Retrieve BitLocker Recovery Keys From Active Directory

Get Recovery Keys.ps1

# Generate Report of BitLocker Status for Computers in the BitLocker Machines OU.
# Sources: https://4sysops.com/archives/find-bitlocker-recovery-passwords-in-active-directory-with-powershell/
param([string]$OutputDirectory="~/Desktop",[string]$OrganizationalUnit=([adsi]'').distinguishedName)
if(!([Security.Principal.WindowsPrincipal] `
  [Security.Principal.WindowsIdentity]::GetCurrent() `
).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host -ForegroundColor Yellow "Only Administrators can read BitLocker Recovery Keys."
    exit
}
$computers = Get-ADComputer -Filter * -SearchBase $OrganizationalUnit
$results = ForEach ($computer in $computers) {
    $dn = $computer.DistinguishedName
    $ldPath = "AD:\",$dn -join ""
    $ldObj = Get-ChildItem $ldPath | where {$_.objectClass -eq "msFVE-RecoveryInformation"}
    $ldObj = "AD:\",$ldObj.DistinguishedName -join ""
    $pass = Get-Item $ldObj -properties "msFVE-RecoveryPassword"
    New-Object PSObject -Property @{
        ComputerName = $computer.Name
        RecoveryPassword = $pass.'msFVE-RecoveryPassword'
    }
}
if(!(Test-Path -Path $OutputDirectory)) {
    New-Item -ItemType Directory -Path $OutputDirectory
}
$results | Export-Csv -Path "$OutputDirectory\bitlocker-report-$(Get-Date -format "yyyyMMdd-HHmm").csv" -NoTypeInformation