How to Find & Export BitLocker Recovery Keys with PowerShell

A locked BitLocker drive at 4:55pm on a Friday is every technician's nightmare. The 48-digit recovery key is the way back in — but only if you can actually find it. Here's how the keys work, where they hide, and the fastest way to have every one of them on hand before you need it.

First: are you running as admin?

Reading BitLocker protectors requires an elevated PowerShell session. Open Windows Terminal or PowerShell as Administrator before you run anything below. The BitLocker cmdlets ship with Windows 10 and 11 (Pro, Enterprise and Education), so there's nothing to install.

The basic one: read the key on the machine in front of you

When you're sitting at the machine, one command shows the recovery password for a volume. In an elevated session:

# Recovery password for the C: volume
(Get-BitLockerVolume -MountPoint "C:").KeyProtector |
  Where-Object KeyProtectorType -eq 'RecoveryPassword'

Prefer the built-in tool? manage-bde -protectors -get C: returns the same thing and works even where the PowerShell module isn't available. That's all you need — for one drive, on one machine, when you're already logged into it.

Where it actually gets hard: everywhere else

Reading a single key is easy. Having the right key at the moment you need it is the real job — and that's where one command stops being enough:

• A machine often has several encrypted volumes, each with its own recovery password.
• Keys are escrowed in different places depending on how the device is joined — kept locally, in Active Directory (as msFVE-RecoveryInformation objects), or in Microsoft Entra ID (reachable through Microsoft Graph).
• The device you need the key for is usually the one you can't log into — so reading it locally isn't an option in the moment that counts.
• Auditors and incident response want one clean, exportable record, not keys copied out of three different consoles.

Turning those one-off commands into something dependable — every volume, correlated to the right machine, collected into a single export you can hand off — is a scripting project in its own right. And it's one you have to get right: a recovery key is a master override for an encrypted disk, so how you collect, store and protect it matters as much as finding it.

The shortcut: collect it once, cleanly

Pulling a machine's full picture — including its BitLocker recovery keys — into one tidy, exportable report is exactly what the System Inventory tool in the goShoplet Windows Admin Toolkit is built for. One run captures serial, model, BIOS, TPM, full network configuration and BitLocker recovery keys, ready to drop straight into your asset records. No stitching commands together, no missed volumes, no keys scattered across half a dozen windows.