How to Prepare AD DS for BitLocker

BitLocker is also integrated into AD DS. In fact, although you can use BitLocker without AD DS, enterprises really shouldn't-key recovery and data recovery agents are an extremely important part of using BitLocker. AD DS is a reliable and efficient way to store recovery keys so that you can restore encrypted data if a key is lost, and you must use Group Policy settings to configure data recovery agents.

If your AD DS is at the Windows Server 2008 or later functional level, you do not need to prepare the AD DS for BitLocker. If your AD DS is at a functional level of Windows Server 2003 or earlier, however, you will need to update the schema to support BitLocker. For detailed instructions on how to configure AD DS to back up BitLocker and TPM recovery information, read "Configuring Active Directory to Back Up Windows BitLocker Drive Encryption and Trusted Platform Module Recovery Information" at http://go.microsoft.com/fwlink/?LinkId=78953. For information about retrieving recovery passwords from AD DS, read "How to Use the BitLocker Recovery Password Viewer For Active Directory Users And Computers Tool to View Recovery Passwords for Windows Vista" at http://support.microsoft.com/?kbid=928202.