Then you pass this information to the second command: manage-bde -protectors -adbackup c: -id '' Reading recovery keys in the Active Directory ^ First, you determine the ID of the numeric password for drive c: manage-bde -protectors -get c: The command line tool manage-bde.exe is capable of doing this. If the group policy is enabled after the drives are already encrypted, it will have no effect and the key will have to be manually transferred to the Active Directory. This ensures that BitLocker will wait until mobile users are reconnected to AD before it encrypts the data.

In addition, it makes sense to activate the Do not enable BitLocker until recovery information is stored to AD DS for operating system drives option.

The key package is used to recover data on a physically damaged drive. You can choose between Backup Restore Password and Key Packages and Backup Restore Passwords Only. GPO setting to backup recovery keys for system drives in Active Directoryįurthermore, you can configure which data will be stored in the AD.

Pcunlocker domain client