NEW TS Error - Recovery password cannot be escrowed to AD because machine is not domain joined

[Noxcrunor]

Hi again, fortunately, i could resolve my issue with the driver installation myself. (doh!)

Unfortunately i got an error I could not solve myself.
In a TS for unknown computers I will join our domain at some point, if I install it from the Distribution Point on my local Site it works like a charm, but if my colleagues on other sites are trying to use this on their sites and want to join the domain from their sites, the deployment fails with the following:

Current OS volume is 'C:' OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Succeeded loading resource DLL 'C:\WINDOWS\CCM\1031\TSRES.DLL' OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
OSDBitLocker is running on Windows 8 or higher. OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
No reboot count provided. OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Protection is OFF OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Volume is fully encrypted OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Creating key protectors OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Tpm is enabled OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Tpm is activated OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Tpm is owned OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Tpm ownership is allowed OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Tpm has compatible SRK OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Tpm has EK pair OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Initial TPM state: 63 OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
TPM is already owned. OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
bDomainJoined == true, HRESULT=80004005 (..\bitlocker.cpp,621) OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Recovery password cannot be escrowed to AD because machine is not domain joined OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
CreateRecoveryPassword(), HRESULT=80004005 (..\bitlocker.cpp,1353) OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Failed to CreateRecoveryPassword (0x80004005) OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
hr, HRESULT=80004005 (..\bitlocker.cpp,1657) OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Failed to configure key protection (0x80004005) OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Rolling back ... OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
pBitLocker->Enable( argInfo.keyMode, argInfo.passwordMode, argInfo.sStartupKeyVolume, argInfo.bWait, argInfo.bFull, argInfo.dwEncryptMethod, argInfo.bIgnoreWhenTPMInvalid), HRESULT=80004005 (..\main.cpp,525) OSDBitLocker 16.10.2020 09:17:58 5364 (0x14F4)
Process completed with exit code 2147500037 TSManager 16.10.2020 09:17:58 3976 (0x0F88)
!--------------------------------------------------------------------------------------------! TSManager 16.10.2020 09:17:58 3976 (0x0F88)
Failed to run the action: BitLocker aktivieren. Error -2147467259 TSManager 16.10.2020 09:17:58 3976 (0x0F88)
Not in SSL. TSManager 16.10.2020 09:17:58 3976 (0x0F88)
Set a global environment variable _SMSTSLastActionRetCode=-2147467259 TSManager 16.10.2020 09:17:58 3976 (0x0F88)
Set a global environment variable _SMSTSLastActionName=BitLocker aktivieren TSManager 16.10.2020 09:17:58 3976 (0x0F88)
Set a global environment variable _SMSTSLastActionSucceeded=false TSManager 16.10.2020 09:17:58 3976 (0x0F88)

My DP on my local site is a WinServer2012R2, whilst the DPs on the other Sites are Win10-1809 (all patches installed) I hope that this is not the issue, because they can let the computers join some OUs but their own seems to fail everytime. (my DP can join his own OU nevertheless)

If some more information from the logfile is needed, i can provide it.

Cheers.

 

[pgnmst]

I would recommend checking the OU permissions. Your Domain Join Account needs to have permissions to join devices to the desired OU. Your Domain Join account is set inside your task sequence within the "Apply Network Settings" step. Next step would be to check "C:\Windows\debug\netsetup.log" on a affected device.