Come trovare la chiave di recupero Bitlocker in Active Directory

30.04.2025

Se state cercando di imparare how to find BitLocker key in AD, Active Directory Users and Computers is usually the first place to check in a domain environment. When a BitLocker recovery password has been backed up to Active Directory Domain Services (AD DS), an authorized administrator can locate the computer object and retrieve the stored 48-digit recovery password.

However, the key will appear in Active Directory only if BitLocker recovery information was previously backed up to AD DS. If the key is missing, you may need to check your organization’s BitLocker policy, permissions, or other recovery locations.

Questa guida spiega how to find BitLocker recovery key in Active Directory, what to do when the BitLocker Recovery tab or key is missing, and an alternative way to search for stored recovery information.

If you need a broader introduction to BitLocker and recovery options, you can also read our complete guide to recuperare la chiave di recupero BitLocker.

Scaricare Magic Recovery Key

Supporta Windows 7/8/10/11 e Windows Server

Indice dei contenuti

Capire Bitlocker e Active Directory

BitLocker is Microsoft’s full-volume encryption technology designed to protect data from unauthorized access. When BitLocker encrypts a Windows drive, a 48-digit recovery password can be used when the normal unlocking method is unavailable, such as after certain hardware, firmware, TPM, or startup changes.

Active Directory, or more specifically Active Directory Domain Services, provides centralized management of computers, users, policies, and other resources in a Windows domain.

In a managed organization, administrators can configure BitLocker so that recovery information is backed up to AD DS. When this happens, the recovery information is stored under the corresponding computer object.

According to Microsoft’s BitLocker architecture, AD DS can store one or more msFVE-RecoveryInformation child objects for a BitLocker-enabled computer. The actual 48-digit recovery password is stored in the msFVE-RecoveryPassword attribute.

Questa distinzione è importante quando si retrieve BitLocker recovery key from Active Directory. A computer may have more than one recovery entry, particularly if recovery passwords have been rotated or BitLocker has been reconfigured. Therefore, you should verify that the Recovery Password ID matches the device that is requesting the key.

Most importantly, joining a computer to a domain does not guarantee that its existing BitLocker recovery password is automatically available in AD. The recovery information must have been backed up through the appropriate BitLocker policy or administrator action.

Come trovare la chiave di recupero Bitlocker in Active Directory

If the computer belongs to an Active Directory domain and its recovery information has been backed up correctly, follow these steps to learn how to find BitLocker key in AD.

1. Sign In With the Required Permissions

Sign in to a domain controller or an administrative computer that has the necessary Active Directory management tools installed.

Your account must have permission to read BitLocker recovery information in AD DS. By default, Domain Administrators normally have access, although organizations can delegate this permission to specific administrators or help-desk personnel.

If you can open the computer object but cannot see its BitLocker recovery information, insufficient permissions may be the reason.

Trovare la chiave di recupero Bitlocker in Active Directory

2. Open Active Directory Users and Computers

Aperto Active Directory Users and Computers (ADUC).

You can normally find it through:

Server Manager > Tools > Active Directory Users and Computers

or by running:

dsa.msc

The BitLocker Recovery Password Viewer is an extension for Active Directory Users and Computers. On administrative workstations, you may need the appropriate Remote Server Administration Tools (RSAT) components installed before the BitLocker Recovery tab becomes available.

3. Locate the Correct Computer Object

Navigate to the Organizational Unit or container that contains the affected computer.

Do not search for the user account. BitLocker recovery information stored in AD DS is associated with the computer object.

For example, if the locked computer is named:

OFFICE-PC-015

find the corresponding computer object in Active Directory.

If several computers have similar names, verify the hostname or other identifying information before continuing. Using a recovery password from another computer will not unlock the affected BitLocker volume.

4. Open the Computer Properties

Right-click the computer object and select Proprietà.

The Properties window displays information and management options associated with that computer.

If your environment has the BitLocker Recovery Password Viewer installed and your account has the required permissions, you should see a Recupero BitLocker scheda.

Active Directory Properties

5. Open the BitLocker Recovery Tab

Selezionare Recupero BitLocker.

The tab displays the BitLocker recovery information stored for that computer. Depending on the device’s history, you may see more than one recovery password.

Compare the Recovery Password ID shown in Active Directory with the identifier displayed on the BitLocker recovery screen.

Once you identify the matching record, copy the corresponding Password di recupero di 48 cifre and enter it on the locked device.

This is generally the simplest way to retrieve BitLocker recovery key from Active Directory when you already know which computer is affected.

Chiave di recupero Bitlocker in Active Directory

What If the BitLocker Recovery Tab Is Missing?

If you cannot see the Recupero BitLocker tab, it does not necessarily mean the recovery key has disappeared.

Le cause più comuni includono:

  • The BitLocker Recovery Password Viewer or required RSAT component is not installed.
  • Your account does not have permission to read BitLocker recovery information.
  • The device is not associated with the expected computer object.
  • BitLocker recovery information was never backed up to AD DS.
  • BitLocker was enabled before the appropriate domain recovery policy was configured.

If the computer is still accessible, an administrator can also verify its current recovery password protector and, where appropriate, manually back it up to AD DS.

For example, Windows provides the Backup-BitLockerKeyProtector PowerShell cmdlet for saving a BitLocker recovery password protector to Active Directory Domain Services.

This is important because changing a Group Policy setting later does not necessarily mean that every previously created recovery password automatically appears in AD.

What If Multiple Recovery Keys Appear?

Active Directory can retain multiple BitLocker recovery records for the same computer.

This can happen after BitLocker recovery password rotation, encryption changes, maintenance, or other administrative actions.

Do not simply select the newest or oldest password.

Instead, compare the Recovery Password ID displayed on the locked computer with the recovery identifier stored in AD. The matching identifier helps you select the correct 48-digit password.

Use Magic Recovery Key Software to Find BitLocker Key in AD

If you cannot find the expected recovery information in Active Directory, another option is to check whether BitLocker recovery information is still stored or accessible elsewhere on the Windows system.

Magic Recovery Key is designed to help search for stored BitLocker recovery key information. It can be useful as an additional recovery option when the expected key cannot be located through Active Directory or other normal storage locations.

However, keep an important limitation in mind: if a BitLocker recovery password was never backed up to Active Directory, software cannot make that missing AD record suddenly appear. You should also check Microsoft accounts, organization records, printed copies, USB backups, and other locations where the recovery password may previously have been saved.

Download and Install Magic Recovery Key

Scaricare e installare Magic Recovery Key from the official source.

Scaricare Magic Recovery Key

Supporta Windows 7/8/10/11 e Windows Server

2. Aprire il software e selezionare BitLocker Recovery Keynel menu di sinistra.

Magic Recovery Key per trovare la chiave di recupero di Bitlocker

3. Cliccare Ricerca per consentire al software di eseguire la scansione della chiave BitLocker.

4. Una volta trovata la chiave, copiatela e usatela per sbloccare l'unità crittografata.

Magic Recovery Key per salvare la chiave di recupero Bitlocker

Importanza di tenere al sicuro la chiave di ripristino

In conclusione, how to find BitLocker key in AD is straightforward when the recovery password was properly backed up to Active Directory. Open Active Directory Users and Computers, locate the correct computer object, open its properties, and check the Recupero BitLocker scheda.

The most important step is to match the correct Recovery Password ID before entering the 48-digit password. If the recovery information is missing, check the AD backup policy, administrative permissions, BitLocker Recovery Password Viewer installation, and other possible key storage locations.

For additional BitLocker recovery scenarios, see our complete BitLocker recovery key guide. If the expected key cannot be located through Active Directory, Magic Recovery Key can also help search for available recovery information stored on the system.

Scaricare Magic Recovery Key

Supporta Windows 7/8/10/11 e Windows Server

FAQs – How to Find BitLocker Key in AD

Dove è possibile trovare in Active Directory la chiave di recupero BitLocker per un computer o un oggetto utente?

È possibile aprire Active Directory Users and Computers, individuare il computer o l'oggetto utente di destinazione, fare clic con il pulsante destro del mouse su → Proprietà e accedere alla scheda BitLocker Recovery per visualizzare le chiavi di ripristino memorizzate.

Quali autorizzazioni sono necessarie per visualizzare le chiavi di ripristino BitLocker in Active Directory?

Per accedere alla scheda Recupero BitLocker delle proprietà dell'oggetto è necessario disporre di diritti amministrativi sul server Active Directory e delle autorizzazioni appropriate. Se l'account non dispone di tali autorizzazioni, la chiave di ripristino potrebbe non essere visibile.

Cosa fare se la chiave di ripristino BitLocker non è memorizzata o visibile in AD?

Innanzitutto, verificare che BitLocker sia stato configurato per eseguire il backup delle informazioni di ripristino in Active Directory (tramite Criteri di gruppo o impostazioni locali). In caso contrario, cercare la chiave tramite l'account Microsoft, backup stampati o USB o utilizzare uno strumento come Magic Recovery Key per la scansione delle chiavi. Contattare l'amministratore IT per assistenza.

Come si fa a garantire il backup automatico delle chiavi di ripristino BitLocker in Active Directory?

Per memorizzare automaticamente le chiavi di ripristino, è necessario configurare un Criterio di gruppo nel dominio che consenta a BitLocker di eseguire il backup delle informazioni di ripristino in Active Directory Domain Services (AD DS). Senza questo criterio, le chiavi non verranno scritte in AD e non potranno essere trovate.

Quale oggetto o attributo AD memorizza le informazioni sulla chiave di ripristino BitLocker?

Le chiavi di ripristino BitLocker sono memorizzate come oggetti figlio dell'account computer in AD, sotto l'attributo msFVE-RecoveryInformation. Questo attributo contiene la password di recupero a 48 cifre e i relativi metadati.

Gli utenti non amministratori possono recuperare le chiavi di ripristino BitLocker da AD?

Per impostazione predefinita, solo gli amministratori di dominio possono visualizzare le chiavi di ripristino BitLocker in Active Directory. È possibile delegare l'accesso in lettura a gruppi specifici concedendo le autorizzazioni per visualizzare l'attributo msFVE-RecoveryInformation.

Cosa fare se la chiave di ripristino non è visibile anche se dovrebbe essere presente in AD?

Se non è visibile, verificare che BitLocker sia stato configurato prima di attivare il criterio di backup AD e che il dispositivo sia stato collegato al dominio e che sia avvenuta la comunicazione con il dominio. Se non è stato eseguito il backup delle chiavi al momento della crittografia, potrebbe essere necessario eseguire il backup manuale o utilizzare altre posizioni di ripristino (ad esempio, account Microsoft, copia stampata).

È possibile trovare le chiavi di recupero BitLocker utilizzando PowerShell?

Sì, se si dispone delle autorizzazioni AD e degli strumenti installati, è possibile utilizzare i comandi PowerShell per cercare gli oggetti msFVE-RecoveryInformation sotto il nome distinto di un computer e recuperare le informazioni sulla chiave di ripristino.

Erin Smith è riconosciuta come una delle scrittrici più professionali di Amagicsoft. Negli ultimi 10 anni ha continuamente affinato le sue capacità di scrittura e ha aiutato milioni di lettori a risolvere i loro problemi tecnologici.