bitlocker - how to create recovery key?

I have a w2k12 system on which I enabled bitlocker on my D: drive. I cannot use TPM, because there is no w2k12 driver for that module which fits my motherboard, so I used USB flash to store the key. Weirdly the wizard did not offer me to use USB flash to store the key when enabling bitlocker on D drive (6TB), but it DID show this option for drive C. Why? Anyway I made it using these commands instead:

manage-bde -protectors -add d: -startupkey e: (e: being the flash drive)
manage-bde -on d:

Then I waited several days and now it says

PS C:\> manage-bde -status d:
BitLocker Drive Encryption: Configuration Tool version 6.3.9600
Copyright (C) 2013 Microsoft Corporation. All rights reserved.
Volume D: [WD6TB]
[Data Volume] Size: 5588.90 GB BitLocker Version: 2.0 Conversion Status: Fully Encrypted Percentage Encrypted: 100.0% Encryption Method: AES 128 Protection Status: Protection On Lock Status: Unlocked Identification Field: Unknown Automatic Unlock: Disabled Key Protectors: External Key

If I look into manage bitlocker control panel I don't see "backup your recovery key"

How do I get the recovery key? This is a server OS, so I did this all while logged on as administrator. I don't have a microsoft account tied to it.

1 Answer

I think that the problem may be that the BitLocker drive just does not have a Recovery Key as one of its BitLocker Protectors.

Bitlocker can unlock your drive with various types of Protectors such as TPM, Password, and Recovery Key.

To see the available types, run:

manage-bde -protectors d: -get

You’ll see the 48-digit password that is the BitLocker recovery key under "Numerical Password":

A "Recovery Key" or "Startup Key" has a corresponding "External Key", which is saved in a .BEK file. These two Protectors are not mandatory, so your drive may not have one assigned.

To save the .BEK key file you need an "External Key" protector listed when you run the above command.

If missing, you can add a Recovery Key to the drive with the command below, which will also back it up to a .BEK file in, for example f:\folder:

manage-bde -protectors -add d: -RecoveryKey f:\folder

Then, when you run the command below it will save a .BEK file to the directoryf:\folder:

manage-bde -protectors -get d: -sek f:\folder

Finally the problem was that the Numerical Password protector, also known as RecoveryPassword was missing, as it was probably not specified when the volume was locked.

An example of a command to enable BitLocker on the C drive, store the recovery key on the Y drive, and generate a random recovery password, is:

manage-bde -on C: -RecoveryKey Y: -RecoveryPassword

If the paramater RecoveryPassword was not specified when enabling BitLocker, this protector can later be added by using the command:

 manage-bde –protectors –add C: -RecoveryPassword