🔐 BitLocker Key Escrow

Intune Remediation · Adds a missing recovery password and escrows it to Entra ID

Test in a pilot group before you point this at the fleet. Detection exits 1 to trigger remediation, 0 to stay put.

Detection Script

Detect missing recovery password detection

Exits 1 when the OS drive is encrypted but has no recovery password. Unencrypted drives exit 0, since enabling BitLocker is the Settings Catalog policy’s job, not this script’s. Caveat: Windows exposes no way to check whether a key already reached Entra, so this catches missing protectors, not un-escrowed ones.

›

# Flags encrypted OS drives with no recovery password.
$vol = Get-BitLockerVolume -MountPoint $env:SystemDrive

if ($vol.ProtectionStatus -ne 'On') {
    Write-Output 'Compliant: BitLocker off, policy handles that'
    exit 0
}

if ($vol.KeyProtector | Where-Object KeyProtectorType -eq 'RecoveryPassword') {
    Write-Output 'Compliant'
    exit 0
}

Write-Output 'Non-compliant: no recovery password'
exit 1

Remediation Script

Escrow recovery key to Entra ID remediation

Runs only when detection exits 1.

›

# Adds a recovery password, then escrows it to Entra.
$drive = $env:SystemDrive
$vol = Get-BitLockerVolume -MountPoint $drive

if (-not ($vol.KeyProtector | Where-Object KeyProtectorType -eq 'RecoveryPassword')) {
    Add-BitLockerKeyProtector -MountPoint $drive -RecoveryPasswordProtector
    $vol = Get-BitLockerVolume -MountPoint $drive
}

$vol.KeyProtector | Where-Object KeyProtectorType -eq 'RecoveryPassword' | ForEach-Object {
    BackupToAAD-BitLockerKeyProtector -MountPoint $drive -KeyProtectorId $_.KeyProtectorId
}

Intune Remediation Settings

Run this script using the logged on credentials No

Enforce script signature check No

Run script in 64-bit PowerShell host Yes

Schedule (recommended) Weekly