Import-Module BitLocker Note: Must be run as Administrator. | Command | Purpose | | :--- | :--- | | Get-BitLockerVolume | Lists volumes and their protection status, including key protectors. | | Backup-BitLockerKeyProtector | Backs up a recovery key to AD DS or Azure AD. | | Manage-bde (legacy tool) | Offers advanced recovery key extraction (e.g., manage-bde -protectors -get C: ). | 4. Practical Scenarios Scenario A: View Recovery Key for the Local C: Drive $Volume = Get-BitLockerVolume -MountPoint "C:" $Volume.KeyProtector | Where-Object $_.KeyProtectorType -eq 'RecoveryPassword' | Select-Object RecoveryPassword Output: 481237-641582-... (the 48-digit recovery key) Scenario B: Backup an Existing Recovery Key to Active Directory $Volume = Get-BitLockerVolume -MountPoint "D:" Backup-BitLockerKeyProtector -MountPoint "D:" -KeyProtectorId $Volume.KeyProtector[0].KeyProtectorId Verification: Check AD attribute msFVE-RecoveryPassword . Scenario C: Retrieve a Lost Recovery Key from AD (Remotely) Get-ADObject -Filter objectClass -eq 'msFVE-RecoveryInformation' -SearchBase "OU=Workstations,DC=contoso,DC=com" | Where-Object $_.Name -like "*COMPUTERNAME*" | Select-Object Name, @n="RecoveryKey";e=$_.'msFVE-RecoveryPassword' Scenario D: Audit Machines Missing AD Backup $computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name foreach ($pc in $computers) $recovery = Get-ADObject -Filter objectClass -eq 'msFVE-RecoveryInformation' -SearchBase "CN=$pc,OU=Computers,DC=contoso,DC=com" -ErrorAction SilentlyContinue if (!$recovery) Write-Host "$pc is missing a recovery key backup!" -ForegroundColor Red
Enable-BitLocker -MountPoint "C:" -TpmProtector -RecoveryPasswordProtector -SkipHardwareTest $Volume = Get-BitLockerVolume -MountPoint "C:" Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $Volume.KeyProtector[1].KeyProtectorId | Error | Likely Cause | Solution | | :--- | :--- | :--- | | "Backup failed" | AD schema missing BitLocker extensions | Extend schema or use local file backup ( -KeyProtector to file). | | "Key protector not found" | No recovery password exists | Add one with Add-BitLockerKeyProtector . | | "Access denied" | PowerShell not elevated | Re-run as Administrator. | 8. Final Pro Tip: One-Liner for Helpdesk When a user calls without their key, give helpdesk this one-liner (run from a domain controller or admin PC with RSAT): powershell bitlocker recovery key
(Get-ADObject -Filter "CN='$env:COMPUTERNAME'" -Properties msFVE-RecoveryPassword).'msFVE-RecoveryPassword' Just replace $env:COMPUTERNAME with the actual computer name. PowerShell gives you surgical control over BitLocker recovery keys—whether you need to extract, backup, audit, or rescue a locked drive. Combine these commands with scheduled scripts to ensure no encrypted machine ever becomes a brick due to a lost key. Import-Module BitLocker Note: Must be run as Administrator
BitLocker Drive Encryption is a cornerstone of Windows security, but a recovery key is your only lifeline if a user forgets their PIN, a TPM malfunction occurs, or a system board fails. Manually tracking these 48-digit numerical passwords is impossible at scale. | | Manage-bde (legacy tool) | Offers advanced
