Unprotect-ShieldedVMRecoveryKey
Decrypts an encrypted recovery key for a Windows shielded VM obtained from the Save-ShieldedVMRecoveryKey cmdlet.
Syntax
Unprotect-ShieldedVMRecoveryKey
-ShieldingDataFilePath <String>
-EncryptedBitLockerKeyPath <String>
-DecryptedBitLockerKeyPath <String>
[-WhatIf]
[-Confirm] Unprotect-ShieldedVMRecoveryKey
-ShieldingDataFileSearchPath <String[]>
[-Recurse]
-EncryptedBitLockerKeyPath <String>
-DecryptedBitLockerKeyPath <String>
[-WhatIf]
[-Confirm] Description
The Unprotect-ShieldedVMRecoveryKey cmdlet decrypts an encrypted BitLocker recovery key file obtained from a Windows shielded VM. To run the cmdlet, you must have the shielding data file that was used to deploy the shielded VM and have the private key for the owner guardian installed on your computer.
The resulting recovery key can be provided to manage-bde.exe, Unlock-BitLocker, or the BitLocker Recovery pre-boot environment to access the contents of your shielded VM OS volume.
Examples
Example 1
PS C:\> Unprotect-ShieldedVMRecoveryKey -ShieldingDataFilePath 'C:\temp\ShieldingDataFile.pdk' -EncryptedBitLockerKeyPath 'C:\temp\MyShieldedVMEncryptedRecoveryKey.ebek' -DecryptedBitLockerKeyPath 'C:\temp\DecryptedRecoveryKey.bek'Decrypts the provided encrypted BitLocker recovery key using the shielding data file and owner guardian private keys, and saves it to the temp directory.
Example 2
PS C:\> Unprotect-ShieldedVMRecoveryKey -ShieldingDataSearchPath 'C:\temp\AllShieldingDataFiles\' -Recurse -EncryptedBitLockerKeyPath 'C:\temp\MyShieldedVMEncryptedRecoveryKey.ebek' -DecryptedBitLockerKeyPath 'C:\temp\DecryptedRecoveryKey.bek'Searches the 'AllShieldingDataFiles' directory and all subdirectories for shielding data files that can be used to decrypt the provided encrypted BitLocker recovery key. If a suitable shielding data file is found and the private key for its owner guardian is available on the local computer, the decrypted BitLocker encryption key will be saved to the temp directory.
Parameters
-Confirm
Prompts you for confirmation before running the cmdlet.
| Type: | SwitchParameter |
| Aliases: | cf |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-DecryptedBitLockerKeyPath
Location to save the decrypted BitLocker encryption key (.bek)
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EncryptedBitLockerKeyPath
Location of the encrypted BitLocker encryption key
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Recurse
Specifies the cmdlet should search subdirectories of the shielding data file search path for compatible PDK files.
| Type: | SwitchParameter |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ShieldingDataFilePath
Location of the shielding data file (.pdk) used to deploy the shielded VM.
| Type: | String |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ShieldingDataFileSearchPath
Location of one or more directories to search for a shielding data file that can be used to decrypt the provided encrypted BitLocker encryption key.
| Type: | String[] |
| Position: | Named |
| Default value: | None |
| Required: | True |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
| Type: | SwitchParameter |
| Aliases: | wi |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
Inputs
None
Outputs
None