Script advice based on Get bitlockerRecoveryKey

Question

Script advice based on Get bitlockerRecoveryKey

Steve Wakefield 1 Microsoft External Staff

I have a customer who wants to access the bitlocker key using only a script, no portal.

Based on 'Get bitlockerRecoveryKey', this has gotten him part of the way, but wondering if anyone has written an example script or could guide us further?

Get bitlockerRecoveryKey - https://learn.microsoft.com/en-us/graph/api/bitlockerrecoverykey-get?view=graph-rest-1.0&tabs=powershell

Kindest Regards,
Steve

MTG 1,261

There you go:

do {
$computers = get-adobject -Filter * | Where-Object {$_.ObjectClass -eq "msFVE-RecoveryInformation"}

$key = (read-host -Prompt "Enter starting portion of recovery key ID").ToUpper()
$records = $computers | where {$_.DistinguishedName -like "*{$key*"}
foreach ($rec in $records) {
    $computer = get-adcomputer -identity ($records.DistinguishedName.Split(",")[1]).split("=")[1]
    $recoveryPass = Get-ADObject -Filter {objectclass -eq 'msFVE-RecoveryInformation'} -SearchBase $computer.DistinguishedName -Properties 'msFVE-RecoveryPassword' | where {$_.DistinguishedName -like "*$key*"}
    [pscustomobject][ordered]@{
        Computer = $computer
        'Recovery Key ID' = $rec.Name.Split("{")[1].split("}")[0]
        'Recovery Password' = $recoveryPass.'msFVE-RecoveryPassword'
    } | Format-List
}
$response = read-host "Repeat (y)?"
}
while ($response -eq "y")

You need to provide only the first 4 characters of the ID to this script.

Steve Wakefield 1 Reputation point Microsoft External Staff

2022-05-16T17:34:00.897+00:00

Thank you very much for this. I will see if this will work for them.
Steve Wakefield 1 Reputation point Microsoft External Staff

2022-05-16T18:58:06.597+00:00

Hello another question regarding this script, if I may:

Cx is migrating all the keys from on prem MBAM / AD to Azure AD. Will this script work for query to AAD?

Isn't the get-adobject a cmdlet only for on prem ad object device management, and not for Azure AD management?

In essence what we need is essentially the same thing, but instead of looking at on prem AD, the script needs to look at Azure AD to pull the recovery key
MTG 1,261 Reputation points

2022-05-17T07:19:00.787+00:00

Sorry Steve, I had not looked at the tags you selected, else I would have known that you need something for azure AD.
We use that script on premises and no, it won't work on azure. No azure experience here, sorry.
Steve Wakefield 1 Reputation point Microsoft External Staff

2022-05-18T00:53:31.603+00:00

Ok...no worries...maybe someone knows the Azure AD equivalent to convert this. Thanks again.

2 answers

Your answer

MTG 1,261 Reputation points

2022-05-16T07:18:21.207+00:00

There you go:

do { $computers = get-adobject -Filter * | Where-Object {$_.ObjectClass -eq "msFVE-RecoveryInformation"} $key = (read-host -Prompt "Enter starting portion of recovery key ID").ToUpper() $records = $computers | where {$_.DistinguishedName -like "*{$key*"} foreach ($rec in $records) { $computer = get-adcomputer -identity ($records.DistinguishedName.Split(",")[1]).split("=")[1] $recoveryPass = Get-ADObject -Filter {objectclass -eq 'msFVE-RecoveryInformation'} -SearchBase $computer.DistinguishedName -Properties 'msFVE-RecoveryPassword' | where {$_.DistinguishedName -like "*$key*"} [pscustomobject][ordered]@{ Computer = $computer 'Recovery Key ID' = $rec.Name.Split("{")[1].split("}")[0] 'Recovery Password' = $recoveryPass.'msFVE-RecoveryPassword' } | Format-List } $response = read-host "Repeat (y)?" } while ($response -eq "y")

You need to provide only the first 4 characters of the ID to this script.
Steve Wakefield 1 Reputation point Microsoft External Staff

2022-05-16T17:34:00.897+00:00

Thank you very much for this. I will see if this will work for them.
Steve Wakefield 1 Reputation point Microsoft External Staff

2022-05-16T18:58:06.597+00:00

Hello another question regarding this script, if I may:

Cx is migrating all the keys from on prem MBAM / AD to Azure AD. Will this script work for query to AAD?

Isn't the get-adobject a cmdlet only for on prem ad object device management, and not for Azure AD management?

In essence what we need is essentially the same thing, but instead of looking at on prem AD, the script needs to look at Azure AD to pull the recovery key
MTG 1,261 Reputation points

2022-05-17T07:19:00.787+00:00

Sorry Steve, I had not looked at the tags you selected, else I would have known that you need something for azure AD.
We use that script on premises and no, it won't work on azure. No azure experience here, sorry.
Steve Wakefield 1 Reputation point Microsoft External Staff

2022-05-18T00:53:31.603+00:00

Ok...no worries...maybe someone knows the Azure AD equivalent to convert this. Thanks again.

Answer 1

Limitless Technology 40,106

Hello SteveWakefield

Yes, you can use the next script to retrieve the recovery key programatedly:

$BitlockerVolumers = Get-BitLockerVolume
$BitlockerVolumers |
ForEach-Object {
$MountPoint = $_.MountPoint
$RecoveryKey = string.RecoveryPassword
if ($RecoveryKey.Length -gt 5) {
Write-Output ("The drive $MountPoint has a recovery key $RecoveryKey.")
}
}

Hope this helps with your query,

--If the reply is helpful, please Upvote and Accept as answer--

Steve Wakefield 1 Reputation point Microsoft External Staff

2022-05-19T00:13:02.837+00:00

Thank you so much; I will pass it along and see if it will work.
Steve Wakefield 1 Reputation point Microsoft External Staff

2022-05-20T03:04:25.467+00:00
These were the errors we got when we ran this:

$.MountPoint : The term '$.MountPoint' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify
that the path is correct and try again.
At line:4 char:15

$MountPoint = $.MountPoint

~~~~~~~~~~~~

CategoryInfo : ObjectNotFound: ($.MountPoint:String) [], CommandNotFoundException

FullyQualifiedErrorId : CommandNotFoundException

$.KeyProtector : The term '$.KeyProtector' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify
that the path is correct and try again.
At line:5 char:25

$RecoveryKey = string.RecoveryPassword

~~~~~~~~~~~~~~

CategoryInfo : ObjectNotFound: ($.KeyProtector:String) [], CommandNotFoundException

FullyQualifiedErrorId : CommandNotFoundException

Answer 2

T. Kujala 8,806

Hi @Steve Wakefield ,

How about simply using the bde commands?

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ff829848(v=ws.11)

manage-bde -protectors C: -get

Steve Wakefield 1 Reputation point Microsoft External Staff

2022-05-16T17:33:31.137+00:00

Hello, not sure. Will it work to get the key that is escrowed in Azure? This is an Intune policy managed environment that wants to manage key recovery to a select few, but also to create an automated way to retrieve it.

thanks again.
Steve Wakefield 1 Reputation point Microsoft External Staff

2022-05-18T00:52:45.827+00:00

Hi TKujala, did you have a link to what you were talking about? This one is dead.

Thanks again.

Share via

Script advice based on Get bitlockerRecoveryKey

2 answers

Your answer