Remove old BitLocker Recovery Passwords from Active Directory

If you manage BitLocker through Group Policy, your computer objects collect recovery entries over time. Every re-encryption, protector reset or key rotation can leave another entry behind. Open the BitLocker Recovery tab on a long-lived laptop and you may find a dozen of them. This guide shows how to clean up old BitLocker recovery passwords with PowerShell, and how to do it without wiping a key you still need. We learn how to remove bitlocker recovery passwords.

Where BitLocker recovery passwords live in AD

BitLocker stores recovery data as child objects of the computer object, with the class msFVE-RecoveryInformation. Each object holds a recovery password and the GUID of the volume it belongs to. You can read about the object structure in the Microsoft documentation on backing up BitLocker recovery information to AD. Because they are children of the computer, deleting the computer account also deletes its recovery entries.

Should you clean them up at all?

Strictly speaking, no. Old entries do not break anything, and a stale key that no longer matches a protector on the drive simply never unlocks it. The reasons to clean up are tidiness and a faster helpdesk lookup. When a user reads out a Password ID, you want one obvious match, not a pile of near-identical entries.

Why a “keep only the newest” script can bite you

Many scripts you find online sort the recovery objects per computer and delete everything except the newest one. That works on a machine with a single encrypted drive. It is dangerous on a machine with an OS drive plus an encrypted data drive, because each volume has its own recovery password. The “newest per computer” logic would delete the current key of one of those volumes.

The safer rule is to keep the newest object per computer and per volume. The msFVE-VolumeGuid attribute on each object makes that possible. The script below groups on it.

Prerequisites for Remove BitLocker Recovery Passwords

You need the Active Directory PowerShell module, which comes with RSAT. If you are on a fresh admin workstation, follow the guide on how to install RSAT on Windows 11 first. You also need an account with permission to delete those child objects, which Domain Admins have by default. Run PowerShell as administrator and, if you can, test in a lab or on a single OU before touching production.

The cleanup script

Save this as C:\scripts\Remove-OldBitLockerRecovery.ps1. It never reads the recovery passwords themselves, only the metadata, and it writes a CSV of everything it plans to delete.

#Requires -Modules ActiveDirectory
[CmdletBinding(SupportsShouldProcess = $true)]
param(
    [string]$SearchBase = (Get-ADDomain).DistinguishedName,
    [string]$ReportPath = "C:\scripts\BitLockerCleanup-$(Get-Date -Format 'yyyyMMdd-HHmm').csv"
)

# One query for the whole search base instead of one query per computer
$recoveryObjects = Get-ADObject -SearchBase $SearchBase `
    -Filter 'objectClass -eq "msFVE-RecoveryInformation"' `
    -Properties whenCreated, 'msFVE-VolumeGuid'

# Group by parent computer and by volume
$groups = $recoveryObjects | Group-Object -Property {
    $parent = ($_.DistinguishedName -split ',', 2)[1]
    $volume = if ($_.'msFVE-VolumeGuid') { ([guid]$_.'msFVE-VolumeGuid').Guid } else { 'no-volume-guid' }
    "$parent|$volume"
}

# Keep the newest object in each group, everything else is a removal candidate
$toRemove = foreach ($group in $groups) {
    $group.Group | Sort-Object whenCreated -Descending | Select-Object -Skip 1
}

if (-not $toRemove) {
    Write-Host 'Nothing to clean up.' -ForegroundColor Cyan
    return
}

# Write a report before deleting anything
$toRemove |
    Select-Object @{n='Computer'; e={($_.DistinguishedName -split ',')[1] -replace '^CN=',''}},
                  whenCreated, DistinguishedName |
    Export-Csv -Path $ReportPath -NoTypeInformation
Write-Host "Report saved to $ReportPath" -ForegroundColor Cyan

foreach ($obj in $toRemove) {
    if ($PSCmdlet.ShouldProcess($obj.DistinguishedName, 'Remove old BitLocker recovery object')) {
        try {
            Remove-ADObject -Identity $obj.DistinguishedName -Confirm:$false -ErrorAction Stop
            Write-Host "Removed object created on $($obj.whenCreated): $($obj.DistinguishedName)" -ForegroundColor Green
        }
        catch {
            Write-Warning "Failed to remove $($obj.DistinguishedName): $_"
        }
    }
}Code language: PHP (php)

Run it safely

Start with a dry run. The -WhatIf switch lists every object the script would delete and removes nothing.

C:\scripts\.\Remove-OldBitLockerRecovery.ps1 -WhatIfCode language: CSS (css)

Review the CSV, then test on one computer by pointing -SearchBase at its distinguished name.

C:\scripts\.\Remove-OldBitLockerRecovery.ps1 -SearchBase "CN=WIN10,OU=Workstations,DC=contoso,DC=com"Code language: JavaScript (javascript)

When the result looks right, run it against the whole domain, or a single OU, without -WhatIf. If you have not enabled the AD Recycle Bin yet, do that first, so an accidental deletion can be reversed.

Verify the result

Open the computer object again and check the BitLocker Recovery tab. You should see one entry per encrypted volume. For a machine with an OS drive and a data drive, that means two entries, not one. Then confirm on the client that the key still matches by running manage-bde -protectors -get C: and comparing the Password ID with the AD entry.

Entra ID and Intune are a separate story

This script only touches on-premises Active Directory. If your devices are Entra joined or hybrid joined and escrow keys to Entra ID through Intune, those copies are stored separately and are not affected. You can inspect and manage them through the Entra admin center, or through Microsoft Graph after you connect to Microsoft Graph with PowerShell. If a computer account is deleted from AD, its recovery entries go with it, as described in this Microsoft Ask the Core Team post on BitLocker and Active Directory.

Microsoft Learn: BitLocker Drive Encryption Configuration Guide, backing up BitLocker and TPM recovery information to Active Directory Microsoft Learn (Ask the Core Team): BitLocker Drive Encryption and Active Directory Microsoft Learn: BitLocker Recovery Guide

References

• Microsoft Learn: BitLocker Drive Encryption Configuration Guide, backing up BitLocker and TPM recovery information to Active Directory
• Microsoft Learn (Ask the Core Team): BitLocker Drive Encryption and Active Directory
• Microsoft Learn: BitLocker Recovery Guide