I know that when you enforce storing the BitLocker recovery information in Active Directory (via GPO), it is stored in the computer object's ms-FVE-RecoveryPassword attribute. Microsoft also has some great information on How to use Active Directory for backup of BitLocker Drive Encryption recovery information. However, it isn't clear how securely this information is transferred from the client being encrypted to the domain controller storing this information.
My question is if this recovery password is encrypted when it is passed from the client to Active Directory, or if it is sent in clear text. I assume it is encrypted, but for sanity's sake I want to verify this.
Does anyone know?