Get Bitlocker Recovery Key From Active Directory Jun 2026

Right-click the (e.g., WS-LAPTOP-0452 ) and select Properties .

You must have Domain Admin rights or have specific permissions delegated to your account to view administrative properties on computer objects.

The Active Directory schema must be updated to include the BitLocker recovery property attributes (automatically included in Windows Server 2008 and later).

PowerShell is often faster for administrators and can be used for bulk reporting. get bitlocker recovery key from active directory

Import-Module ActiveDirectory $cn = "COMPUTERNAME" $dn = (Get-ADComputer $cn).DistinguishedName Get-ADObject -SearchBase $dn -Filter 'objectClass -eq "msFVE-RecoveryInformation"' -Properties msFVE-RecoveryPassword, msFVE-RecoveryGuid, whenCreated | Select-Object @Name='Computer';Expression=$cn, msFVE-RecoveryGuid, msFVE-RecoveryPassword, whenCreated

This article is a step-by-step, technical deep dive on exactly using five different methods—from GUI tools to PowerShell automation.

param( [Parameter(Mandatory=$true)] [string]$ComputerName, [Parameter(Mandatory=$true)] [string]$KeyID Right-click the (e

A list of recovery keys associated with that computer will display, along with their configured dates and Backup IDs. Match the displayed on the user's locked screen with the ID in the list to find the correct 48-digit password.

If you are finding that keys are not being backed up to Active Directory, you should verify that the Group Policy "Store BitLocker recovery information in Active Directory Domain Services" is properly configured, as noted in the Microsoft documentation. Have you already checked that policy?

How to Get BitLocker Recovery Key from Active Directory: A Complete Guide PowerShell is often faster for administrators and can

A known issue with Windows 11 24H2 is that the "Enable BitLocker" task sequence step can fail with error 0x80070057 . This happens because the step defaults to backing up the key to Azure AD, even in on-premises environments. The solution is to edit the task sequence and explicitly configure the "Enable BitLocker" step to back up to on-premises AD only. This ensures the step bypasses the Azure AD backup requirement, allowing the process to complete successfully.

Now helpdesk staff can retrieve keys without domain admin rights.

Method 2: Using Active Directory Administrative Center (ADAC)

Getting a BitLocker key from AD is easy— The real work isn’t recovery; it’s prevention. Make sure your BitLocker GPO is set to "Require BitLocker backup to AD DS" before you deploy machines.