The BitLocker attribute in AD stores several key pieces of information, including:
By default, the group has access to view BitLocker recovery keys. However, regular users and computer accounts need permission to write these keys to AD.
If a recovery key is used (or exposed to a user), it should be considered compromised. You should delete the old key object in AD and force BitLocker to generate a new one on the client machine using:
When a computer is decommissioned, the msFVE-RecoveryInformation objects often remain attached to the tombstoned computer account. Ensure your AD cleanup scripts remove these child objects to keep the database clean.
The BitLocker attribute in AD stores several key pieces of information, including:
By default, the group has access to view BitLocker recovery keys. However, regular users and computer accounts need permission to write these keys to AD. bitlocker attribute active directory
If a recovery key is used (or exposed to a user), it should be considered compromised. You should delete the old key object in AD and force BitLocker to generate a new one on the client machine using: The BitLocker attribute in AD stores several key
When a computer is decommissioned, the msFVE-RecoveryInformation objects often remain attached to the tombstoned computer account. Ensure your AD cleanup scripts remove these child objects to keep the database clean. including: By default
Copyright © INTERNATIONAL COLOR CONSORTIUM
