1611

Issue:
Devices encrypted using the BitLocker SDOT profile may have different BitLocker Recovery information (Recovery ID and Recovery Key) than what are recorded on the SES Console and SES Web.

Symptom:
During the SecureDoc conversion, a reboot of the device was initiated which causes BitLocker to re-generate new recovery information.  The new recovery information is not picked up by SecureDoc and does not get propagated back to SES. When the device is in a state of recovery, the client receives an error of incorrect/mismatch key information when entering the outdated key information from the SES.



 


Probable Causes:
The bug was reported whereby the SD recovery information originally sent to the SES is different than what the device has after a reboot and could not unlock the drive.

Product version affected:
SD Versions 6.4, 6.5, 6.5SR1, 6.5SR2, 6.5 SR3 HF2

Environment (OS/hardware/software):
Lenovo X250 - Win8.1 UEFI
Dell Latitude E5450 - Win7x64
BitLocker Profile with SDOT

Informational Gathering and Troubleshooting:
-Extract the SDSpace.dat and MBR
-Determine what version of SES and SD on the device(s)

Resolution:
For the targeted devices that have not been upgraded to SD 7.1 SR1, there are two recommendations:

1. For client currently using SES version 6.5x, apply 6.5 SR3 HF6. Please contact customer support to obtain the 6.5 SR3 Hot Fix 6.
2. Please use the WinPE tool to extract the SDSpace.dat and MBR – Support team will assist the customer in extracting the Recovery key information from the drive.

Permanent Fix:
Please upgrade the production server and existing devices to 7.1 SR1.
With SD version 7.1 SR1 build 26, it will be able to capture the correct SD recovery key information.
Right after a reboot, the device will correctly sync with SES, and the server will capture the correct BitLocker Recovery information to match the client device.

Internal Reference:
SD-15254 BitLocker Recovery Key on Device is Different Than What is in SES Database on Fresh Install
SD-17222 Bitlocker Recovery Key on Device is Different from the SES Server and SDWeb.