SCCM SQL Query to get bitlocker recovery password

Question

Hi,

I am using the below query to get the recovery password.

select a.Id, a.Name, b.VolumeId, c.RecoveryKeyId, c.RecoveryKey, c.LastUpdateTime, c.Disclosed from RecoveryAndHardwareCore_Machines a
inner join RecoveryAndHardwareCore_Machines_Volumes b ON a.Id = b.MachineId
inner join RecoveryAndHardwareCore_Keys c ON b.VolumeId = c.VolumeId
where RecoveryKeyId LIKE '4DFDHHHH%'

But recovery password is more than 48 digit.

Please share the query to get bitlocker recovery password in actual format

Answer 1

That's because it's encrypted in place. There is no (supported) direct query you can use for this.

Answer 2

@Boopathi Subramaniam

For our sercurity protection,we may not see our recovery key directly in our data base. If we install a SQL Server certificate, Configuration Manager encrypts your data in SQL.

If we really want to see our recovery key,maybe we could set up BitLocker portals through our sccm and configure our portal to let us have access to all recovery areas of the administration and monitoring website.
For more details,please see this article:
https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/bitlocker/setup-websites

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Here is a possible, but unsupported solution (the last query on the page):

https://geekdudes.wordpress.com/2020/03/25/sccm-get-decrypt-bitlocker-recovery-keys-from-the-configmgr-database/