Get Password ID using manage-bde

Question

Hi there.

I'm trying to script the combination between 2 commands.

manage-bde -protectors -get C:
manage-bde -protectors -adbackup C: -id{XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

because I need to do it on ~800 computers.

I'm doing like this:

FOR /F "tokens=1" %%G IN ('manage-bde -protectors -get C:') DO SET _IDKey=%%G

By doing it, for the following command result, I can only get {YYYYYYY-YYYY-YYYY-YYYY-YYYYYYYYYYYY} and 123456-123456-123456-123456-123456-123456-123456-123456.
Is there any way of getting {XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} instead?

Microsoft Windows [Version 10.0.18363.1256]
(c) 2019 Microsoft Corporation. All rights reserved.

C:\windows\system32>manage-bde -protectors -get C:
BitLocker Drive Encryption: Configuration Tool version 10.0.18362
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Volume C: [Windows]
All Key Protectors

Password:
  ID: {XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

Numerical Password:
  ID: {YYYYYYY-YYYY-YYYY-YYYY-YYYYYYYYYYYY}
  Password:
    123456-123456-123456-123456-123456-123456-123456-123456

Thank you in advanced.
Hugo Cruz

Answer 1

Hi.

Recently, someone else had the same question.

My advice is and was: let go of the idea to find computers without keys in AD and rather save the keys to AD now!

Just deploy an immediate scheduled task to all computers that consists of this single batch line:

for /f "tokens=1,2" %%a in ('manage-bde -protectors -get C: -Type recoverypassword ^| findstr ID') do manage-bde -protectors -adbackup c: -id %%b
Please note: this is only for the c: drive. For d:/... additional lines need to be added, just exchange C: for D: and so on. You can of course use errorcontrol to see if it fails (why should it? never saw that fail)::

for /f "tokens=1,2" %%a in ('manage-bde -protectors -get C: -Type recoverypassword ^| findstr ID') do manage-bde -protectors -adbackup c: -id %%b || echo ADBackup of C: key failed on %computername%>>\server\share\%computername%.txt

Please note that this code was copied from "Ronald Schilf", my old MS technet forums identity which I had to give up, because Microsoft migrated Technet to "answers" without allowing my ID to logon to answers.

Answer 2

Hi，

To get {XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} you can do it like this

SETLOCAL ENABLEDELAYEDEXPANSION
SET count=1
FOR /F "tokens=2" %%G IN ('manage-bde -protectors -get C:^|findstr ID') DO (
SET var!count!=%%G
SET /a count=!count!+1
)
echo %var1%

Best Regards，
Ian Xue