Intune / Windows 10 – Unable to turn on BitLocker with conflicting group policy error

Recently I came across an issue turning on BitLocker with the error

BitLocker Drive Encryption cannot be applied to this drive because there conflicting Group Policy settings for recovery options on fixed data drives.

image_thumb

Also got the error before starting the troubleshooting

You can’t create both a recovery password and a recovery key

image_thumb[1]

The policy to enable and enforce BitLocker is set on Intune/Endpoint Configuration Manager and the device has been refreshed (auto-pilot).

The device used to already have BitLocker enabled before the refresh process and re-assignment to another user.

After some troubleshooting and investigation, it was found that a registry key was the root cause of this ‘so called conflict’

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE

with the below values

“FDVRecoveryPassword”=dword:00000000

“FDVRequireActiveDirectoryBackup”=dword:00000001

The FVE key is not created by Intune policy and should not be present when BitLocker is managed by Intune.

Deleting the complete FVE key solved the problem.

Benoit Hamet
Benoit Hamet
Benoit is working on Microsoft collaborative technologies He has been awarded as MVP for more than 12 years Currently MVP on Office 365 after being awarded on SharePoint (2011-2012) and Windows client & server (2002-2007) Speaker at various Microsoft events (TechDays, TechNet seminars) and Quest Software He works on on-premises (Active Directory, RADIUS/NPS, Exchange, Skype for Business, SharePoint, SQL, Terminal Server, Windows client and Windows Server) or online (Azure, Intune, Office 365, Exchange Online, SharePoint Online, Skype for Business Online, Teams) technologies