BitLocker is a Windows security feature that protects your files by encrypting the data stored on your computer’s drive. It helps prevent unauthorized access if someone removes your hard drive or attempts to access your files without the correct authentication.
In a business or enterprise environment, IT administrators often manage BitLocker encryption through Active Directory Domain Services (AD DS). When BitLocker is enabled on a domain-joined computer, its recovery information can be backed up to Active Directory. This makes it easier for authorized administrators to retrieve recovery keys when employees forget their passwords, lose access to their startup PINs, or encounter unexpected recovery prompts.
However, finding a BitLocker recovery key in Active Directory requires the correct permissions and properly configured directory services. The recovery information must also have been backed up before you can retrieve it from that location.
If you are an IT administrator or help desk technician, you can use Active Directory Users and Computers (ADUC) or PowerShell to locate the recovery information associated with a computer account.
In this guide, we’ll explain how to access BitLocker recovery keys in Active Directory on Windows Server, how to identify the correct recovery key, and what to do if the recovery information is missing.
Access BitLocker Recovery Keys in Active Directory
To access BitLocker recovery keys in Active Directory, follow these steps:
- To begin, sign in to a domain-connected administrative computer using an account with permission to view BitLocker recovery information.
- Open Active Directory Users and Computers (ADUC) using the dsa.msc command.
- Enable Advanced Features from the View menu.
- Locate the computer account associated with the encrypted device.
- Open its Properties window and select the BitLocker Recovery tab.
- Review the available recovery passwords and identify the correct entry using its Recovery Password ID.
- Verify the Recovery Password ID against the ID displayed on the affected computer’s BitLocker recovery screen.
- Provide the matching 48-digit recovery password only to the authorized user or administrator who needs it.
1: Understand How BitLocker Recovery Keys Are Stored in Active Directory
Before retrieving a recovery key, it helps to understand how Windows stores BitLocker recovery information in an Active Directory environment.
When an administrator configures BitLocker to back up recovery information to Active Directory Domain Services, Windows can store the recovery password and associated metadata under the computer’s directory object.
The recovery information is generally represented through the msFVE-RecoveryInformation objects associated with the computer account. These objects contain important details, including the recovery password, recovery password ID, and creation timestamp.
The recovery password is a unique 48-digit numerical code that allows an authorized person to unlock an encrypted drive when normal authentication is unavailable.
One important thing to remember is that joining a computer to a domain does not automatically guarantee that its BitLocker recovery key has been backed up. The appropriate Group Policy settings, client configuration, and backup operation must be in place.
You should also understand that Active Directory stores recovery information only when the backup process has been configured and completed successfully.
2: Sign In With an Authorized Administrative Account
To retrieve BitLocker recovery information, you need access to the domain environment and sufficient permissions to read the recovery objects.
Sign in to a domain-connected Windows computer using an authorized administrative account. This could be a domain administrator account or a delegated IT support account with the required permissions.
You do not necessarily need full Domain Admin privileges. Organizations can delegate access to BitLocker recovery information to specific help desk or security teams through appropriate Active Directory permissions.
Before proceeding, confirm that the computer can communicate with a domain controller. A working domain connection helps ensure that you can access the latest directory information.
You can follow this general path: Windows sign-in > Domain account > Administrative access > Active Directory management tools.
If you are using a standard employee account without the required permissions, you may not be able to view the recovery information. In that situation, contact your organization’s Active Directory administrator rather than attempting to bypass directory security.
3: Open Active Directory Users and Computers
The easiest graphical method for accessing BitLocker recovery information is through Active Directory Users and Computers.
Press Windows + R to open the Run dialog box. Type dsa.msc and press Enter. The Active Directory Users and Computers console should open if the management tools are installed and available on your computer.
If you cannot open the console, you may need to install the appropriate Remote Server Administration Tools (RSAT) for your Windows edition or use a Windows Server computer with the Active Directory management tools installed.
Once the console opens, expand your domain in the left navigation panel. You will see the organizational units and containers used to organize your domain accounts and computers.
Follow this navigation path: Windows + R > dsa.msc > Enter > Your Domain.
Make sure you select the correct domain, especially if your organization manages multiple domains or has separate test and production environments.
4: Enable Advanced Features in Active Directory
After opening Active Directory Users and Computers, you need to enable Advanced Features. This option makes additional directory information and management tabs available, including the BitLocker Recovery tab.
At the top of the Active Directory Users and Computers window, select the View menu. From the dropdown menu, click Advanced Features. A checkmark should appear next to the option once it is enabled.
Now, navigate through your domain’s organizational units to locate the computer account whose BitLocker recovery key you need.
For example, if your organization stores employee computers in a dedicated organizational unit, expand that OU and look for the required computer name.
Follow this path: Active Directory Users and Computers > View > Advanced Features > Domain > Organizational Unit.
Enabling Advanced Features does not grant additional permissions. It simply makes more directory management options visible to users who already have the necessary access.
5: Locate the Computer Account
Now that Advanced Features is enabled, find the computer account associated with the encrypted device.
You can browse the organizational units manually or use the Find option in Active Directory Users and Computers. To search for a computer, right-click your domain and select Find. Choose Computers as the object type, enter the computer’s name, and start the search.
Once the correct computer account appears, right-click it and select Properties.
Make sure you select the correct computer account. Organizations sometimes reuse computer names or maintain multiple computer accounts for testing, retired devices, and employee workstations.
The navigation path is Active Directory Users and Computers > Domain > Find > Computers > Search > Computer Properties.
If you are unsure about the computer name, ask the employee or check the device’s hostname before proceeding. You can also identify the computer name on the Windows sign-in screen or through the organization’s device inventory system.
6: Open the BitLocker Recovery Tab
After opening the computer account’s Properties window, look for the BitLocker Recovery tab.
Select this tab to view the recovery information stored for that computer in Active Directory. If the recovery key was successfully backed up, you should see one or more recovery entries.
Each entry may include a recovery password ID, recovery password, and creation date. These details help administrators identify the correct recovery information, particularly when a computer has been encrypted, decrypted, or re-encrypted multiple times.
Follow this path: Computer Account > Properties > BitLocker Recovery.
If you cannot find the BitLocker Recovery tab, check whether Advanced Features is enabled. Also verify that the Active Directory management tools support the required functionality and that your account has permission to read the recovery information.
If the tab is available but contains no recovery entries, the computer’s recovery information may not have been backed up to Active Directory.
7: Identify the Correct BitLocker Recovery Password
This is one of the most important steps because a computer may have multiple BitLocker recovery entries.
When a Windows computer displays the BitLocker recovery screen, it shows a Recovery Key ID. This ID helps you identify which recovery password matches the current recovery request.
Compare the Recovery Key ID displayed on the affected computer with the recovery password IDs listed in the BitLocker Recovery tab in Active Directory.
Select the entry that matches the ID shown on the recovery screen. Once you identify the correct entry, use its associated 48-digit recovery password.
For example, if the recovery screen displays a particular Recovery Key ID, locate the corresponding entry in Active Directory instead of selecting the newest entry automatically.
The navigation path is BitLocker Recovery Screen > Recovery Key ID > Active Directory > BitLocker Recovery > Matching Recovery Entry.
Remember that the Recovery Key ID is not the recovery password. The ID helps you identify the correct password, while the 48-digit recovery password is what you enter to unlock the encrypted drive.
8: Retrieve the Recovery Key Using PowerShell
If you prefer command-line administration, you can also retrieve BitLocker recovery information using PowerShell.
First, open PowerShell with an account that has permission to read the relevant Active Directory attributes. Make sure the Active Directory PowerShell module is available.
Run the following command to retrieve the recovery information associated with a computer account:
Get-ADObject -Filter ‘objectClass -eq “msFVE-RecoveryInformation”‘ `
-SearchBase “CN=COMPUTERNAME,OU=Computers,DC=example,DC=com” `
-Properties msFVE-RecoveryPassword,msFVE-RecoveryGuid,whenCreated
Replace the example distinguished name with the actual distinguished name of your computer account. The command searches for BitLocker recovery objects underneath that computer account and requests the recovery password, recovery identifier, and creation date.
To retrieve the information for a specific computer, you can also use the following approach:
$Computer = Get-ADComputer “COMPUTERNAME”
Get-ADObject -SearchBase $Computer.DistinguishedName `
-SearchScope OneLevel `
-LDAPFilter “(objectClass=msFVE-RecoveryInformation)” `
-Properties msFVE-RecoveryPassword,msFVE-RecoveryGuid,whenCreated
Follow this path: PowerShell > Active Directory Module > Get-ADComputer > Get-ADObject > Recovery Information.
These commands may display sensitive recovery passwords. Run them only in an approved administrative environment, avoid saving the output in unsecured files, and do not share the results through ordinary email or public communication channels.
Verify That the Recovery Key Works
After retrieving the correct recovery password, verify the Recovery Key ID one more time before using it.
On the affected Windows computer, enter the matching 48-digit recovery password into the BitLocker recovery screen. Pay attention to the number sequence and enter all digits correctly.
If the password is correct, Windows should unlock the encrypted drive and continue the startup process.
Once the computer starts successfully, investigate why BitLocker requested recovery in the first place. Possible reasons include BIOS or UEFI changes, TPM configuration changes, boot configuration modifications, or other changes that triggered BitLocker’s security checks.
You should also verify that the recovery information is properly backed up to Active Directory so that future recovery requests can be handled more easily.
FAQs
1. Where are BitLocker recovery keys stored in Active Directory?
BitLocker recovery information is stored as child objects under the computer account in Active Directory. These objects use the msFVE-RecoveryInformation class and contain recovery-related attributes.
2. Why can’t I see the BitLocker Recovery tab in Active Directory?
The tab may be missing because Advanced Features is disabled, the required management tools are unavailable, or your account lacks the necessary permissions. Enable Advanced Features from the View menu and check your administrative access.
3. Can I access BitLocker recovery keys without Domain Admin rights?
Yes. You do not always need Domain Admin privileges. An administrator can delegate the appropriate read permissions to authorized help desk technicians or IT support personnel.
4. What is the difference between a BitLocker Recovery Key ID and a recovery password?
The Recovery Key ID identifies a particular recovery entry. The recovery password is the actual 48-digit code required to unlock the encrypted drive.
5. What should I do if the BitLocker recovery key is missing from Active Directory?
First, confirm that you have selected the correct computer account and that you have permission to view its recovery information. If no recovery entry exists, check whether the organization configured and completed the AD DS backup process. You may need to investigate other authorized recovery locations, such as Microsoft Entra ID or an approved organizational backup system.
6. Can I retrieve BitLocker recovery keys using PowerShell?
Yes. You can use the Get-ADObject cmdlet to query BitLocker recovery information stored in Active Directory. The account running the command must have permission to read the relevant directory attributes.
7. Does Active Directory automatically back up every BitLocker recovery key?
No. The organization must configure the appropriate Group Policy or management settings and ensure that the recovery information is successfully backed up. Simply enabling BitLocker does not guarantee that a recovery key exists in Active Directory.
8. Can I use the same recovery key for multiple computers?
No. BitLocker recovery passwords are associated with specific encrypted volumes and recovery information. You must retrieve the correct recovery password for the affected device and match its Recovery Key ID.