Volume Encryption Lifecycle Management

In a computing environment, a system, comprising:

• a root trust device that includes a cryptographic key generator and nonvolatile memory capable of storing data;
• one or more storage devices connected to a computing device, the one or more storage devices having one or more volumes thereon;
• a protector store operable to maintain protector data that is usable to unlock the one or more volumes;
• and
• an orchestrating agent operable to facilitate cryptographically protecting the computing device and the one or more volumes by performing actions in a pre-defined order, the orchestrating agent further operable to determine that an active session with a user is occurring on the device in conjunction with at least one of the actions, the orchestrating agent further operable to send the protector data to an escrow service for storing the protector data on a recovery store external to the device.

A computer storage medium having computer-executable instructions, which when executed perform actions, comprising:

• from an orchestrating agent located on a computing device having one or more storage devices that include one or more volumes, the orchestrating agent operable to facilitate cryptographically protecting the computing device and the one or more volumes by performing actions in a pre-defined order, the orchestrating agent further operable to determine that an active session with a user is occurring on the device in conjunction with at least one of the actions, receiving protector data used to cryptographically protect volume data of the computing device;
• storing the protector data in a recovery store external to the computing device;
• and
• sending confirmation to the orchestrating agent that the protector data has been stored.