BitLocker Escrow

A PowerShell script that checks whether a device's BitLocker recovery key really escrowed to Entra ID, and forces the backup when it did not.

Get it by emailView on GitHub

What it does

  • Checks for event 845 in the BitLocker-API/Management log, which is written when a key is backed up to Entra ID successfully
  • Treats the device as escrowed only if that event was logged inside your window, so an already-backed-up key is not re-sent every run
  • Forces the backup with BackupToAAD-BitLockerKeyProtector for every RecoveryPassword protector when nothing is confirmed
  • Handles the awkward cases: no recovery protector present, or more than one protector on a volume
  • Reports only by default. Nothing changes until you set $WhatIf to $false
  • Logs every action to %LOCALAPPDATA%\Atliso\BitLockerEscrow.log

Configuration

You edit one block:

PowerShell
Preview snippet. The full, tested script lives in the vault.
# ══════════════ EDIT THIS BLOCK FOR YOUR ENVIRONMENT ══════════════
$VolumesToCheck = @("C:")   # add data volumes if you encrypt them
$MaxAgeDays     = 7          # a confirmed backup inside this window counts as escrowed
$WhatIf         = $true      # $false to actually force the escrow

Deploy in Intune

  1. In the Intune admin center: Devices > Scripts and remediations > Remediations > Create.
  2. Use the detection half (exits 1 when no recent escrow is confirmed) as the detection script.
  3. Use this script with -WhatIf $false as the remediation script.
  4. Run as SYSTEM in the 64-bit PowerShell host.

Full walkthrough with screenshots: BitLocker Recovery Key Missing From Intune? Force the Escrow Fleet-Wide

Get BitLocker Escrow

We'll send the script plus the deployment checklist, and updates when Microsoft changes something. No spam.