# Backup BitLocker Recovery Key

> Backs up existing BitLocker recovery passwords on a volume to on-premises Active Directory and can optionally write the passwords to the job log.

Source: https://docs.capaone.com/capaone/application-manager/powerbricks/backup-bitlocker-recovery-key/  
Product: CapaOne — a separate CapaSystems product; do not apply this page to any other.

Backs up existing BitLocker recovery passwords on a volume to on-premises Active Directory and can optionally write the passwords to the job log.

## Parameters

#### Mount Point
*Required* — Default: `OS`

Drive letter of the BitLocker volume whose recovery password should be backed up, for example C: or D:. You can also use OS or SystemDrive to target the operating system drive automatically.

#### Backup To Active Directory
*Optional* — Default: `True`

Enable to save the BitLocker recovery password of the volume in on-premises Active Directory. Disable to skip the Active Directory backup, so the recovery password is only written to the job log if Write Recovery Key To Log is enabled. Enabled by default; disable it on machines with no on-premises Active Directory, where the backup would otherwise fail.

#### Write Recovery Key To Log
*Optional* — Default: `True`

Writes the BitLocker recovery password to the PowerBrick log before or while it is backed up. Enabled by default; disable when log visibility should be restricted.

## Details

- **Category:** System
- **Brick ID:** `BitLocker-Backup-Recovery-Key`

## Raw JSON definition

**JSON**

```json
{
  "category": "system",
  "description": "Backs up existing BitLocker recovery passwords on a volume to on-premises Active Directory and can optionally write the passwords to the job log.",
  "developerVendor": "CapaSystems A/S",
  "displayName": null,
  "id": "BitLocker-Backup-Recovery-Key",
  "name": "Backup BitLocker Recovery Key",
  "parameters": [
    {
      "allowManualInput": false,
      "defaultValue": "OS",
      "defaultValueObject": null,
      "description": "Drive letter of the BitLocker volume whose recovery password should be backed up, for example C: or D:. You can also use OS or SystemDrive to target the operating system drive automatically.",
      "id": "MountPoint",
      "name": "Mount Point",
      "regExValidation": "",
      "required": true,
      "type": "TextBox",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Enable to save the BitLocker recovery password of the volume in on-premises Active Directory. Disable to skip the Active Directory backup, so the recovery password is only written to the job log if Write Recovery Key To Log is enabled. Enabled by default; disable it on machines with no on-premises Active Directory, where the backup would otherwise fail.",
      "id": "BackupToActiveDirectory",
      "name": "Backup To Active Directory",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Writes the BitLocker recovery password to the PowerBrick log before or while it is backed up. Enabled by default; disable when log visibility should be restricted.",
      "id": "WriteRecoveryKeyToLog",
      "name": "Write Recovery Key To Log",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    }
  ],
  "powershell": {
    "base64Encoded": true,
    "function": "ZnVuY3Rpb2..."
  },
  "type": "powerbrick",
  "version": "2026.9.1.1"
}
```