How to fix BitLocker error 0x80070005 (failed to back up to Active Directory)
On a managed PC this access-denied error means a policy requires BitLocker to save the recovery key to Active Directory or Intune before it can turn on, and the upload failed. Jump to your situation below or work through the methods in order.
By Neeraj Singh ~7 min Updated Jun 2026 89% found this helpful
Error message
0x80070005 Access denied. Failed to back up the TPM Owner Authorization or recovery information to Active Directory.
Summary
On a domain or Intune-managed PC, BitLocker error 0x80070005 (Access Denied) usually means a Group Policy requires the recovery information to be stored in Active Directory or Intune before BitLocker can be enabled, and that backup failed. When the PC is offline, off the corporate network, or not synced, the key cannot upload, so the policy blocks encryption and you get access denied. It can also be a plain elevation problem, the command was not run as administrator. The fix is to get the device onto the corporate network or VPN so the key can back up, confirm the device is Azure AD or Intune joined and has synced, run the action elevated, and if the policy is misconfigured, have an administrator adjust the Group Policy that blocks BitLocker until recovery information is stored.
What this error means
Organisations protect themselves from lost data by requiring that a BitLocker recovery key is escrowed, stored centrally in Active Directory or Intune, before a drive is encrypted. That way IT can always recover a locked machine. A Group Policy enforces this.
The catch is that if the device cannot reach the directory to upload the key, offline, off the VPN, or not yet synced, the backup fails and the policy refuses to let BitLocker turn on, returning access denied. Getting the device connected and synced, or relaxing the policy, lets the key escrow and encryption proceed.
Common causes
A policy requires the recovery key to be stored in AD or Intune first.
The PC is offline or off the corporate network.
The device is not Azure AD or Intune joined, or has not synced.
The command was not run as administrator.
A misconfigured Group Policy blocks BitLocker until escrow succeeds.
The account lacks permission to write the key to the directory.
Expert insight
“On a work laptop this is almost always the escrow policy. IT has said do not encrypt until the recovery key is safely stored in our directory, and the laptop is sitting off the network, so the upload fails and BitLocker throws access denied. The fix is usually as simple as connecting to the corporate VPN so the key can back up. If it still refuses, the device is not synced or the policy is too strict, and that is a quick word with IT to sort out.”
Manager, Tech Support & Operations · 19+ years fixing Windows and system errors
✓ How to fix it
Method 1
Connect to the corporate network or VPN
1Connect the PC to the corporate network or VPN so it can reach Active Directory or Intune.
2Then retry enabling BitLocker; the recovery key can now back up.
3This resolves most cases on a managed device.
Method 2
Confirm the device is joined and synced
1Check that the device is Azure AD or Intune joined and has synced (Settings, Accounts, Access work or school).
2Force a sync if available, then retry.
3An unsynced device cannot escrow the key.
Method 3
Run the action as administrator
1Make sure you are running the BitLocker action or Command Prompt as administrator.
2A non-elevated command produces an access-denied error too.
3Retry elevated.
Method 4
Ask your administrator to check the policy
1If it still fails, an administrator should review the Group Policy that requires storing recovery information to AD DS before enabling BitLocker.
2They can confirm the device has permission to write the key, or relax the requirement.
3This is the fix when the policy or permissions are the block.
On a managed PC, 0x80070005 is usually the recovery-key escrow policy combined with the device being off the network, so connect to the corporate network or VPN first and let the key back up. Confirm the device is joined and synced, run the action elevated, and involve your administrator if the policy or permissions are the block.
Frequently asked questions
What does BitLocker error 0x80070005 mean?
Access denied. On a managed PC it usually means a policy requires the recovery key to be stored in Active Directory or Intune before BitLocker can turn on, and that backup failed.
Why did the backup fail?
Most often the PC was offline or off the corporate network, so it could not reach the directory to upload the key. Connecting to the network or VPN lets the key back up.
How do I fix it on a work laptop?
Connect to the corporate network or VPN, confirm the device is Azure AD or Intune joined and synced, and run the action as administrator. Then retry enabling BitLocker.
Could it just be permissions?
Yes. Running the command without administrator rights also gives access denied. Run Command Prompt or the BitLocker action as administrator and try again.
It still fails after connecting
The device may not be joined or synced, or the policy may be misconfigured. Ask your administrator to check the escrow Group Policy and the device's permission to write the key.
Can I bypass the policy myself?
Not on a managed device, and you should not try. The escrow requirement protects you from data loss. Work with your administrator to enable BitLocker correctly.
Still not working?
If you are an administrator and escrow still fails with the device connected, check that the AD schema is extended for BitLocker and that the computer object has permission to write recovery information. You can also submit your error to us for a tailored fix.
