Is there a way to keep bitlocker keys apart from intune on prem AD also?

Question

Hello,

I keep bitlocker recovery keys in intune but I would just like to keep them on premises AD also. Is there such a possibility even for laptops that have already been encrypted?

I appreciate the help

Lefteris

Answer 1

@Kolleros Eleftherios Thanks for posting in our Q&A.

For this issue, please note that BitLocker recovery key is not stored in Intune, it is stored in Microsoft Entra ID. BitLocker recovery passwords are only saved to AD and Entra ID at the time they are set (or reset).

Honestly, I'm not familiar with keep BitLocker recovery keys in AD. Based on my research, I find someone shared a method to backup existing BitLocker recovery keys to AD.

https://techdirectarchive.com/2021/01/11/how-to-backup-existing-and-new-bitlocker-recovery-keys-to-active-directory/

Note: Non-Microsoft link, just for the reference.

Hope it will help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi @Kolleros Eleftherios

Yes you can save bitlocker key in Active directory.

You should start by enabling the store of bitlocker recovery information in AD through GPO:

Then you can use the following command as mentioned in the link below:

$BLV = Get-BitLockerVolume -MountPoint "C:"
Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[1].KeyProtectorId

Backup-BitLockerKeyProtector

---

Please don't forget to accept helpful answer

---