AutomoxAutomox

Bitlocker Key ID and Recovery Key

cfrieberg
September 4, 2019 at 10:01 pm UTC

Been working on a worklet policy to grab bitlocker keys ID and recovery keys.
So far I’ve been successful at making the policy create a .csv locally to the machine.
Not sure if this is the best place to post this, but if anyone wants to expand on this such as.
a) out-putting to FTP server, URL, etc. please do

powershell15 lines
$KeyProperties = @()
$KeyObj = @()
$Computer = $env:Computername
$Keys = Get-BitlockerVolume -MountPoint C:
$selected = $Keys | Select-Object -ExpandProperty KeyProtector
$Selected[1] | select-Object KeyprotectorID, RecoveryPassword
Foreach ($S in $Selected) {
    $KeyProperties = [pscustomobject]@{
            Computer = $Computer
            KeyProtectorID = $S.KeyProtectorID
            RecoveryPassword = $S.RecoveryPassword
    }
    $KeyObj += $KeyProperties
    }
$KeyObj[1] | Export-CSV "C:\$($Computer)_Keys.csv" -NoTypeInformation

This discussion is archived and closed to replies. Continue it in the Automox Community Slack.

Discuss on Slack

Replies (16)

Nic-AutomoxSeptember 4, 2019
#1

Thanks for sharing @cfrieberg! I added in the code block formatting to your post - let me know if that looks like it kept the right indenting. For the code blocks, you just have to put ``` on the line above and below the code.

cfriebergSeptember 4, 2019
#2

thanks Nic!

dimforestSeptember 5, 2019
#3
1 line
testing testing 123

Oh look at that.

Nic-AutomoxSeptember 5, 2019
#4

The code block feature is pretty nice. Not only does it preserve formatting, but it autodetects what programming language you are using and does color labels accordingly.

dimforestSeptember 5, 2019
#5

Yea, that’s pretty slick!

GavinSeptember 5, 2019
#6

Thanks for sharing! This is awesome and something I’ve seen a lot of people ask for.

cfriebergSeptember 6, 2019
#7

Wasn’t sure how to edit my original post.

Just following up since I noticed output from this worklet also being stored in Automox Activity Log.

Interesting.

dimforestSeptember 6, 2019
#8

If you click the little pencil icon in the bottom left of your post you can edit it.

Nic-AutomoxSeptember 6, 2019
#9

It’ll store in the log whatever message you return in the code. That does make it easier to have in one place to collect than gathering a bunch of CSV files from each endpoint.

cfriebergSeptember 6, 2019
#10
Nic-AutomoxSeptember 6, 2019
#11

It might be because I have the permissions locked down on submitting posts to the Worklet section - they have to get approved so that we can review the code first. Normally it will let you edit your post, but in this case it would let someone replace the code the originally posted with something potentially malicious or broken. Just send me your edits and I can replace the code for you.

JHagstromSeptember 14, 2020
#12

How was this implemented into the existing bit locker script that Automox has provided on these forums? Did you just add it into the Remediation code?

cfriebergSeptember 14, 2020
#13

Yes - added to rc

HarlanJune 30, 2021
#14

Well, sorry to dig up an old thread. Wondering if there’s a way to store the keys in the device tags in automox, rather than a .csv on the machine.

JHagstromJune 30, 2021
#15

This may be useful to you. Worklet: Install BitLocker and store keys in device tag - #23 by vukko

That is to install bitlocker and store the keys, but down in the comments there is a rough script for just grabbing keys and storing them in device tags.

HarlanJune 30, 2021
#16

Thanks for the pointer!