Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently use Bitlocker on our laptops here at work. The helpdesk are responsible for backing the Bitlocker key up to AD when they build the system. We ran into an issue recently where a user had a hardware problem that set Bitlocker off, so it won't go past the screen prompting for the recovery key.

No problem, we have had this before, except that when I look in AD there's no key, which means somebody forgot to back it up. So I randomly click on a handful of other laptop objects and find another not backed up. So this has me thinking we need to seriously look into this before it happens again (on a higher profile employee).

Instead of going through the entire laptop OU and clicking on the Bitlocker recovery tab, is there a way in PowerShell to check that tab and see if anything is in there? I wouldn't even need to know the key there, just to know if any data is there which would show it's been backed up. If not it's not the end of the world, but I'd much rather be able to do that with a script than manually. :)

I've been looking online but so far found nothing exactly what I want, usually it's much more complex than I'm needing.

Thanks for any help you can give!

share|improve this question
The helpdesk are responsible for backing the Bitlocker key up to AD when they build the system. - Not an answer to your question, but you can enforce the backup of the key automatically to AD via GPO. The laptop will not begin encryption until the key is there. – MDMarra May 3 '12 at 13:33
up vote 3 down vote accepted

As MDMara points out, Your Doing It Wrong™.

Enable the GPO setting to backup the BitLocker keys to AD automatically. BitLocker will backup the key first, so it's not possible to get into the situation you have now. There's quite a few other BitLocker GPO Settings too.

You'll also want the BitLocker Recovery Password Viewer for Active Directory Users and Computers that allows you to see the BitLocker Keys in AD.

Not to get too preachy: Before you go endeavoring into new technologies which might lock people out of their computers permanently, you should really read all the documentation and best practices. MS has published volumes on BitLocker to help people prevent mistakes like this.

share|improve this answer
I was thinking we had tried that, but had some kind of problem with it. Now would be a good time to revisit the topic and do it right. Thank you both for the direction, I'll start digging into it right now! – Don May 3 '12 at 13:46
It's possible you've got something crazy going on that would prevent you from using it; but it's what we use internally, works great for us. – Chris S May 3 '12 at 13:47
I second that. We use the same process here without issue. – MDMarra May 3 '12 at 14:04
If the machine isn't in an OU when the policy is applied, then it's not going to get that policy. – MDMarra May 3 '12 at 16:01
Looks like this worked just fine. I applied the GPO to the staging OU and selected AD during the MDT phase, worked like a charm. I believe we tried them both when we set the system up, but not at the same time. ;) Thanks! – Don May 3 '12 at 16:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.