Retrieving BitLocker Keys for Computers in Active Directory Using PowerShell

Have you ever lost a BitLocker recovery key and wished you had a way to retrieve it? BitLocker is a built-in encryption feature in Windows that can protect your data from unauthorized access. However, if you lose the BitLocker key, you might not be able to access your data. In this blog post, we’ll show you how to use PowerShell to retrieve BitLocker keys for the computers in Active Directory.

Before we begin, let’s go over some basics. BitLocker is a drive encryption technology that is built into Windows. It uses a combination of a key protector and an encryption key to secure your data. The key protector can be a password, a smart card, or a recovery key. The encryption key is used to encrypt and decrypt your data. If you lose your key protector, you can use the recovery key to regain access to your data.

To retrieve BitLocker keys for the computers in Active Directory, we’ll use PowerShell. PowerShell is a powerful scripting language that is built into Windows. It allows you to automate administrative tasks and perform system management tasks more efficiently.

First, we’ll need to get a list of computers from Active Directory. We can use the Get-ADComputer cmdlet to do this. We’ll filter the results to include only the computers whose names contain “LT” and expand the properties to include all properties. Change the “LT” to whatever naming convention you have or remove the naming filter.

Here’s the code:

$Computers = Get-ADComputer -Filter {Name -like '*LT*'} -Properties * | Select -ExpandProperty Name

Next, we’ll loop through the list of computers and retrieve the BitLocker key protectors for the C drive. We’ll use the Invoke-Command cmdlet to run the Get-BitLockerVolume cmdlet remotely on each computer. We’ll also use the Select-Object cmdlet to expand the KeyProtector property. Here’s the code:

$results = foreach ($computer in $computers) {
    Invoke-Command -ComputerName $computer -ScriptBlock {
        Get-BitLockerVolume -MountPoint C | Select-Object -ExpandProperty KeyProtector
    }
}

Finally, we’ll export the results to a CSV file. Here’s the code:

$results | Export-Csv -Path "C:\BitLockerKeys.csv" -NoTypeInformation

Here is the complete code block:

$Computers = Get-ADComputer -Filter {Name -like 'LT'} -Properties * | Select -ExpandProperty Name
$results = foreach ($computer in $computers) {
Invoke-Command -ComputerName $computer -ScriptBlock {
Get-BitLockerVolume -MountPoint C | Select-Object -ExpandProperty KeyProtector
}
}
$results | Export-Csv -Path "C:\BitLockerKeys.csv" -NoTypeInformation

To check if BitLocker is enabled on a computer, you can run the Get-BitLockerVolume cmdlet with the MountPoint parameter.

Here’s the code:

Get-BitLockerVolume -MountPoint "C:" | Select-Object VolumeStatus

Retrieving BitLocker keys for the computers in Active Directory can be a useful task for system administrators. By using PowerShell, you can automate this task and save time. We hope this blog post has been helpful and informative. If you have any questions or comments, please leave them below.