Selfservice Recovery: Trellix BitLocker and fileVault Recovery

Trellix Management for Native Encryption (MNE) is a management product that allows ePO administrators to manage Apple FileVault and Microsoft BitLocker. These programs are the native encryption offerings on macOS and Windows operating systems. MNE can also help users in system recovery, and provides rich audit and reporting capabilities. In this article, we shall discuss “Trellix BitLocker and fileVault Recovery: Perform Selfservice Recovery”. Please see How to Test Web Applications Using Scandium, how to Install and Set Lively Wallpaper on Windows 11, and How to Perform a Reverse Image Search on Your Browsers.

If you wish to follow along, you can request an online DEMO account fro Test as shown below.

Force BitLocker Recovery Mode

BitLocker is a feature in Microsoft Windows that provides encryption for the entire operating system volume and data volumes. Sometimes, due to various reasons like hardware changes, system updates, or forgotten passwords, BitLocker may enter into a recovery state, requiring a recovery key or password to unlock the drive.

To simulate the above scenarios and get into the recovery mode. We will have to launch the Command Prompt or  PowerShell window and type the following command depending on the drive you wish to initiate the recovery on.

manage-bde -ForceRecovery C:

You will be required to restart. You can use the command line or use the restart button. When the PC restarts, you will be prompted with the BitLocker Recovery Mode.

See Mac FileVault Encryption: How to enable FileVault disk encryption, how to perform Trellix ePolicy Orchestrator Installation on Windows Server, and How to upgrade Trellix ePolicy Orchestrator.

Part 1: Provide the recovery key to the user

Login to Trellix ePO as shown below as an administrator.

Under the Data Protection, click on Trellix Management of Native Encryption. Please see BitLocker Windows Update Shutdown or Reboot option behavior.

In the NME wizard, please enter the recovery key ID as shown in the BitLocker Recovery mode above. When you start typing the initial keys, Trellix will pre-populate these fields. Click on it to proceed.

You will be able to find your BitLocker Recovery key in this Window. When you are done, click close.

FileVault Recovery

FileVault is the native operating system encryption product from Apple. It encrypts the entire OS X startup volume, typically including the home directory, but not non-OS volumes. It supports a user-based preboot.

Follow through the same steps as above to access “import FileVault recovery”.

Follow the prompt by entering the serial number of recovery key

Recover Client PC: Provide the BitLocker Recovery key to the user

Now that we have been able to access the BitLocker Recovery. Please enter the retrieved key and hit the enter button on your keyboard to access your PC.

Assign BitLocker Recovery to the Trellix Help Desk Team

As shown above, you were able to perform the BitLocker/FileValut recovery because you are an administrator of the ePO server. What if you want to grant just the ability to recovery BitLocker Recovery Keys to a not so technical person? For example, a help-desk. Follow the steps below to achieve this.

Part 1: Enable AD Users to Logon

First, you would have to allow AD users the ability to logon unto ePO.

Click on ePO menu, and select Server Settings under Configuration. Edit this settings by selecting the associated checkmark. When done, click on SAVE.

As you can see, we have enabled ePO logon when an AD user has at least a single permission set assigned.

Part 2: Create a New Permission Set

As you can see, unlike MBAM. Trellix MNE does not have the traditional helpdesk feature. I will have to use the permission set to achieve this. To do this, launch the permission set.

Great a new permission set

Upon clicking on the add button, a select Group window will open up. Please select the group of your choice and click OK.

Note: See this guide if you wish to assign a permission set to an AD user-group. I will discuss these steps below.

Assign Trellix MNE to the newly created permission set. To do this, edit the permission for access the Trellix Management of Native Encryption.

Assign the desired permission and save!

Create an AD User Account on Trellix

Please populate the field as you wish to create a user on Trellix. When complete, click OK. Do not forget to select the permission set created above.

Here is how to Disable SQL Auto Close: Auto Close is enabled for both ePO and ePO Events Databases, and how To Setup A New Computer Without A Microsoft Account on Windows 11.

Access the Trello ePO with the new user account

As you can see, the user only has the selected permission set we have assigned.

You can now follow the prompt to import FileVault Recovery Key.

Part 2: Perform Self-service Bitlocker Recovery

Note: Make sure that you have installed the dpssp.zip extension on the Trellix ePO – On-prem server before performing this task. But because, I checked in all extensions and components, I did not manually have to do this. See Manage BitLocker and FileVault with Trellix Native Encryption.

Since we have been able to perform BitLocker recovery from the console and by assigning a subset of permission to a users.

Now, let’s enable self-recovery portal

Click to Edit the self-service portal.

Enter the information and save. Next to Authentication, AD is selected by default as the Active Directory sever.

Create a New Permission Set to assign Self-Service Portal Permission that will be associated to this user. Follow the same steps as above to create a new permission set.

IF you do not already have a user and would like to assign this right to a new user Please create a new ePO user that will utilise Windows Authentication.

Perform Trellix Self Service Recovery

When DPSSP is used for recovery with systems managed with Trellix MNE, the user must open the DPSSP portal, enter the serial number or recovery key ID for the FileVault or BitLocker system respectively, and obtain the recovery key.

In the event that both Trellix MNE and Drive Encryption are installed within the customer environment, the user is required to choose the product for which recovery is being requested.

In the address bar of a web browser, enter the URL: domain:8444/dpssp/selfRecovery, then press Enter to open the Data Protection Self Service Portal (DPSSP) page.

Enter your domain name and password.

Upon a successful login to DPSSP, you should be able to perform self service bitLocker/FileVault recovery.

FAQs

I hope you found this article on “Selfservice Recovery: Trellix BitLocker and fileVault Recovery” useful. Please feel free to leave a comment below.