So this is what it looks like when you restart a server or client machine and
you're in recovery mode. We're being asked for the recovery key for this
drive. It's a little bit annoying that there's no copy/paste, so you're going
to be in for some careful transcription.
So the idea, of course,
is how do you get your recovery key if you don't have your backup handy?
Well, what we'll do next is I'll show you how to get that
information from Active Directory because we set up Group Policy
that way. Back to dc1 we go. This time, let's open up Active
Directory Users and Computers, and you'll want to make sure that you
have the Advanced Features turned on.
And there's a couple things we can do once we've
enabled these BitLocker features.
And actually, it reminds me of a point. Let me bring up a script file that
I share with you in the exercise files. In order to get the extensions to
BitLocker that give you the unlock tool, you'll want to run line 8 here if
you're going to do it with PowerShell, Install‑WindowsFeature. You'll do
this on a domain controller, Install‑WindowsFeature
RSAT‑Feature‑Tools‑BitLocker‑BdeAducExt.
This is required to get to the Password Viewer tool in
Active Directory Users and Computers.
If you're just looking to install BitLocker on a server,
you could run what's on line 7, Install‑WindowsFeature
‑Name‑BitLocker. So once you're in advanced view, one thing we could
do, as I said, is we can look at the properties of a server, like
MEM1, and we now have a BitLocker Recovery tab where we've got the
recovery password in plaintext.
So here is where we can, for example, copy it out. Let me throw this into a
new document file here in VS Code, and we could give that to the user in
question to solve the problem and unlock the drive.
Another way to do this would be using, again, that extension.
If we right‑click the domain, notice that there's a new option here,
Find BitLocker recovery password. Now here,
unfortunately, it looks like you have to provide the first eight
characters of the password ID. That is pretty inconvenient.
So maybe Microsoft designed this intentionally because if someone
were to breach a domain administrator account and maybe you were
not set up as a disaster recovery agent,
it would be too easy to enumerate all of the keys across the domain.
But if we come back here, one, two, three, four, five, six, seven,
eight, password ID, it's looking for the first. I really don't like
this. I'm being really honest and candid.
I don't like that tool at all. To be honest with you,
I'm totally happy being able to look up here because I know what the machine is,
I know what the machine name is, and we can go to... Okay,
so it looks like actually password ID is a totally separate string from the
recovery password, and here are the first eight characters.
So we would need this anyway to use the viewer.
So let me copy out those eight characters.
And again,
you see where I'm going? If you're able to get to the eight characters,
why would you need to look up the recovery password in here?
Again, I'm just thinking aloud.
But anyway,
you can see that by providing those eight characters we're able to resolve the server and its recovery password.