Blog Details

This article will walk you through the process of recovering BitLocker keys from Active Directory Domain Services. Organizations can access BitLocker-protected data by using BitLocker recovery information kept in Active Directory Domain Services (AD DS). It is recommended to design a BitLocker key and password recovery model while planning BitLocker deployment.

This article assumes you understand how to configure Active Directory Domain Services to automatically back up BitLocker recovery information and what sorts of recovery information are saved to Active Directory Domain Services. How easily one can retrieve back the BitLocker Key and Password Recovery.

This article does not go into detail about how to set up Active Directory Domain Services to store BitLocker recovery information.

Recommended final solution is BLR BitLocker Tool for Recovery if all the manual steps does not work. So read all the manual steps and get back the key and password of BitLocker encryption.

What exactly is BitLocker key and password recovery

BitLocker key and password recovery is the process of restoring access to a BitLocker-protected drive if it cannot be opened properly. In a recovery scenario, the following alternatives for restoring drive access are available:

The recovery password can be supplied by the user. If the business permits users to print or save recovery passwords, they can enter the 48-digit recovery password they printed or saved on a USB drive or using a Microsoft account online. Saving a recovery password with a Microsoft account online is only permitted when BitLocker is utilized on a non-domain member PC.

Data recovery agencies can unlock the drive using their credentials. If the drive is an operating system drive, the data recovery agent must mount it as a data drive on another computer before it can be unlocked.

The recovery password can be obtained via Active Directory Domain Services and used to unlock the drive by a domain administrator. It is suggested to save recovery passwords in Active Directory Domain Services so that IT experts can access recovery passwords for drives in a company if necessary. This solution requires that this recovery method be enabled in the BitLocker group policy setting. Choose how BitLocker-protected operating system drives can be retrieved in the Local Group Policy Editor by going to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives. See BitLocker Group Policy settings for additional details.

Why and How does BitLocker key Recovery and password recovery Occur?

Examples of specific situations that will send BitLocker into recovery mode when attempting to start the operating system disk are provided in the list below:

• When an attack is discovered, devices such as tablets and phones that solely utilize BitLocker Device Encryption or PCs that employ BitLocker Drive Encryption instantly reboot and enter BitLocker recovery mode. Administrators can enable this feature by configuring the Interactive logon: Machine account lockout threshold Group Policy setting in the Local Group Policy Editor under Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options. Alternately, users can utilize Exchange ActiveSync’s MaxFailedPasswordAttempts policy (also customizable through Microsoft Intune) to restrict the number of unsuccessful password tries before the device enters Device Lockout mode.
• Changing the BIOS or firmware boot device order results in BitLocker recovery tool on devices with TPM 1.2. TPM 2.0-equipped devices, however, don’t launch BitLocker recovery in this scenario. Because the OS Boot Loader is unaffected, TPM 2.0 does not view a firmware change in boot device order as a security issue.
• inserting or removing a CD or DVD after placing the CD or DVD drive before the hard disk in the BIOS boot sequence.
• failing to start the computer from a network drive before the hard disk.
• a portable computer’s docking or undocking. The docking condition of the portable computer may occasionally be taken into account when measuring the system status and is required to be consistent in order to unlock BitLocker (depending on the computer manufacturer and BIOS). Therefore, if BitLocker is activated while a portable computer is docked to its docking station, it may also be necessary to dock the machine when it is unlocked. On the other hand, if a portable computer isn’t docked to its docking station when BitLocker is activated, it might be necessary to unplug it when it’s unlocked.
• The creation, deletion, or resizing of a primary partition are all changes that can be made to the disk’s NTFS partition table.
• wrongly entering the personal identification number (PIN) too many times, triggering the TPM’s anti-hammering logic. Anti-hammering logic is a software or hardware technique that delays accepting PIN submissions until after a predetermined period of time has passed, hence increasing the difficulty and cost of a brute force attack on a PIN.
• If using USB-based keys rather than a TPM, disable the functionality for reading the USB device in the pre-boot environment from the BIOS or UEFI firmware.
• turning off, disabling, deactivating, or clearing the TPM.
• Changing the relevant boot metrics due to upgrading crucial early starting components like the BIOS or UEFI firmware.
• forgetting the PIN after enabling PIN authentication.
• updating the ROM firmware of an option.
• TPM firmware upgrade.
• hardware insertion or removal, such as installing a new card in the computer, such as some PCMIA wireless cards.
• removing, reinstalling, or totally draining a portable computer’s smart battery of its charge.
• alterations to the disk’s master boot record.
• alterations to the disk’s boot manager.
• from the OS system, the TPM is hidden. There are some BIOS or UEFI settings that can be utilized to stop the TPM from being enumerated by the operating system. By using this option, the TPM can be made invisible to the operating system. The BIOS and UEFI secure startup are disabled, and the TPM is not responsive to orders from any software when it is concealed.
• utilizing a keyboard that incorrectly enters the PIN or whose keyboard map does not correspond to the keyboard map that the pre-boot environment assumes. The entering of improved PINs may be prohibited by this issue.
• The TPM validation profile’s Platform Configuration Registers (PCRs) can be changed. For instance, if PCR[1] is enabled, BitLocker will measure the majority of BIOS configuration changes and will activate recovery mode even when non-boot critical BIOS parameters are modified.

Note: There are BIOS options on some systems that prevent the need for some PCR measurements, such as PCR[2]. Because the PCR measurement will be different, changing this parameter in the BIOS will force BitLocker to enter recovery mode.

• Transferring a BitLocker-protected drive to a new machine.
• Upgrading to a new motherboard with a new TPM.
• When startup key authentication is enabled, the USB flash drive with the startup key is lost.
• Failure to pass the TPM self-test.
• Having a client computer with a BIOS, UEFI firmware, or an option ROM component that is not compliant with the applicable Trusted Computing Group requirements. A non-compliant implementation, for example, may store volatile data (such as time) in TPM measures, resulting in different measurements on each startup and BitLocker starting in recovery mode.
• Changing the TPM’s storage root key usage authorization to a non-zero value.

Note: Because the BitLocker TPM initialization process sets the usage authorization value to zero, another user or process must have altered it directly.

• Enabling or disabling the code integrity check in Windows Boot Manager (Bootmgr).
• During the boot process, press the F8 or F10 key.
• Adding or deleting add-in cards (such as video or network cards), as well as upgrading add-in card firmware.
• Changing the boot order to something other than the hard disk using a BIOS hot key during the boot process.

Note: It is recommended that you determine what triggered your recuperation before you begin. This may assist to avoid the problem from recurring in the future. For example, if it is found that an attacker manipulated the computer via gaining physical access, new security measures for tracking who has physical presence can be developed. BitLocker reseals the encryption key to the current values of the measured components when the recovery password has been used to regain access to the PC.

• In planned cases, such as known hardware or firmware changes, BitLocker protection can be temporarily suspended to prevent beginning recovery. Because suspending BitLocker leaves the drive completely encrypted, the administrator can simply re-enable BitLocker protection after the planned task is completed. Suspend and resume also reseals the encryption key without requiring the recovery key to be entered.

Note: Unless a reboot count is defined using the manage-bde command line tool, BitLocker will automatically restart protection when the PC is rebooted if it is suspended.

The BitLocker network unlock feature can be activated to provide the secondary authentication factor when the computers don’t have an on-premises user to provide the additional authentication method, which is useful if software maintenance necessitates restarting the computer and two-factor authentication is being used.

Unplanned or undesirable action has been used to characterize recovery. Recovery can, however, also result from a production scenario that was intended, such as managing access control. BitLocker can be made to recover before the machine is transferred to a new user when desktop or laptop devices are redeployed to various departments or employees in the company.

Evaluating BitLocker key recovery

Before developing a full BitLocker key and password recovery process, it is recommended to evaluate how the recovery process works for both end users (those who call the helpdesk for the recovery password) and administrators (those who assist the end user in receiving the recovery password). Before users encounter a recovery situation, they can quickly move through the recovery procedure by using the manage-bde.exe command line option -forcerecovery.

Force a recovery on your local computer or laptop.

• Hit on Windows button and type cmd.
• Then, using the mouse, right-click CMD dot exe and select Run as Administrator.
• Now open the console CMD prompt and type the command.

To force a remote computer’s recovery:

• Choose the Start button and enter cmd.
• Right-click cmd dot exe or Command Prompt and choose Run as administrator.
• Enter the following command at the command prompt:

Note: Unless a TPM protector is installed or protection is suspended by the user, recovery caused by -forcerecovery persists after numerous restarts. The -forcerecovery option is not recommended when utilizing Modern Standby devices (like as Surface devices), because BitLocker must be explicitly unlocked and disabled from the WinRE environment before the OS can boot up again. See BitLocker Troubleshooting: Continuous reboot loop with BitLocker recovery on a slate tablet for additional information.

Preparing for the Recovery Process

Consult the organization’s current best practices for recovering sensitive information before beginning the BitLocker recovery process. How does the business, for instance, handle forgotten Windows passwords? How does the company reset the PIN on smart cards? A BitLocker key and password recovery model can be created with the use of these best practices and pertinent resources (including people and tools).

Organizations that rely on BitLocker Drive Encryption and BitLocker Key Management should utilize the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. To Go to protect data on numerous computers and removable drives running Windows 11, Windows 10, Windows 8, or Windows 7, as well as Windows to Go. MBAM facilitates deployment and management of BitLocker implementations and enables administrators to configure and keep track of encryption for operating systems and fixed drives. A user is prompted by MBAM before fixed disks are encrypted. Additionally, MBAM stores recovery keys for both fixed and detachable drives, simplifying management of recovery. MBAM can be utilized either as a stand-alone solution or as a component of a Microsoft System Center implementation. Visit Microsoft BitLocker Administration and Monitoring for further information.

Users can use a recovery password to gain access to encrypted data once a BitLocker key and password recovery has been started. For the company, take into account both self-recovery and recovery password retrieval techniques.

• When the recovery procedure has been determined:

1. Understand how to get a recovery password. See:
2. Self-recovery

• Recovery password recovery

1. Determine a post-recovery procedure, such as examining why the recovery occurred and resetting the recovery password. See:
2. Post-recovery evaluation

Self-recovery

In some situations, users may have a printout or a USB flash drive with the recovery password and can execute self-recovery. It is suggested that the organization develop a self-recovery policy. If self-recovery requires the use of a password or recovery key saved on a USB flash drive, users should be cautioned not to put the USB flash drive in the same location as the PC, especially while traveling. For example, if the PC and the recovery components are both in the same bag, an unauthorized user could easily obtain access to the PC. Another policy to consider is requiring users to contact the Helpdesk before or after doing self-recovery in order to identify the root problem.

Recovery password recovery

If the user does not have a recovery password printed or on a USB flash drive, the user must be able to obtain it from an online source. If the PC is a domain member, the recovery password can be saved to AD DS. However, the recovery password is not automatically backed up to AD DS. Before BitLocker could be installed on the PC, the recovery password had to be backed up to AD DS using the required group policy settings. BitLocker group policy settings can be located under Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption in the Local Group Policy Editor or the Group Policy Management Console (GPMC). The recovery techniques that can be used to restore access to a BitLocker-protected drive if an authentication method fails or is unavailable to be utilized are defined in the following policy settings.

• Select the method for recovering BitLocker-protected operating system disks.
• Choose the method for recovering BitLocker-protected fixed disks.
• Select the method for recovering BitLocker-protected detachable disks.

Select Save BitLocker recovery information to Active Directory Domain Services in each of these policies, and then specify which BitLocker key and password recovery information to store in AD DS. If it is desirable, check the Do not enable BitLocker until recovery information is stored in AD DS check box to restrict users from enabling BitLocker until the machine is joined to the domain and the backup of BitLocker recovery information for the disk to AD DS is successful.

Note: Users are recommended to save their BitLocker recovery password with their Microsoft account online if the PCs are part of a workgroup. It is suggested to keep an online copy of the BitLocker recovery password to ensure that access to data is not lost in the event that a recovery is required.

Domain administrators can access BitLocker key and password recovery passwords for specific computer objects in Active Directory using the BitLocker Recovery Password Viewer for Active Directory Users and Computers tool.

The list below can be used as a template for developing a recovery method for recovering passwords. The BitLocker Recovery Password Viewer for Active Directory Users and Computers utility is used in this example method.

• Take note of the user’s PC name.
• Check the user’s identification.
• In AD DS, look for the recovery password.
• Collect data to determine why recovery occurred.
• Provide the user with the recovery password.

Take note of the computer’s name.

The user’s computer name can be used to locate the recovery password in AD DS. If the user does not know the name of the computer, have him or her read the first word of the Drive Label in the BitLocker Drive Encryption Password Entry user interface. This was the computer name when BitLocker was enabled, and it is most likely the computer’s present name.

Verify the user’s identity.

The individual requesting the recovery password should be verified as an authorized user of that computer. It should also be verified that the computer for which the user provided the name belongs to the user.

Find the recovery password in AD DS.

Find the computer object with the same name in AD DS. Because computer object names are listed in the AD DS global catalog, the item should be able to be located even in a multi-domain forest.

Multiple recovery passwords

If several recovery passwords are saved under a computer object in AD DS, the name of the BitLocker key and password recovery information object includes the date the password was created.

To ensure that the proper password is entered and/or to avoid entering the erroneous password, ask the user to read the eight-character password ID presented in the recovery panel.

Because the password ID is a unique value associated with each recovery password saved in AD DS, running a query using this ID returns the proper password to unlock the encrypted volume.

Collect data to determine why recovery occurred.

Before providing the user with the recovery password, information that will aid in determining why the recovery was required should be gathered. During the post-recovery study, this information might be used to examine the root cause. More information about post-recovery analysis can be found at Post-recovery analysis.

Provide the User a Recovery password.

Because the recovery password is 48 characters long, the user may need to write it down or type it on a different computer. To eliminate the security issues associated with an uncontrolled password, while using MBAM or Configuration Manager BitLocker Management, the recovery password is regenerated after it is recovered from the MBAM or Configuration Manager database.

Note: The user may mishear or mistype the 48-digit recovery password since it is long and involves a mix of digits. The boot-time recovery console detects input problems in each 6-digit block of the 48-digit recovery password using built-in checksum numbers and allows the user to repair such errors.

Post-recovery evaluation

When a volume is unlocked using a recovery password, an event is logged, and the platform validation measures in the TPM are reset to match the present configuration. Unlocking the volume indicates that the encryption key has been released and is ready for on-the-fly encryption when writing data to the volume and on-the-fly decryption when reading data from the volume. BitLocker behaves the same way after the volume is unlocked, regardless of how access was allowed.

If an administrator notices that a computer has repeated recovery password unlocks, he or she should perform post-recovery analysis to determine the root cause of the recovery and refresh BitLocker platform validation so that the user does not have to enter a recovery password each time the computer boots up. More information can be found at:

• Determine the underlying cause of the recovery.
• Determine the root cause.

Determine the underlying cause of the recovery.

If a user needs to recover the drive, it’s critical to figure out what caused the recovery as soon as feasible. Analyzing the condition of the computer and detecting tampering properly may identify threats with wider consequences for company security.

While an administrator can explore the cause of recovery remotely in some situations, the end user may need to bring the computer containing the recovered drive on site to further study the root cause.

Examine and respond to the following questions for the organization:

• Which BitLocker protection option (TPM, TPM + PIN, TPM + startup key, startup key alone) is in use? Which PCR profile is currently active on the PC?
• Is it possible that the user simply forgot the PIN or misplaced the startup key? Where could a token be if it was lost?
• Was recovery triggered by a boot file modification if TPM mode was enabled?
• If the recovery was caused by a boot file change, was the boot file change the result of an intended user action (such as a BIOS upgrade) or malicious software?
• When was the last time the user successfully started the computer, and what occurred to it since then?
• Could the user have come into contact with harmful software or left the machine unattended since the last successful boot?

Use the BitLocker command-line tool to view the current settings and protection mode to assist answer these questions:

Scan the event log for occurrences that may assist explain why recovery was initiated (for example, a boot file modification). Both of these functions can be carried out remotely.

Determine the root cause.

After determining what caused the recovery, BitLocker protection can be reset to prevent recovery on every restart.

The specifics of this reset may differ depending on the cause of the recovery. If the root cause cannot be discovered, or if malicious software or a rootkit may have infected the computer, Helpdesk should respond appropriately using best-practice virus rules.

Note: By suspending and restoring BitLocker, you can reset the validation profile.

PIN not known

If a user forgets their PIN, they must reset it while logged in to the computer to prevent BitLocker from commencing recovery every time the computer is rebooted.

To avoid further recovery due to an unknown PIN

1. Use the recovery password to unlock the computer.
2. Resetting the PIN:

• Select and hold the drive, then click Change PIN.
• Select Reset a Forgotten PIN from the BitLocker Drive Encryption popup. If the signed-in account is not an administrator account, administrative credentials must be provided at this point.
• In the PIN reset dialog, enter and confirm the new PIN to be used, then click Finish.
• The new PIN can be used the next time the drive has to be unlocked.

Startup key misplaced

If the USB flash drive containing the startup key is missing, the drive must be opened using the recovery key. A new startup can then be formed.

To avoid further recovery due to a misplaced startup key

• Log in as an administrator to the PC whose startup key has been misplaced.
• Navigate to Manage BitLocker.
• Select Duplicate start-up key, then insert the clean USB disk onto which the key will be written, and then save.

Alterations to boot files

If the firmware is changed, this error occurs. BitLocker should be paused before performing firmware modifications as a best practice. After the firmware upgrade is complete, protection should be resumed. BitLocker suspension stops the computer from entering recovery mode. If changes were made while BitLocker security was enabled, the recovery password can be used to unlock the drive, and the platform validation profile will be changed to ensure that recovery does not occur again.

Device Encryption with Windows RE and BitLocker

The Windows Recovery Environment (RE) can be used to regain access to a drive that has been encrypted with BitLocker Device Encryption. If a computer fails to startup after two attempts, Startup Repair kicks in. When Startup Repair is triggered by a boot failure, it only patches the operating system and driver files if the boot logs or any accessible crash dump point to a specific corrupted file. Devices that incorporate firmware to enable particular TPM measurements for PCR[7] can check that Windows RE is a trusted operating environment and unlock any BitLocker-protected drives in Windows 8.1 and subsequent versions if Windows RE hasn’t been updated. If the Windows RE environment has been altered, for example, by disabling the TPM, the disks will remain locked until the BitLocker recovery key is provided. If Startup Repair cannot run automatically from the PC and Windows RE must be started manually from a repair disk, the BitLocker recovery key must be provided in order to unlock the BitLocker-protected devices.

When a Remove everything reset from Windows RE is initiated on a device that employs TPM + PIN or Password for OS drive protection, Windows RE will also prompt for a BitLocker recovery key. When you start BitLocker key and password recovery on a keyboardless device with TPM-only protection, Windows RE, not the boot manager, will prompt you for the BitLocker recovery key. After entering the key, Windows RE troubleshooting tools are available, or Windows can be started normally.

The BitLocker recovery screen displayed by Windows RE includes accessibility capabilities such as a narrator and an on-screen keyboard to assist in entering the BitLocker recovery key. If the Windows boot manager requests the BitLocker recovery key, those tools may be unavailable.

Press Windows + CTRL + Enter to activate the narrator during BitLocker key and password recovery in Windows RE. Tap on a text input control to bring up the on-screen keyboard.

BitLocker recovery interface

During BitLocker recovery, Windows shows a bespoke recovery message as well as a few suggestions indicating where a key might be obtained. These enhancements may be useful to a user during BitLocker recovery.

Personalized recovery message

Starting with Windows 10, version 1511, BitLocker Group Policy settings allow you to configure a custom recovery message and URL on the BitLocker key and password recovery screen. The address of the BitLocker self-service recovery portal, the IT internal website, or a phone number for support can be included in the custom recovery message and URL.

This policy can be configured using GPO under Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > BitLocker Drive Encryption > BitLocker Drive Encryption > BitLocker Drive En Set the message and URL for the pre-boot recovery.

It can also be configured using mobile device management (MDM), such as Intune, by using the BitLocker CSP:

As in – A customized of recovery screen:

Recovery key hints for BitLocker

Beginning with Windows 10, version 1903, BitLocker metadata has been updated to contain information about when and where the BitLocker recovery key was backed up. This information is not accessible via the UI or any public API. It is only utilized by the BitLocker key and password recovery screen as hints to help a user locate a volume’s recovery key. On the recovery screen, hints are given that point to the area where the key was saved. Both the current (blue) and legacy (black) recovery screens show hints. Both the boot manager recovery screen and the WinRE unlock screen are affected by the hints.

Important: It is not recommended to print or save recovery keys to a file. Use Active Directory backup or a cloud-based backup instead. Azure Active Directory (Azure AD) and Microsoft accounts are included in cloud backup.

There are principles that regulate which clue is displayed during recovery (in the order of processing):

• If a custom recovery message has been configured (through GPO or MDM), it will always be displayed.
• Always show a generic hint: Visit for additional details.
• https://aka.ms/recoverykeyfaq.
• If there are numerous recovery keys on the drive, prioritize the most recently produced (and successfully backed up) recovery key.
• Prioritize keys with successful backups above keys with no backups.
• Backup hints should be prioritized in the following order for remote backup locations: Microsoft Account > Azure Active Directory > Active Directory.
• Instead of two distinct hints, show a combined hint, “Look for a printout or a text file with the key,” if a key has been printed and saved to file.
• If multiple backups of the same type (removal vs. local) have been conducted for the same recovery key, prioritize backup information based on the most recently backed-up date.
• For keys stored to an on-premises Active Directory, there is no explicit hint. A personalized message (if specified) or a generic message, “Contact your organization’s help desk,” is presented in this scenario.
• If there are two recovery keys on the disk, but only one has been successfully backed up, the system requests the backed-up key, even if another key is newer.

Result showing: Only custom URL is on screen displayed.

Now for Example 3 – Single Backup with Single BitLocker Recovery key

In the result – Microsoft account is visible

Now for Example 4 – Single Backup with Single BitLocker Recovery key

Now for Example 5 – Single Backup with Single BitLocker Recovery key

In the result it shows most recent key

Utilizing additional recovery data

In addition to the 48-digit BitLocker key and password recovery, Active Directory stores additional recovery information. This section explains how these additional details can be utilized.

BitLocker key envelop

If the recovery methods described earlier in this document fail to unlock the volume, the BitLocker Repair utility can be used to decrypt the volume on a block-by-block basis. The application employs the BitLocker key package to aid in the recovery of encrypted data from severely damaged drives. Even if the correct recovery password fails to decrypt the damaged volume, the recovered data can be used to recover encrypted data. It is still advised to save the recovery password. A key product cannot be utilized without the associated recovery password.

By default, the BitLocker key package is not retained. To save the package along with the recovery password in AD DS, the option Backup recovery password and key package must be selected in the group policy settings that govern the recovery method. Additionally, the key bundle may be exported from a working volume. Refer to Retrieving the BitLocker Key Package for information on exporting key packages.

Resetting password recovery

After a recovery password has been provided and used, it is recommended to invalidate it. The recovery password can be rendered invalid for any valid reason, including when it has been provided and used.

There are two methods to invalidate and reset the recovery password:

• Using manage-bde.exe, you can remove the old recovery password and apply a new one. The procedure specifies the command and syntax associated with this technique.
• Execute a script To reset the password without decrypting the volume, a script can be executed. The procedure’s sample script demonstrates this functionality. The sample script generates a new recovery password and renders all other passwords ineffective.

Summary:

The entire article is covered up about the BitLocker key and password recovery module and how to retrieve back the data from BitLocker drive with key and password and without BitLocker key and password. Simple steps but thorough guidelines and task helps users to retrieve BitLocker key and password from the saved locations using different modules. Microsoft itself provides options in the beginning while creating or putting BitLocker encryption on drive.

Recommended solution is to Try BLR BitLocker data recovery tool if unable to locate BitLocker key and password recovery