BitLocker — povolení a export klíče do AD
Povolení BitLockeru na systémovém disku a export recovery klíče do Active Directory (vyžaduje rozšíření schématu AD pro BitLocker).
powershell
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -RecoveryPasswordProtector
Enable-BitLocker -MountPoint "C:" -TpmProtector
$key = (Get-BitLockerVolume -MountPoint "C:").KeyProtector | Where-Object { $_.KeyProtectorType -eq "RecoveryPassword" }
Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $key.KeyProtectorIdKontrola, že se klíč propsal do AD (spustit na DC):
powershell
Get-ADComputer -Identity "PC01" -Properties msFVE-RecoveryPassword | Select-Object -ExpandProperty msFVE-RecoveryPassword