Skip to main content

BitLocker Recovery Key Backup

Summary​

This script verifies whether the device is joined to a domain or Azure AD. For eligible devices, it attempts to back up BitLocker recovery keys to Azure AD or Local AD, depending on the join type. For each drive, it checks for RecoveryPassword protectors and tries to back up the key using the appropriate cmdlet. The output summarizes any failures, including drive letter, key substring, and platform. If all keys are backed up successfully, it reports success. If the device is not domain or Azure AD joined, or the BitLocker module is unavailable, it returns a relevant message. The output is formatted for saving into the CW RMM custom field BitLocker Key Backup Status.

Notes: The BitLocker Drive Encryption feature must be enabled on servers to run this script against windows servers. Auditing will not work without enabling this feature.

Sample Run​

Image1

Dependencies​

Task Setup Path​

Tasks Path: AUTOMATION ➞ Tasks
Task Type: Script Editor

Task Creation​

Description​

  • Name: BitLocker Recovery Key Backup
  • Description: This script verifies whether the device is joined to a domain or Azure AD. For eligible devices, it attempts to back up BitLocker recovery keys to Azure AD or Local AD, depending on the join type. For each drive, it checks for RecoveryPassword protectors and tries to back up the key using the appropriate cmdlet. The output summarizes any failures, including drive letter, key substring, and platform. If all keys are backed up successfully, it reports success. If the device is not domain or Azure AD joined, or the BitLocker module is unavailable, it returns a relevant message. The output is formatted for saving into the CW RMM custom field "BitLocker Key Backup Status".
  • Category: Security

Image2

Script Editor​

Step 1: Row -> PowerShell script​

  • Use Generative AI Assist for script creation: False
  • Expected time of script execution in seconds: 300
  • Operating System: Windows
  • Continue on Failure: False
  • Run As: System
  • PowerShell Script Editor:

PowerShell Script

Image3

Step 2: Row -> Script Log​

  • Script Log Message: %Output%
  • Continue on Failure: False
  • Operating System: Windows

Image4

Step 3: Row -> Set Custom Field ( BitLocker Key Backup Status = %output% )​

  • Custom Field: BitLocker Key Backup Status
  • Value: %Output%
  • Continue on Failure: False
  • Operating System: Windows

Image5

Completed Task​

Image6

Output​

  • Script Log
  • Custom Field

Schedule Task​

Task Details​

  • Name: BitLocker Recovery Key Backup
  • Description: This script verifies whether the device is joined to a domain or Azure AD. For eligible devices, it attempts to back up BitLocker recovery keys to Azure AD or Local AD, depending on the join type. For each drive, it checks for RecoveryPassword protectors and tries to back up the key using the appropriate cmdlet. The output summarizes any failures, including drive letter, key substring, and platform. If all keys are backed up successfully, it reports success. If the device is not domain or Azure AD joined, or the BitLocker module is unavailable, it returns a relevant message. The output is formatted for saving into the CW RMM custom field "BitLocker Key Backup Status".
  • Category: Security

Image7

Schedule​

  • Schedule Type: Schedule
  • Timezone: Local Machine Time
  • Start: <Current Date>
  • Trigger: Time At <Current Time>
  • Recurrence: Every day

Image8

Targeted Resource​

Device Group: BitLocker Key Backup Enabled

Image9

Completed Scheduled Task​

Image10

Changelog​

2025-09-01​

  • Initial version of the document