topic Re: Bitlocker recovery keys not present in Cortex XDR Discussions

Bitlocker recovery keys not present

Bruno_Alipio — Mon, 10 Aug 2020 11:08:06 GMT

Hello,

I wanted to check if someone can shed some light on this issue I had.

During a Cortex XDR PoC, the end user activated the Disk encryption policy on a couple of workstations without confirming the pre-requisities so these workstations encrypted the HDD (C:) and after the first reboot started asking for the bitlocker recovery key.

Now, the issue is that the key is not present on Active Directory and the user said that it got no other prompt to save the key on the endpoint. My question is that if XDR activated the bitlocker policy and if it was not able to save the recovery key, should it encrypt anyway? I now have a couple of workstations that have their disks encrypted and no way to rollback or unlock them.

Thanks in advance for any tips/help/comments.

Re: Bitlocker recovery keys not present

dfalcon — Tue, 11 Aug 2020 01:58:33 GMT

Hi @Bruno_Alipio -

There are several pre-reqs that must be checked off before enabling an encryption policy. They can be found here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/hardened-endpoint-security/disk-encryption-using-bitlocker.html

Since you are having issues with decryption, it is best to contact Support for assistance.

Re: Bitlocker recovery keys not present

Bruno_Alipio — Tue, 11 Aug 2020 08:52:45 GMT

Hi @dfalcon, thanks for the feedback, I opened a case in support but unfortunately they where not able to help. I'm just trying to figure out the standard behavior if the prerequisites are not met. If the bitlocker process cant save the recovery keys to the AD, should it present a GUI to the user asking for USB/print/local file? Is there anyway that the XDR agent is enabling the bitlocker and asking for a silent process?

Re: Bitlocker recovery keys not present

gbagita — Wed, 09 Dec 2020 13:29:46 GMT

Hi Dfalcon,

Is there a tool or some some log which can show, what prerequisites are not met? I have some PC's I think are compliant, but the Disk Encryption Visibility portal doesn't share my opinion. And I don't know what is the problem.