RELATED IDEAS
SQL Query to report BitLocker Recovery Keys from MECM Console
Currently a user needs to have logged onto a device before RCTs can report on BitLocker Recovery Key. We have devices which were imaged and remote admins request BitLocaker Keys.
sample query:
Select
MAC.Name AS "Machine Name",
K.RecoveryKeyId AS "Recovery Key ID",
RecoveryAndHardwareCore.DecryptString(K.RecoveryKey, DEFAULT) AS "Recovery Key"
FROM
dbo.RecoveryAndHardwareCore_Machines AS MAC
JOIN
dbo.RecoveryAndHardwareCore_Machines_Volumes AS mv ON MAC.Id = mv.MachineId
JOIN
dbo.RecoveryAndHardwareCore_Keys AS K ON mv.VolumeId = K.VolumeID
WHERE
MAC.Name = 'System Name'
Thanks for submitting the idea! We currently use the Microsoft-supported Admin Service API to retrieve the recovery key from the ConfigMgr database. One limitation of this approach is that it requires a value in the Last Logon User Name field as you noted. Intune has the same limitation when retrieving BitLocker keys from ConfigMgr in Cloud Attach scenarios because it uses the same underlying method.
If we implemented a direct SQL-based approach for getting the keys, would you want us to continue marking keys as disclosed and requiring rotation, similar to the behavior of the Admin Service today?