We have an MBAM server and tested policies which work normally for nearly every machine we've migrated. Though, I have seen 3 systems now that prompt for a recovery key instead of the users PIN. After recovering, each subsequent reboot asks for recovery keys again, requiring end users to contact support after each reboot. The recovery keys are being escrowed into AD\MBAM just fine.
Seeing as the process has worked on roughly 99% of systems so far, I'm assuming we're dealing with hardware or software level issues. In one case, I have reloaded the system and had BitLocker begin working normally indicating it was some machine state issue.
I've been through the gambit in terms of troubleshooting the TPM state, firmware upgrades, reviewing BitLocker logs, fully decrypting\re-encrypting devices but once the laptop is in this state, it always prompts for recovery.
Is there a way to discover which PCR exactly is triggering the recovery state so I can focus on a single PCR? We're about to go company wide with this process and I'm concerned that we might disrupt more users during migration. I'd at least like to have a plan to troubleshoot.