Invoke-Command -ComputerName "PC-WS001" -ScriptBlock Where-Object $_.KeyProtectorType -eq 'RecoveryPassword' Just the 48-digit number. No extra text. Need more details (like the Key ID)? Invoke-Command -ComputerName "PC-WS001" -ScriptBlock Get-BitLockerVolume -MountPoint "C:" Method 2: Get Keys for ALL Drives (System + Data) Some machines encrypt secondary drives (D:, E:). Use this to pull everything at once:
# Install RSAT (if not already) Add-WindowsCapability -Name "Rsat.BitLocker.Recovery.Tools~~~~0.0.1.0" -Online Get-BitLockerRecoveryInfo -ComputerName "PC-WS001" | Select-Object RecoveryPassword powershell get bitlocker recovery key remote computer
This works even if the PC is dead or offline. Use this method when possible. Don't wait for a boot-loop emergency to figure this out. Test Method 1 on a lab machine today. Better yet, script Method 3 into a weekly audit report so you always know where your recovery keys are. Don't wait for a boot-loop emergency to figure this out
Invoke-Command -ComputerName "PC-WS001" -ScriptBlock $volumes = Get-BitLockerVolume foreach ($vol in $volumes) $recKey = ($vol.KeyProtector powershell get bitlocker recovery key remote computer
catch [PSCustomObject]@Computer=$pc; RecoveryKey=$null; Status="Failed: $ "
PowerShell is your best friend.
We’ve all been there: A user calls at 8 AM on a Monday. “My laptop won’t boot. It’s asking for some 48-digit key.” If you’ve stored the key in Active Directory or Microsoft Entra ID (Azure AD), you’re safe. But what if the network is down, or you need to pull the key without leaving your chair?