BitLocker-Could we get decrypted recovery keys if database recoverd to another server

Question

I have a question on database backup and recovery and BitLockerManagement_Cert.

We are using ConfigMgr 2103, we found that BitLocker recovery keys were encrypted by default on ConfigMgr database, but no certificate found.
Execute
select * from sys.certificates
on ConfigMgr database retuns nothing.

But try
SELECT RecoveryAndHardwareCore.DecryptString(RecoveryAndHardwareCore_Keys.RecoveryKey, DEFAULT) AS RecoveryKey FROM RecoveryAndHardwareCore_Keys
We can get the decrypted recovery key .

If we recovery database to another server, I doubt if we could still get decrypted recovery keys...

2021/12/16, Add some details:
"Allow recovery information to be stored in plian text" was Checked by default and it's grayed out, cannot be uncheck.

when query SQL, there is no certificate found on ConfigMrg database.
query recovery keys returns encrypted recovery key, but we can decrypt the keys by using a decryptString method:

Answer 1

Hi, @xianhua 李
Thank you for posting in Microsoft Q&A forum.

The documentation said:
If you don't want to create a BitLocker management encryption certificate, opt-in to plain-text storage of the recovery data. When you create a BitLocker management policy, enable the option to Allow recovery information to be stored in plain text.
I think you are using the option "Allow recovery information to be stored in plain text." So you don't have a cert named "BitLockerManagement_Cert". Your recovery keys are not encrypted by SQL Server encryption certificate.

You may check this article to see why the query you used can decrypted recovery key:
https://geekdudes.wordpress.com/2020/03/25/sccm-get-decrypt-bitlocker-recovery-keys-from-the-configmgr-database/
(Please note: Information posted in the given link is hosted by a third party. Microsoft does not guarantee the accuracy and effectiveness of information.)

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

---

Answer 2

You can follow the steps outlined in this document https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/bitlocker/encrypt-recovery-data

Thanks,
Eswar
www.eskonr.com