Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that when you enforce storing the BitLocker recovery information in Active Directory (via GPO), it is stored in the computer object's ms-FVE-RecoveryPassword attribute. Microsoft also has some great information on How to use Active Directory for backup of BitLocker Drive Encryption recovery information. However, it isn't clear how securely this information is transferred from the client being encrypted to the domain controller storing this information.

enter image description here enter image description here

My question is if this recovery password is encrypted when it is passed from the client to Active Directory, or if it is sent in clear text. I assume it is encrypted, but for sanity's sake I want to verify this.

Does anyone know?

share|improve this question
If you have a few minutes you could run wireshark or do a raw network dump and use grep to search for the password in the output. – Daisetsu Jan 24 '11 at 23:08
up vote 1 down vote accepted

Seeing that there's already a PKI pair between AD and your Computer Account, I would assume that it's encrypted using that signature. There's only one way to check it out, but I don't have any bit-locker encrypted systems and I'm not on my network to verify.

share|improve this answer
But it's possible for a local user to login to a system and begin the BitLocker encryption process. Does the computer object have a PKI pair with AD and the computer account as well? – Mick Jan 24 '11 at 22:30
Sorry I meant Computer and AD. Yes, computers are uniquely Identified by active directory and have their own PKI pair. – Michael Brown Jan 24 '11 at 22:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.