:( Thanks for the screenshot - answers a few questions already!
Was this drive encrypted BEFORE Sophos was installed by any chance or has Sophos managed it since day 1?
This PC shouldn't really be in this container either. Auto registered is like a temporary home before the directory syncs with AD. It should then move from this container into the correct OU.
You may find you have another "blank/phantom" instance of this PC in the correct location/OU which you can then delete and allow this one to move across. It'll not move into this OU until the phantom version is removed.
This may have caused the issue here because the PC may not receive the correct policies in .auto registered.
I have applied my encryption policies at the OU level. I wanted the machines to have talked to the server first to ensure they got the correct policy and also had a better chance of backing up the recovery key. It also allows much more granularity in terms of control. One department in one OU can have one policy and one department in another OU a different one. You may find for instance the Finance department has different requirements from the rest of the establishment.
I do have a handful of policies at root level but these are to ensure decryption/uninstall. This is therefore applied to everyone but it's based on group membership so doesn't get applied to the objects until they're a member of the group.
I believe it's not what Sophos recommend. I still believe this issue though could be because C Drive was already encrypted and therefore not managed by Sophos from day one.
Do you need to recover data from this drive or are you just testing you have the recovery key?
