurityPKI to computer, and see new entry in registry (SystemCertificatesFVECertificates)
The registry SelfSignedCertificates is set to 1.
But when i start encrypting drive, it is not added as key protector.
