BitLocker, How to recover BitLocker key using Active Directory Users and Computers
Overview
BitLocker is a Windows-specific disk encryption scheme. Keys can be stored and retrieved from Active Directory using a common program available on Windows systems.For a user's personal device that is not domain-joined, the location of the BitLocker recovery key depends on how the device was configured. If the recovery key was backed up to the user's University of Illinois work or school account in Microsoft Entra ID, have the user log in to the Microsoft 365 Devices portal, have them select their device, then select 'View Bitlocker Keys'. If the device was configured using a personal Microsoft account, the recovery key may instead be stored with that personal Microsoft account.
Systems
Windows Computers
Intended Audience
University of Illinois IT Pros leveraging Active Directory to store BitLocker keys
General Information
This article describes the steps an IT Pro can take to recover a BitLocker key stored in Active Directory.
You will need
- to be a member of your unit's BitLocker recovery admins group. This needs to be requested from the AD Group.
- to be an OU admin (meaning you are listed in the OU admin group for the unit)
- a Windows workstation with Active Directory Users & Computers installed (install directions, Microsoft's RSAT download).
Steps
- Find the AD computer object representing the machine using Active Directory Users and Computers.
- Right-click on the computer object, select Properties
- Select the BitLocker Recovery tab
- Identify the correct recovery password using the Password ID which should match the BitLocker prompt on the workstation.
