Configure BitLocker Fails with Exit Code 1603
Problem
Section titled “Problem”A Company App or script that uses the Configure BitLocker PowerBrick fails with:
ERROR_INSTALL_FAILURE (1603): Fatal error during installationPowerBricks that come after Configure BitLocker in the same app don’t run. For example, if the app also contains Activate Windows, Windows isn’t activated.
Install.log for the job shows:
BitLocker_Configure: Backup-BitLockerKeyProtector for protector {...} failed on C:. Group policy does not permit the storage of recovery information to Active Directory. The operation was not attempted. | HResult: 0x80131501SCRIPT ENDED WITH EXITCODE: 1603To see the log, open the app, select the Endpoints tab, open the endpoint’s row menu, and
select View logs. Open Install.log. CapaOne.ScriptingLibrary.log and PackageInstaller.log
have more detail.
Write Recovery Key To Active Directory is turned on in the Configure BitLocker PowerBrick. The brick tries to back up the recovery password to on-premises Active Directory, but the BitLocker Group Policy settings on the device don’t allow recovery information in Active Directory Domain Services (AD DS). Windows doesn’t attempt the backup, the brick fails with exit code 1603, and the PowerBrick sequence stops.
Solution
Section titled “Solution”Use one of these options, then select Redeploy in the endpoint’s row menu:
- If the recovery password should be stored in Active Directory: allow it in Group Policy.
In Computer Configuration → Administrative Templates → Windows Components → BitLocker Drive
Encryption → Operating System Drives, enable Choose how BitLocker-protected operating system
drives can be recovered and select Save BitLocker recovery information to AD DS for operating
system drives. Make sure the device has received the policy before you redeploy, for example
with
gpupdate /force. - If you don’t use Active Directory for BitLocker recovery: in the Configure BitLocker brick, turn off Write Recovery Key To Active Directory.