Get Bitlocker Recovery Key From Active Directory Jun 2026

If you want, I can produce a one-line PowerShell command tailored to your environment (provide the exact computer name or OU).

When an organization deploys BitLocker Drive Encryption, backup recovery keys can be automatically saved to Active Directory Domain Services (AD DS). This ensures that if a user forgets their PIN, loses their smart card, or encounters a hardware change, an administrator can quickly retrieve the password and restore data access. Prerequisites for Access

# Fetch BitLocker recovery keys for a specific computer Get-ADComputer -Identity "Target-PC" -Properties "msFVE-RecoveryInformation" | Select-Object -ExpandProperty "msFVE-RecoveryInformation" Use code with caution. Find Key by 8-Digit Key ID Subset

If a computer account is deleted and re-created, the link to old recovery keys is severed. Check the Active Directory Recycle Bin if the object was recently removed. get bitlocker recovery key from active directory

Alternatively, if you know the computer name, search for the computer object directly.

The BitLocker Recovery Password Viewer (part of Remote Server Administration Tools) must be enabled on the domain controller or management workstation. Method 1: Active Directory Users and Computers (ADUC)

If you prefer a more modern interface or need to search globally across the domain, ADAC is an excellent choice. If you want, I can produce a one-line

In the Properties window, click on the tab.

The tool will locate the corresponding computer name, full Backup ID, and the 48-digit recovery key. Method 3: Using PowerShell (Fastest & Scalable)

# Search the entire directory for a matching Key ID fragment $KeyID = "A1B2C3D4" # Replace with the user's 8-digit ID Get-ADObject -Filter "objectClass -eq 'msFVE-RecoveryInformation' -and name -like '*$KeyID*'" -Properties "msFVE-RecoveryPassword" | Select-Object Name, msFVE-RecoveryPassword Use code with caution. Prerequisites for Access # Fetch BitLocker recovery keys

2. Method 1: Using Active Directory Users and Computers (ADUC)

# Replace "DESKTOP-PC01" with the actual computer name $ComputerName = "DESKTOP-PC01" $Computer = Get-ADComputer -Identity $ComputerName Get-ADObject -Filter "objectClass -eq 'msFVE-RecoveryInformation'" -SearchBase $Computer.DistinguishedName -Properties msFVE-RecoveryPasswordObjectDN, msFVE-RecoveryPassword | Select-Object Name, @Name="RecoveryKey";Expression=$_.msFVE-RecoveryPassword Use code with caution. Find the Computer Name by Using the Key ID

If you're interested in reading more about BitLocker and recovery key management, I recommend checking out the following papers:

Your users will thank you when that blue recovery screen appears—and you hand them the golden 48-digit key in under a minute.

Locate the computer object for the affected user. Check the default Computers container or the specific Organizational Unit (OU) where the device resides.