Body
Summary
This article has instructions for how to use Active Directory Users and Computers (ADUC) and RSAT to look up BitLocker Recovery Passwords. ADM account required. Help Desk staff and supervisors have these permissions. There are two methods of finding BitLocker recovery passwords: search by BitLocker Password ID or by searching for the Computer object.
The BitLocker Recovery Password Viewer tool is an optional tool included with the Remote Server Administration Tools (RSAT). It lets BitLocker recovery passwords that are stored in on-prem Active Directory Domain Services (AD DS) be located and viewed. This tool can be used to help recover data that is stored on a drive that has been encrypted by using BitLocker. The BitLocker Active Directory Recovery Password Viewer tool is an extension for the Active Directory Users and Computers (ADUC) Microsoft Management Console (MMC) snap-in. Using this tool, a computer object's Properties dialog box can be examined to view the corresponding BitLocker recovery passwords.
Before you begin, you must Install the RSAT: Bitlocker Drive Encryption Administration Utilities. See detailed instructions in the second task below.
How-To
Task: Look up Bitlocker Recovery Passwords
Important: Bitlocker passwords can only be viewed by opening ADUC using an ADM account
Note: You must be on the campus network or on the VPN to sign in with ADM_ credentials (as of Oct. 2, 2024).
Step 1 - Pin the ADUC tool to your Windows Taskbar
Step 2 - Shift-Right-Click on the ADUC tool in your Windows Taskbar and choose Run as different user
Step 3 - Type in your ADM_ username and password, then click OK
To locate a recovery password by using a password ID
Step 1 - In Active Directory Users and Computers (ADUC), right-click the domain container, and then select Find BitLocker Recovery Password.
Click for full-size image
Step 2 - In the Find BitLocker Recovery Password dialog box, type the first eight characters of the recovery password in the Password ID (first 8 characters) box, and then click Search.
Click for full-size image
Step 3 - View the Recovery Password in the Details in the lower half of the pane.
To view the recovery passwords for a computer
Step 1 - In Active Directory Users and Computers, locate and then select the container in which the computer is located.
Step 2 - Right-click the computer object, and then select Properties.
Step 3 - In the Properties dialog box, select the BitLocker Recovery tab to view the BitLocker recovery passwords that are associated with the computer.
Task: Install ADUC and RSAT
Installation Instructions
Step 1 -Install Remote Administration Tools for Active Directory Users and Computers (ADUC) via Company Portal.
Click for full-size image
Step 2- Install RSAT: Bitlocker Drive Encryption Administration Utilities following these steps:
2.1 - Open Settings
2.2 - Click on Apps
2.3 - Click Optional Features
2.4 - Click Add a Feature
2.5 - Select RSAT: Bitlocker Drive Encryption Admin Utilities
2.6 - Click INSTALL
Further Readings
View Windows BitLocker Recovery Key - Public KB Article
BitLocker: Looking up Recovery Keys - Microsoft Entra (ETS Internal)
Microsoft Documentation
Need additional help?
If you have questions or need additional help with these topics, please reach out to your Team Lead or supervisor for assistance.