BitLocker Escrow

A PowerShell script that checks whether a device's BitLocker recovery key really escrowed to Entra ID, and forces the backup when it did not.

Send me the scriptView on GitHub

What it does

  • Checks for event 845 in the BitLocker-API/Management log, which is written when a key is backed up to Entra ID successfully
  • Treats the device as escrowed only if that event was logged inside your window, so an already-backed-up key is not re-sent every run
  • Forces the backup with BackupToAAD-BitLockerKeyProtector for every RecoveryPassword protector when nothing is confirmed
  • Handles the awkward cases: no recovery protector present, or more than one protector on a volume
  • Reports only by default. Nothing changes until you set $WhatIf to $false
  • Logs every action to %LOCALAPPDATA%\Atliso\BitLockerEscrow.log

Get the script

From the PowerShell Gallery with Install-Script Atliso-BitLockerEscrow -Scope CurrentUser, or download it from GitHub.

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ══════════════ EDIT THIS BLOCK FOR YOUR ENVIRONMENT ══════════════
$VolumesToCheck = @("C:")   # add data volumes if you encrypt them
$MaxAgeDays     = 7          # a confirmed backup inside this window counts as escrowed
$WhatIf         = $true      # $false to actually force the escrow

Deploy in Intune

  1. In the Intune admin center: Devices > Scripts and remediations > Remediations > Create.
  2. Use the detection half (exits 1 when no recent escrow is confirmed) as the detection script.
  3. Use this script with -WhatIf $false as the remediation script.
  4. Run as SYSTEM in the 64-bit PowerShell host.

Full walkthrough with screenshots: BitLocker Recovery Key Missing From Intune? Force the Escrow Fleet-Wide

If the drive shows Protection Off or waiting for activation rather than a missing key, use BitLocker Protection Fix.

Version history

Scripts are checked against each month's Windows and Intune changes and patched when something breaks. Every version stays available: if a newer one misbehaves in your environment, use the one before it and reply to any Atliso email to tell me.

  1. v1.0.1Latest

    Adds PowerShell Gallery metadata (PSScriptInfo) so the script can be installed with Install-Script Atliso-BitLockerEscrow. No change to what the script does.

    Download v1.0.1 from GitHub

  2. v1.0.0

    Initial public release. MIT licensed. Download the zip below or clone the repo. See README for usage and the linked Atliso guide.

    Download v1.0.0 from GitHub

Get BitLocker Escrow

We'll send the script plus the deployment checklist, and updates when Microsoft changes something. No spam.