Powershell Bitlocker Recovery Key ((full)) (2026)

).KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'} $Key.RecoveryPassword | Out-File -FilePath "C:\BitLockerRecoveryKey.txt" Use code with caution. Copied to clipboard Note: Storing the key on the same encrypted drive is not recommended. It is better to save it to a secure USB drive or a network location.   Microsoft Dev Blogs  +1 Force Backup to Active Directory (AD)   If your device is part of a domain, you can manually trigger a backup of the recovery key to Active Directory or

How to Retrieve Your BitLocker Recovery Key Using PowerShell Locked out of a drive or performing a routine audit? While you can find recovery keys in your Microsoft Account or Active Directory, PowerShell is the fastest way to pull this information directly from a running system. Why Use PowerShell for BitLocker? Manual methods involve clicking through several GUI menus. PowerShell allows you to: Quickly view the 48-digit recovery password . Identify the Key ID to match it with the correct prompt. Automate key backups for multiple machines in an IT environment. Step 1: Get the Recovery Key for a Specific Drive To see the recovery information for your primary drive (usually C:), open PowerShell as an Administrator and run: powershell (Get-BitLockerVolume -MountPoint "C:").KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'} Use code with caution. Copied to clipboard What this does: It filters the volume's "Key Protectors" to show only the 48-digit password. You will see a field labeled RecoveryPassword —that is your golden ticket. Step 2: List Keys for All Drives If you have multiple encrypted partitions or external drives, use this command to see everything at once: powershell Get-BitLockerVolume | Select-Object -ExpandProperty KeyProtector Use code with caution. Copied to clipboard Step 3: Back Up Your Key to Active Directory (AD) In an enterprise setting, you might need to manually trigger a backup of the key to your domain controller. You can do this with the Backup-BitLockerKeyProtector cmdlet: First, get the KeyProtectorID using the commands above. Run the backup command: powershell Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId "{YOUR-KEY-ID-HERE}" Use code with caution. Copied to clipboard Troubleshooting & Tips Administrative Rights: You must run PowerShell as an Administrator. If you don't, the Get-BitLockerVolume command will return an error or empty results. Key Not Found? If no key protector of type RecoveryPassword appears, BitLocker might be suspended or only using a TPM chip without a numerical backup. Saving to a File: You can export your key to a text file for safekeeping (though be careful where you store it!): powershell (Get-BitLockerVolume -MountPoint "C:").KeyProtector.RecoveryPassword | Out-File "C:\SafeLocation\BitLockerKey.txt" Use code with caution. Copied to clipboard For more advanced management, check out the official Microsoft BitLocker Documentation or guides from ManageEngine .

Managing BitLocker Recovery Keys with PowerShell: A Complete Guide BitLocker Drive Encryption is a cornerstone of Windows security, but a recovery key is your only lifeline if a user forgets their PIN, a TPM malfunction occurs, or a system board fails. Manually tracking these 48-digit numerical passwords is impossible at scale. PowerShell transforms BitLocker recovery key management from a tedious chore into a rapid, automatable process. Below is everything you need to know. 1. Why Use PowerShell for Recovery Keys?

Inventory: Quickly list which drives have BitLocker enabled and whether their recovery keys are backed up. Backup Automation: Ensure every new encrypted drive backs its key to Active Directory or Azure AD. Emergency Extraction: Retrieve a lost key without navigating the BitLocker control panel. Auditing & Compliance: Generate reports on key storage status across hundreds of machines. powershell bitlocker recovery key

2. Core PowerShell Module: BitLocker All commands reside in the built-in module. Load it with: Import-Module BitLocker

Note: Must be run as Administrator. 3. Key Commands for Recovery Key Operations | Command | Purpose | | :--- | :--- | | Get-BitLockerVolume | Lists volumes and their protection status, including key protectors. | | Backup-BitLockerKeyProtector | Backs up a recovery key to AD DS or Azure AD. | | Manage-bde (legacy tool) | Offers advanced recovery key extraction (e.g., manage-bde -protectors -get C: ). | 4. Practical Scenarios Scenario A: View Recovery Key for the Local C: Drive $Volume = Get-BitLockerVolume -MountPoint "C:" $Volume.KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'} | Select-Object RecoveryPassword

Output: 481237-641582-... (the 48-digit recovery key) Scenario B: Backup an Existing Recovery Key to Active Directory $Volume = Get-BitLockerVolume -MountPoint "D:" Backup-BitLockerKeyProtector -MountPoint "D:" -KeyProtectorId $Volume.KeyProtector[0].KeyProtectorId Microsoft Dev Blogs +1 Force Backup to Active

Verification: Check AD attribute msFVE-RecoveryPassword . Scenario C: Retrieve a Lost Recovery Key from AD (Remotely) Get-ADObject -Filter {objectClass -eq 'msFVE-RecoveryInformation'} -SearchBase "OU=Workstations,DC=contoso,DC=com" | Where-Object {$_.Name -like "*COMPUTERNAME*"} | Select-Object Name, @{n="RecoveryKey";e={$_.'msFVE-RecoveryPassword'}}

Scenario D: Audit Machines Missing AD Backup $computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name foreach ($pc in $computers) { $recovery = Get-ADObject -Filter {objectClass -eq 'msFVE-RecoveryInformation'} -SearchBase "CN=$pc,OU=Computers,DC=contoso,DC=com" -ErrorAction SilentlyContinue if (!$recovery) { Write-Host "$pc is missing a recovery key backup!" -ForegroundColor Red } }

5. Protecting the Protector: Security Notes Manual methods involve clicking through several GUI menus

Never log recovery keys in plain text. Use Read-Host -AsSecureString if prompting users. Restrict script access. Anyone who can run these commands as admin on a machine can decrypt the drive. Limit who can execute these scripts. Use JIT (Just-In-Time) access for the AD attributes containing recovery passwords. Rotate keys after retrieval. If you extract a key for support reasons, force a new key to be generated: manage-bde -protectors -add C: -recoverypassword then delete the old protector.

6. Automating Backup at Encryption Time Instead of relying on memory, embed backup into your deployment script: Enable-BitLocker -MountPoint "C:" -TpmProtector -RecoveryPasswordProtector -SkipHardwareTest $Volume = Get-BitLockerVolume -MountPoint "C:" Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $Volume.KeyProtector[1].KeyProtectorId

).KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'} $Key.RecoveryPassword | Out-File -FilePath "C:\BitLockerRecoveryKey.txt" Use code with caution. Copied to clipboard Note: Storing the key on the same encrypted drive is not recommended. It is better to save it to a secure USB drive or a network location.   Microsoft Dev Blogs  +1 Force Backup to Active Directory (AD)   If your device is part of a domain, you can manually trigger a backup of the recovery key to Active Directory or

How to Retrieve Your BitLocker Recovery Key Using PowerShell Locked out of a drive or performing a routine audit? While you can find recovery keys in your Microsoft Account or Active Directory, PowerShell is the fastest way to pull this information directly from a running system. Why Use PowerShell for BitLocker? Manual methods involve clicking through several GUI menus. PowerShell allows you to: Quickly view the 48-digit recovery password . Identify the Key ID to match it with the correct prompt. Automate key backups for multiple machines in an IT environment. Step 1: Get the Recovery Key for a Specific Drive To see the recovery information for your primary drive (usually C:), open PowerShell as an Administrator and run: powershell (Get-BitLockerVolume -MountPoint "C:").KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'} Use code with caution. Copied to clipboard What this does: It filters the volume's "Key Protectors" to show only the 48-digit password. You will see a field labeled RecoveryPassword —that is your golden ticket. Step 2: List Keys for All Drives If you have multiple encrypted partitions or external drives, use this command to see everything at once: powershell Get-BitLockerVolume | Select-Object -ExpandProperty KeyProtector Use code with caution. Copied to clipboard Step 3: Back Up Your Key to Active Directory (AD) In an enterprise setting, you might need to manually trigger a backup of the key to your domain controller. You can do this with the Backup-BitLockerKeyProtector cmdlet: First, get the KeyProtectorID using the commands above. Run the backup command: powershell Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId "{YOUR-KEY-ID-HERE}" Use code with caution. Copied to clipboard Troubleshooting & Tips Administrative Rights: You must run PowerShell as an Administrator. If you don't, the Get-BitLockerVolume command will return an error or empty results. Key Not Found? If no key protector of type RecoveryPassword appears, BitLocker might be suspended or only using a TPM chip without a numerical backup. Saving to a File: You can export your key to a text file for safekeeping (though be careful where you store it!): powershell (Get-BitLockerVolume -MountPoint "C:").KeyProtector.RecoveryPassword | Out-File "C:\SafeLocation\BitLockerKey.txt" Use code with caution. Copied to clipboard For more advanced management, check out the official Microsoft BitLocker Documentation or guides from ManageEngine .

Managing BitLocker Recovery Keys with PowerShell: A Complete Guide BitLocker Drive Encryption is a cornerstone of Windows security, but a recovery key is your only lifeline if a user forgets their PIN, a TPM malfunction occurs, or a system board fails. Manually tracking these 48-digit numerical passwords is impossible at scale. PowerShell transforms BitLocker recovery key management from a tedious chore into a rapid, automatable process. Below is everything you need to know. 1. Why Use PowerShell for Recovery Keys?

Inventory: Quickly list which drives have BitLocker enabled and whether their recovery keys are backed up. Backup Automation: Ensure every new encrypted drive backs its key to Active Directory or Azure AD. Emergency Extraction: Retrieve a lost key without navigating the BitLocker control panel. Auditing & Compliance: Generate reports on key storage status across hundreds of machines.

2. Core PowerShell Module: BitLocker All commands reside in the built-in module. Load it with: Import-Module BitLocker

Note: Must be run as Administrator. 3. Key Commands for Recovery Key Operations | Command | Purpose | | :--- | :--- | | Get-BitLockerVolume | Lists volumes and their protection status, including key protectors. | | Backup-BitLockerKeyProtector | Backs up a recovery key to AD DS or Azure AD. | | Manage-bde (legacy tool) | Offers advanced recovery key extraction (e.g., manage-bde -protectors -get C: ). | 4. Practical Scenarios Scenario A: View Recovery Key for the Local C: Drive $Volume = Get-BitLockerVolume -MountPoint "C:" $Volume.KeyProtector | Where-Object {$_.KeyProtectorType -eq 'RecoveryPassword'} | Select-Object RecoveryPassword

Output: 481237-641582-... (the 48-digit recovery key) Scenario B: Backup an Existing Recovery Key to Active Directory $Volume = Get-BitLockerVolume -MountPoint "D:" Backup-BitLockerKeyProtector -MountPoint "D:" -KeyProtectorId $Volume.KeyProtector[0].KeyProtectorId

Verification: Check AD attribute msFVE-RecoveryPassword . Scenario C: Retrieve a Lost Recovery Key from AD (Remotely) Get-ADObject -Filter {objectClass -eq 'msFVE-RecoveryInformation'} -SearchBase "OU=Workstations,DC=contoso,DC=com" | Where-Object {$_.Name -like "*COMPUTERNAME*"} | Select-Object Name, @{n="RecoveryKey";e={$_.'msFVE-RecoveryPassword'}}

Scenario D: Audit Machines Missing AD Backup $computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name foreach ($pc in $computers) { $recovery = Get-ADObject -Filter {objectClass -eq 'msFVE-RecoveryInformation'} -SearchBase "CN=$pc,OU=Computers,DC=contoso,DC=com" -ErrorAction SilentlyContinue if (!$recovery) { Write-Host "$pc is missing a recovery key backup!" -ForegroundColor Red } }

5. Protecting the Protector: Security Notes

Never log recovery keys in plain text. Use Read-Host -AsSecureString if prompting users. Restrict script access. Anyone who can run these commands as admin on a machine can decrypt the drive. Limit who can execute these scripts. Use JIT (Just-In-Time) access for the AD attributes containing recovery passwords. Rotate keys after retrieval. If you extract a key for support reasons, force a new key to be generated: manage-bde -protectors -add C: -recoverypassword then delete the old protector.

6. Automating Backup at Encryption Time Instead of relying on memory, embed backup into your deployment script: Enable-BitLocker -MountPoint "C:" -TpmProtector -RecoveryPasswordProtector -SkipHardwareTest $Volume = Get-BitLockerVolume -MountPoint "C:" Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $Volume.KeyProtector[1].KeyProtectorId