The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For a domain-joined Windows device, retrieve a BitLocker recovery password from the Active Directory Domain Services (AD DS) record using the BitLocker Recovery Password Viewer in Active Directory Users and Computers (ADUC). You can open a known computer object or search by the first eight characters of the password ID shown on the locked device. This works only if the recovery information was backed up to AD DS and your account can read it.
Before you look in Active Directory
Confirm that AD DS is the intended recovery store for the device. Microsoft distinguishes domain-joined devices, whose recovery information may be stored in AD DS, from Microsoft Entra-joined or hybrid-joined devices, for which Entra ID may also be relevant. Check the device’s join state and your organization’s recovery procedures rather than assuming every managed Windows device has its key in AD DS. Microsoft’s BitLocker recovery process describes the recovery workflow.
As an Amazon Associate I earn from qualifying purchases.
The recovery information must actually exist in AD DS. A lookup cannot find a password that was never backed up or was removed later. Microsoft warns that backup may not happen automatically and recommends configuring policy to save recovery information. The policy option Do not enable BitLocker until recovery information is stored in AD DS can prevent encryption from being enabled until the backup succeeds. Configure backup before enabling BitLocker where possible; backup may sometimes be performed afterward. See Microsoft’s BitLocker Group Policy settings.
Recommended Free Tools
You also need permission to read the recovery data. Domain Administrators have access by default, and administrators can delegate access to specific security principals. Treat that permission as sensitive and limit and audit it according to your organization’s policy: the recovery password can unlock the encrypted drive. Microsoft’s Recovery Password Viewer guidance covers access and use of the viewer.
#1 Best Overall
- [Trusted Platform Security] TPM 2.0 module with 20 pin LPC interface adds hardware based key storage for systems that support TCG 2.0. Designed for use with compatible motherboards such as for AOM TPM 9665V.
- [BitLocker Key Storage] This trusted platform module works with BitLocker and similar encryption software by storing encryption keys on a discrete processor, helping control access to protected files and system data.
- [BIOS Update Compatibility] Some motherboards need a TPM module or BIOS update to enable newer security functions. Check your motherboard manual for 20 pin LPC and TCG 2.0 support before installation.
- [Vertical Space Saving Design] Built with a compact vertical PCB structure, this motherboard security module fits neatly inside desktop systems while helping preserve internal layout space for other components.
- [Easy System Integration] The daughterboard style TPM module connects directly to the motherboard through the LPC interface. Suitable for desktop users upgrading compatible PCs for encryption focused use scenarios.
Choose a lookup route
| Route | Use it when | What you need |
|---|---|---|
| Open the computer object’s BitLocker Recovery tab | You know which computer object to inspect | Access to ADUC and permission to read the recovery record |
| Search for a BitLocker recovery password | You can read the recovery-screen password ID, or need to search without first locating the computer object | The first eight characters of the password ID and permission to read the record |
The BitLocker Recovery Password Viewer is included with Remote Server Administration Tools (RSAT) and is used through the ADUC Microsoft Management Console snap-in. Microsoft’s instructions state that the search can look across domains in the forest. Use the route that best matches the information available at the helpdesk.
Retrieve the password in ADUC
- Open ADUC. On an administrator workstation with the BitLocker Recovery Password Viewer available, open Active Directory Users and Computers.
- Choose the computer-object route or the search route.
- For a known computer, locate its computer object, open Properties, then select the BitLocker Recovery tab.
- To search by ID, right-click the domain container and select Find BitLocker Recovery Password. Enter the first eight characters of the password ID from the recovery screen.
- Match the result to the locked device. Confirm the recovery identifier before using the associated password. The ID is a locator, not the password itself.
- Provide the recovery password through your organization’s approved helpdesk process. Do not expose it in an unsecured ticket, chat, or other channel.
Microsoft documents these ADUC workflows in its BitLocker Recovery Password Viewer instructions.
Rank #2
- [Encrypt with Confidence] Tpm is a discrete encryption processor connected to the daughter board, ensuring strong encryption for your pc.
- [] Store encryption keys securely for software like bitlocker, ensuring protection for your pc content.
- [Seamless Integration] Compatible with a wide range of pc like z590, b560, h510, offering small size and versatile functionality.
- [Multiple Compatibility] With a 14-pin layout and lpc interface, this tpm2.0 module is ideal for a variety of pc , ensuring data security.
- [Enhanced Security] Safely generate, store, and restrict usage of encryption keys, protecting your data from unauthorized access.
Tell the password ID apart from the recovery password
The recovery screen shows a password ID that helps identify the correct recovery record. The ADUC search accepts its first eight characters. The actual BitLocker recovery password is a 48-digit value. Do not enter the short ID where the recovery password is requested, or provide a password from a record whose identifier does not match the device. Microsoft’s recovery-process guidance explains the recovery prompt and identifier.
Understand what AD DS may store
AD DS recovery data can include a recovery GUID, volume GUID, recovery password, and key package. The key package is separate from the password: it is not an alternate way to unlock a drive. When a volume is physically corrupted, the package may help recover portions of it when used with the corresponding recovery password and volume identifier.
Rank #3
- [Suitable for Pc Computers] Compatible with pc computers, this tpm2.0 security module is designed for data security, working within the standard pc architecture for optimal performance and protect.
- [Compatible with Motherboards] A stand-alone cryptographic processor that fits motherboards, offering practical functionality to enhance device security.
- [Ddr4 Memory Module Compatibility] Featuring a 16-pin design, this module is compatible with ddr4 memory modules, enhancing device security against unauthorized access.
- [Secure Encryption Keys Storage] Safely store encryption keys created using software like bitlocker, ensuring content remains protected from unauthorized access on the user's pc.
- [Easy Replacement for Damaged Tpms] Conveniently replace damaged or underperforming tpms to restore device functionality, ensuring proper operation based on specific motherboard specifications.
Microsoft says the key package is not stored by default. If your organization needs that recovery capability, configure the policy to back up both the recovery password and key package. The relevant settings are described in Microsoft’s BitLocker Group Policy settings.
If ADUC does not find a record
- Check the lookup details. Confirm the computer object, domain, and first eight characters of the password ID. Make sure the ID is not being confused with the 48-digit recovery password.
- Check access. Verify that your account can read the recovery information; ask an administrator with the appropriate delegated permission if needed.
- Check the recovery store and backup history. Confirm the device’s join state and whether policy was configured to back up recovery information to AD DS. The record may never have been backed up or may have been removed.
- If the device is online and its recovery information still exists locally, an administrator can attempt a backup. From an elevated Command Prompt on the client, run
manage-bde.exe -protectors -adbackup C:. This backs up available protector information; it does not recreate a lost password or guarantee a directory record if the relevant recovery protector is unavailable. Microsoft documents the command in its BitLocker management guidance. - If no authorized recovery location has the password, stop treating this as a lookup problem. ADUC cannot derive missing credentials. Follow your organization’s incident and data-recovery procedures; BitLocker is designed to keep data inaccessible without the required authentication information.
After the drive is recovered
Follow your organization’s post-recovery process to determine why BitLocker entered recovery and whether recovery credentials should be rotated. Rotation is not automatic merely because the password was retrieved or used. Microsoft’s recovery-process article includes post-recovery tasks.
Rank #4
- STANDALONE CRYPTOGRAPHIC PROCESSOR: TPM2.0 is a standalone cryptographic processor connected to a daughter board attached to the motherboard.
- STABLE PERFORMANCE: Replace broken, damaged, cracked, unusable encryption security module, easy to use and stable performance.
- ENCRYPTION KEY: TPM2.0 securely stores the encryption key, which can be created with encryption software (e.g. for for BitLocker). Without this key, the contents of the computer remain encrypted and protected from unauthorized access.
- SUPPORT SYSTEM: TPM2.0 is installed to upgrade your computer system to for 11, compatible with for 2.0 system, with good compatibility.
- APPLICATIONS: 14pin, Supported states may vary by motherboard specification. tpm chips are more compatible with DDR4 memory modules on motherboards.
The Microsoft Learn recovery-process article lists applicability to Windows 10, Windows 11, and Windows Server 2016, 2019, 2022, and 2025. The exact behavior of legacy platforms and an organization’s own delegation and Group Policy configuration should be verified in that environment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
