This document has an overview of Bitlocker, explains how to enable storage of bitlocker recovery keys to the NETID domain via group policy, and how to recover those recovery keys when needed.
Using Bitlocker on systems in a Delegated OU is recommended for any system which is regularly used to interact with restricted or confidential data. Bitlocker provides at-rest volume-level data encryption. To be secure, Bitlocker requires a Trusted Platforms Module (TPM) 1.2 or newer chip. Bitlocker can be used without a TPM, but this is not as secure. The TPM chip allows the volume based encryption to check whether the computer has been tampered with, and trigger a recovery mode if it detects that it has been tampered with. Bitlocker recovery mode can be triggered by a number of situations, including:
When Bitlocker recovery mode is triggered, you must provide the recovery keys to get access to the Bitlocker enabled volumes on the computer. The recovery keys are provided to the user enabling Bitlocker, and can optionally also be written to AD. It is a good idea to write Bitlocker recovery keys to AD, because users can often have a hard time keeping track of the recovery keys for when they later need them; it enables IT support personnel to help users when they run into Bitlocker recovery mode. When the recovery keys are written to AD, only users who have full permissions to your computer objects can read them. By default, this is your OU Admins, the NETID domain admins, and whoever created the computer account. Microsoft's BitLocker Drive Encryption documentation provides a good introduction and background material for Windows 7 that you might want to review. See BitLocker for the equivalent Windows 8 documentation and BitLocker for the equivalent Windows 10 documentation.
To enable AD-based storage of your Bitlocker recovery keys, you'll need to do the following: Create a GPO linked to your delegated OU which enables the following settings:
The setting "Do not enable BitLocker until recovery information is stored to AD DS for operating system drives" is not technically required in order to store your keys in Active Directory. However, We recommend that you enable this setting, because if you don't, you've lost your assurance that this information will be available for recovery when needed. For more information, see the Microsoft BitLocker Group Policy Settings document.
Method 1
$BLV = Get-BitLockerVolume -MountPoint "C:" Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[1].KeyProtectorId Method 2
Please leverage Microsoft documentation to recover your key: https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/recovery-process#helpdesk-recovery-in-active-directory-domain-services. Keep in mind that only members of your OU's bitlocker readers role group can get access. If you have problems, send an email to help@uw.edu to request assistance.
To obtain the Bitlocker recovery key for a computer which has stored it in AD, run the Get-BitLockerRecoveryInfo.vbs script. You will only be able to obtain a recovery password from AD for computers in your delegated OU. Domain admins are capable of recovering any recovery password in AD, if for some reason your OU admins are unavailable. Usage: Get-BitLockerRecoveryInfo.vbs [computername] If [computername] is omitted, the script assumes the local computer. For example: C:\bin>Get-BitLockerRecoveryInfo.vbs naboo Microsoft (R) Windows Script Host Version 5.8 Copyright (C) Microsoft Corporation. All rights reserved. Accessing object: LDAP://CN=NABOO,OU=pottery,DC=netid,DC=washington,DC=edu name: 2007-10-23T13:44:12-08:00{62E83AE2-DB9F-4B4E-BC7C-2ED057E13FC4} msFVE-RecoveryGuid: {62E83AE2-DB9F-4B4E-BC7C-2ED057E13FC4} msFVE-RecoveryPassword: 327679-031823-308099-108900-464640-385660-335214-476806