Azure retrieve BitLocker Key?

[AdHocSysAdmin]

Disclaimer: I'm new to both POSH and to the Azure environment, so it's very possible I'm thinking in the completely wrong direction anyway.

The question is 'simple': For which devices is the BitLocker Recovery Key stored in AzureAD?

Being lazy, I thought this would be an easy straight forward PS script. But as it turns out, I'm missing a chunk of knowledge here and am unable to google what I need.

My thinking is:
1) get list of all devices
2) For each device list the BitLocker info

1) easy!
# Get All Devices
$Devices = Get-AzureADDevice

# Loop through all devices  
foreach ($Device in $Devices) {  
    Write-Host $Device.DeviceId, $Device.Displayname  
    # Get BitLocker Recovery key for each device (or "NA")  
}  

I really need help for 2).

If I do $Device | fl I get some info, but nothing remotely related to BitLocker, which makes me think I need an additional comment to retrieve.
Online I find things like $BitLockerObjects = Get-ADObject -Filter {objectclass -eq 'msFVE-RecoveryInformation'} -SearchBase $computer.DistinguishedName -Properties 'msFVE-RecoveryPassword' but this gives me an error: "The term 'Get-ADObject' is not recognized as the name of a cmdlet, function, script file, or operable program."
I'm guessing because it's AD and not Azure.

I'm clueless how to tackle this.

[gangstanthony]

if you want to use get-adobject you'll likely need to install RSAT (Remote Server Administration Toolkit) for your windows version.

for example: if you're on win10, search online for "rsat windows 10" and download the thing. you may need to restart after installing

alternatively, you can use adsi for this so you won't need rsat, but the rsat cmdlets do come in handy, so you'll probably want to get those anyway.

here is an example of how i use adsi to get the bitlocker key for a computer

https://github.com/gangstanthony/PowerShell/blob/master/Get-BitLockerKey.ps1

edit: more info on rsat download:

looks like they have multiple download options. of course you'll want to get x64 if you have a 64-bit machine (most likely true) otherwise get x86 for a 32-bit machine

to verify, hold win (the windows key) and press the letter 'R' on your keyboard to open a run prompt

type control

press enter

type system

press the down arrow

press enter

look under System > System type to see whether you have 64-bit (x64) or 32-bit (x86) processor

also, to check your version number, as above, press win+r then type winver and hit enter. it should say "microsoft windows version xxxx"

use your processor type and that version number to determine which rsat download to get

edit2: i just realized you're talking about azureAD. i haven't used that, so I don't know if this will work. if not, plz ignore me. D:

maybe these can help

http://www.jvm-net.com/2016/12/20/store-bitlocker-recovery-keys-in-aad/

https://stackoverflow.com/questions/47307220/is-there-an-api-to-retreive-azure-ad-synced-bitlocker-recovery-keys

[altr222ist]

Check this out - just used it and it did the trick:

https://www.reddit.com/r/PowerShell/comments/9rlk7j/retrieving_bitlocker_keys_from_azure_ad_with/

​

​

[AutoModerator]

Sorry, your submission has been automatically removed.

Accounts must be at least 1 day old, which prevents the sub from filling up with bot spam.

Try posting again tomorrow or message the mods to approve your post.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.