1

So from what I’ve read this should be pretty simple but for some reason every query I run returns with no output on multiple computer objects that 100% do have a bitlocker key stored in them.

Here’s what I have been running.

$pc = Get-ADComputer PC01
$dn = $pc.DistinguishedName
$ldPath = "AD:\",$dn -join ""
$ldObj = Get-ChildItem $ldPath | where {$_.objectClass -eq "msFVE-RecoveryInformation" }

$objComputer = Get-ADComputer <ComputerName>
$Bitlocker_Object = Get-ADObject -Filter {objectclass -eq 'msFVE-RecoveryInformation'} -SearchBase $objComputer.DistinguishedName -Properties 'msFVE-RecoveryPassword'
$Bitlocker_Object.msFVE-RecoveryPassword

Am I missing something?

5 Spice ups
2

Wasn’t running the query with admin privileges, that’ll do it.

2 Spice ups
3 
$ADObject = get-ADObject -Filter * | ? {$_.DistinguishedName -match $ComputerObject.Name -and $_.ObjectClass -eq "msFVE-RecoveryInformation") | ft

Try that and report back findings

4

You can include a #Requires statement so that Powershell will check if it is running as an administrator.

#Requires -RunAsAdministrator
3 Spice ups
5

I wrote one a while back…

IT Pro Today - Get BitLocker Recovery Information from AD Using PowerShell

Updated script here:

HTH

Bill