Next, we need to add an access control entry (ACE) so that backing up TPM recovery information is possible. Step 2: Set the required permissions for backing up TPM password information If you would like to verify everything went well, Microsoft has posted some output on what the command should write: (v=ws.10).aspx You can see the official technet article here for more information on the command: (v=ws.10).aspx It is literally apart of the command, so ensure you execute the command exactly like above (changing your domain of course). Yes, you do want the trailing period (.) at the end of the command. Note: If you are on Server 2008 r2, it is recommended you extend your schema to Server 2012 or if you just want the BitLocker attributes, use these two ldf files: ldifde -i -v -f BitLockerTPMSchemaExtension.ldf -c 'DC=X' 'DC=mydomain,DC=local' -k -j. If you need the schema update (you are missing the five schema objects listed in the above powershell command), you can execute the following command via Command Prompt on your Domain Controller: # Check if the Computer Object exists in AD $computerObject = Get-ADComputer -Filter Įxtending your schema if you don't have the schema changes above Write-Host '~Enter in the correct credentials to access the BitLocker and TPM Owner attributes~' $UserName = Read-Host 'Enter User Name' $Password = Read-Host -AsSecureString 'Enter Your Password' $credential = New-Object -TypeName -ArgumentList $UserName, $Password # Get input on which machine to lookup $computer = Read-Host 'Enter in machine name' # Import our Active Directory PowerShell commands Import-Module ActiveDirectory

Bitlocker recovery password viewer