Backup BitLocker Recovery Key

Backs up existing BitLocker recovery passwords on a volume to on-premises Active Directory and can optionally write the passwords to the job log.

Parameters

Mount Point

Required — Default: System Drive

Selects the BitLocker volume whose recovery password should be backed up. System Drive is the drive Windows is installed on and is the right choice on almost every device. Pick a specific drive letter only when the volume is a data volume, for example D:. If the selected drive does not exist on the device, the brick fails. Allowed values: System Drive, A:, B:, C:, D:, E:, F:, G:, H:, I:, J:, K:, L:, M:, N:, O:, P:, Q:, R:, S:, T:, U:, V:, W:, X:, Y:, Z:.

Backup To Active Directory

Optional — Default: True

Enable to save the BitLocker recovery password of the volume in on-premises Active Directory. Disable to skip the Active Directory backup, so the recovery password is only written to the job log if Write Recovery Key To Log is enabled. Enabled by default; disable it on machines with no on-premises Active Directory, where the backup would otherwise fail.

Write Recovery Key To Log

Optional — Default: True

Writes the BitLocker recovery password to the PowerBrick log before or while it is backed up. Enabled by default; disable when log visibility should be restricted.

Details

Category: System
Brick ID: BitLocker-Backup-Recovery-Key

{
  "category": "system",
  "description": "Backs up existing BitLocker recovery passwords on a volume to on-premises Active Directory and can optionally write the passwords to the job log.",
  "developerVendor": "CapaSystems A/S",
  "displayName": null,
  "id": "BitLocker-Backup-Recovery-Key",
  "name": "Backup BitLocker Recovery Key",
  "parameters": [
    {
      "allowManualInput": false,
      "defaultValue": null,
      "defaultValueObject": {
        "id": "SystemDrive",
        "name": "System Drive"
      },
      "description": "Selects the BitLocker volume whose recovery password should be backed up. System Drive is the drive Windows is installed on and is the right choice on almost every device. Pick a specific drive letter only when the volume is a data volume, for example D:. If the selected drive does not exist on the device, the brick fails.",
      "id": "MountPoint",
      "name": "Mount Point",
      "regExValidation": "",
      "required": true,
      "type": "ComboBox",
      "value": null,
      "values": [],
      "valuesObject": [
        {
          "id": "SystemDrive",
          "name": "System Drive"
        },
        {
          "id": "A:",
          "name": "A:"
        },
        {
          "id": "B:",
          "name": "B:"
        },
        {
          "id": "C:",
          "name": "C:"
        },
        {
          "id": "D:",
          "name": "D:"
        },
        {
          "id": "E:",
          "name": "E:"
        },
        {
          "id": "F:",
          "name": "F:"
        },
        {
          "id": "G:",
          "name": "G:"
        },
        {
          "id": "H:",
          "name": "H:"
        },
        {
          "id": "I:",
          "name": "I:"
        },
        {
          "id": "J:",
          "name": "J:"
        },
        {
          "id": "K:",
          "name": "K:"
        },
        {
          "id": "L:",
          "name": "L:"
        },
        {
          "id": "M:",
          "name": "M:"
        },
        {
          "id": "N:",
          "name": "N:"
        },
        {
          "id": "O:",
          "name": "O:"
        },
        {
          "id": "P:",
          "name": "P:"
        },
        {
          "id": "Q:",
          "name": "Q:"
        },
        {
          "id": "R:",
          "name": "R:"
        },
        {
          "id": "S:",
          "name": "S:"
        },
        {
          "id": "T:",
          "name": "T:"
        },
        {
          "id": "U:",
          "name": "U:"
        },
        {
          "id": "V:",
          "name": "V:"
        },
        {
          "id": "W:",
          "name": "W:"
        },
        {
          "id": "X:",
          "name": "X:"
        },
        {
          "id": "Y:",
          "name": "Y:"
        },
        {
          "id": "Z:",
          "name": "Z:"
        }
      ]
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Enable to save the BitLocker recovery password of the volume in on-premises Active Directory. Disable to skip the Active Directory backup, so the recovery password is only written to the job log if Write Recovery Key To Log is enabled. Enabled by default; disable it on machines with no on-premises Active Directory, where the backup would otherwise fail.",
      "id": "BackupToActiveDirectory",
      "name": "Backup To Active Directory",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    },
    {
      "allowManualInput": false,
      "defaultValue": "True",
      "defaultValueObject": null,
      "description": "Writes the BitLocker recovery password to the PowerBrick log before or while it is backed up. Enabled by default; disable when log visibility should be restricted.",
      "id": "WriteRecoveryKeyToLog",
      "name": "Write Recovery Key To Log",
      "regExValidation": "",
      "required": false,
      "type": "Boolean",
      "value": null,
      "values": [],
      "valuesObject": null
    }
  ],
  "powershell": {
    "base64Encoded": true,
    "function": "ZnVuY3Rpb2..."
  },
  "type": "powerbrick",
  "version": "2026.10.8.1"
}