Elements portal shows Encrypted drive status as “Recovery information error”

Issue:

In the Elements Security Center portal the portal shows that the system disk drive is encrypted for a device but it is unable to collect the bitlocker recovery key. 

On the device details page for a device, it shows under "Endpoint encryption > Encrypted Drives" the following details and error message:

Drive C (system disk)

• Encrypted
• Recovery information error (An error occurred during data collection for the recovery information. Please review the logs.)
• Pin-code: set 

Why does Elements Endpoint Protection (Elements Agent) fail to retrieve the BitLocker key from the device? 

Resolution:

For example, if BitLocker was enabled using: manage-bde -on C: -tpmandpin

then it is possible that only a TPM+PIN protector was created and no recovery password protector exists.

You can run the following command to display the BitLocker protectors configured on the volume: manage-bde -protectors -get C:

If you only see:

• TPM
• TPM And PIN

and there is no "Numerical Password" protector, then there is no recovery key stored on that device to retrieve.

manage-bde -protectors -get C: should display the 48-digit recovery password locally.

When scripting BitLocker deployment, ensure a recovery password protector is added, for example: manage-bde -protectors -add C: -RecoveryPassword <NumericalPassword>