Find computers in domain without Bitlocker info

Question

Hi!

We are seeking for a powershell command that would list which domain joined computers don't have bitlocker keys stored in AD.
with best regards

Answer 1

Better use this which makes use of the attribute pwdlastset (which gets replicated alright across all DCs)

Import-Module ActiveDirectory
$date = [DateTime]::Today.AddDays(-60)
$pcs = Get-ADComputer -Filter  'PasswordLastSet -le $date'  -properties PasswordLastSet
foreach ($pc in $pcs) {
$dn = $pc.DistinguishedName
$ldPath = "AD:\",$dn -join ""
if ((Get-ChildItem $ldPath | where {$_.objectClass -eq "msFVE-RecoveryInformation"}) -eq $null) {echo $pc.name}} 

Answer 2

Be aware that having "some" recovery key does not always help. It needs to fit the current partitions that you want to secure, so your approach is not securely leading to the desired result as keys can be outdated or some partitions might not have their key backuped while others have.

What you should do instead: deploy a script (as immediate scheduled task) that runs on all machines that adbackup all keys of all drives presently connected.

Answer 3

Hi. Thanks for your reply. Agree.
But for phase1 we would like to collect AD joined machines which don't have recovery key so we can start to investigate what's the reason that key isn't stored in AD, so we are (still) searching a powershell way for gathering those assets...

Answer 4

Hi @BCR ,

maybe this helps to get started:

https://4sysops.com/archives/find-bitlocker-recovery-passwords-in-active-directory-with-powershell/

The rest will be an easy if/else -> if msFVE-RecoveryPassword is not null = bitlocker recovery exists and else bitlocker recovery does not exist

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Answer 5

Thank you all for your replies and help.