So specifically, what do we mean by AD BitLocker Key Recovery?
This is an option.
It's not enabled by default in your domain.
It's an option to store your server and potentially your client Windows
devices recovery key information in Active Directory directly,
you see.
Over on the right side,
you see a representative properties sheet from Active Directory users
and computers that when you enable this extension,
you have a new tab in there called BitLocker recovery,
and this would allow your delegated administrators,
perhaps your help desk staff, to recover that key for users if their machine,
for whatever reason, has triggered BitLocker recovery,
or if you have a server that's done the same thing.
It's a convenience.
You optionally can store the entire key package,
not just the recovery password, it's called a recovery password,
but it's just a numeric string, as you can see in the screenshot,
but you can actually store the whole key package in AD
optionally and that would be if maybe the TPM chip on your
server or client device was corrupted and you needed to restore
the entire package back to the TPM.
So this technology has GUI, or graphical user component.
You can see here the BitLocker Recovery tab.
The BitLocker Recovery Password Viewer is a separate GUI tool that allows,
say again,
a delegated support person to do a search for a server or client
hostname and quickly look up the recovery key. Now let's do a demo, and we can illustrate some of this theory.