# Configure BitLocker Fails with Exit Code 1603

> Fix a Company App or script whose Configure BitLocker PowerBrick fails because Group Policy doesn't allow BitLocker recovery information in Active Directory.

Source: https://docs.capaone.com/capaone/troubleshooting/configure-bitlocker-fails-with-exit-code-1603/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

## Problem

A Company App or script that uses the
[Configure BitLocker](/capaone/application-manager/powerbricks/bricks/configure-bitlocker/)
PowerBrick fails with:

```text
ERROR_INSTALL_FAILURE (1603): Fatal error during installation
```

PowerBricks that come after Configure BitLocker in the same app don't run. For example, if the
app also contains [Activate Windows](/capaone/application-manager/powerbricks/bricks/activate-windows/),
Windows isn't activated.

`Install.log` for the job shows:

```text
BitLocker_Configure: Backup-BitLockerKeyProtector for protector {...} failed on C:. Group policy does not permit the storage of recovery information to Active Directory. The operation was not attempted. | HResult: 0x80131501
SCRIPT ENDED WITH EXITCODE: 1603
```

To see the log, open the app, select the **Endpoints** tab, open the endpoint's row menu, and
select **View logs**. Open `Install.log`. `CapaOne.ScriptingLibrary.log` and `PackageInstaller.log`
have more detail.

## Cause

**Write Recovery Key To Active Directory** is turned on in the Configure BitLocker PowerBrick. The
brick tries to back up the recovery password to on-premises Active Directory, but the BitLocker
Group Policy settings on the device don't allow recovery information in Active Directory Domain
Services (AD DS). Windows doesn't attempt the backup, the brick fails with exit code 1603, and the
PowerBrick sequence stops.

## Solution

Use one of these options, then select **Redeploy** in the endpoint's row menu:

- **If the recovery password should be stored in Active Directory:** allow it in Group Policy.
  In **Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive
  Encryption → Operating System Drives**, enable **Choose how BitLocker-protected operating system
  drives can be recovered** and select **Save BitLocker recovery information to AD DS for operating
  system drives**. Make sure the device has received the policy before you redeploy, for example
  with `gpupdate /force`.
- **If you don't use Active Directory for BitLocker recovery:** in the Configure BitLocker brick,
  turn off **Write Recovery Key To Active Directory**.

:::note
If one PowerBrick in an app fails, the bricks after it don't run. When a later step, such as
Windows activation, is missing, check `Install.log` for the first brick that failed.
:::

## Related

- [Configure BitLocker](/capaone/application-manager/powerbricks/bricks/configure-bitlocker/)
- [Backup BitLocker Recovery Key](/capaone/application-manager/powerbricks/bricks/backup-bitlocker-recovery-key/)
- [Activate Windows](/capaone/application-manager/powerbricks/bricks/activate-windows/)
- [BitLocker recovery overview](https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/recovery-overview) on Microsoft Learn