We use cookies to ensure that we give you the best experience on our website.

从Active Directory删除旧的Bitlocker恢复密码

当您为计算机生成新的Bitlocker恢复密码时，旧的Bitlocker恢复密码不再有效。但是，这些密码仍保留在Active Directory中。您可以将它们保留在那里，因为它不会受到伤害。但是对于一个清洁的环境，将其删除很棒。在本文中，您将学习如何使用PowerShell删除旧的Bitlocker恢复密码。

开始Active Directory用户和计算机并搜索计算机。双击计算机对象以打开计算机属性。单击Bitlocker恢复选项卡。

如果计算机对象上存在一个以上的bitlocker恢复密码，这就是外观。

如果要从所有计算机中从Active Directory导出当前的BitLocker恢复键，请阅读使用PowerShell从Active Directory导出Bitlocker恢复键。

删除旧的Bitlocker恢复密码PowerShell脚本

下载remove-bitlockerpass.ps1 powershell脚本并将其放入C：脚本文件夹。

确保文件未阻止以防止运行脚本时的错误。在运行PowerShell脚本时，请在文章中阅读更多信息。

另一个选择是将下面的代码复制并粘贴到记事本中。给它名字删除bitlockerpass.ps1并将其放在C：脚本文件夹。

<#
    .SYNOPSIS
    Remove-BitLockerPass.ps1

    .DESCRIPTION
    Remove old BitLocker Recovery Passwords from Active Directory for all computers.

    .LINK
    www.alitajran.com/remove-old-bitlocker-recovery-passwords/

    .NOTES
    Written by: ALI TAJRAN
    Website:    alitajran.com
    X:          x.com/alitajran
    LinkedIn:   linkedin.com/in/alitajran

    .CHANGELOG
    V1.00, 10/06/2024 - Initial version
#>

# Fetching computers from Active Directory
$Computers = Get-ADComputer -Filter 'ObjectClass -eq "computer"' -Property Name, DistinguishedName, OperatingSystem | Sort-Object Name

foreach ($computer in $Computers) {
    $params = @{
        Filter     = 'objectclass -eq "msFVE-RecoveryInformation"'
        SearchBase = $computer.DistinguishedName
        Properties = 'msFVE-RecoveryPassword', 'whencreated'
    }

    # Get BitLocker recovery information
    $bitlockerInfos = Get-ADObject @params | Sort-Object -Property WhenCreated -Descending

    if ($bitlockerInfos) {
        # Keep only the latest recovery password
        $latestRecoveryInfo = $bitlockerInfos[0]
        Write-Host "BitLocker Recovery information found for $($computer.Name)" -ForegroundColor Cyan

        # Check if there are more than one recovery keys to process
        if ($bitlockerInfos.Count -gt 1) {
            # Remove all but the latest recovery information
            foreach ($info in $bitlockerInfos[1..($bitlockerInfos.Count - 1)]) {
                try {
                    Remove-ADObject -Identity $info.DistinguishedName -Confirm:$false
                    Write-Host "Removed old BitLocker Recovery key for $($computer.Name) created on $($info.whencreated)" -ForegroundColor Green
                }
                catch {
                    Write-Host "Failed to remove old BitLocker Recovery key for $($computer.Name): $_" -ForegroundColor Red
                }
            }
        }
        else {
            Write-Host "Only one BitLocker Recovery key found for $($computer.Name). No action required." -ForegroundColor Cyan
        }
    }
    else {
        Write-Host "No BitLocker Recovery information found for $($computer.Name)" -ForegroundColor Cyan
    }
}

以管理员的身份运行PowerShell并运行remove-bitlockerpass.ps1脚本。

C:scripts.Remove-BitLockerPass.ps1

下面的输出出现。

建议阅读：

No BitLocker Recovery information found for DC01-2022
No BitLocker Recovery information found for DC02-2022
No BitLocker Recovery information found for EX01-2019
No BitLocker Recovery information found for EX02-2019
No BitLocker Recovery information found for EX03-2019
No BitLocker Recovery information found for FS01-2019
BitLocker Recovery information found for WIN10
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 01:19:12
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 01:18:45
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 01:15:43
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 00:59:41
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 00:56:39
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 00:51:52
Removed old BitLocker Recovery key for WIN10 created on 09/24/2024 08:41:52
Removed old BitLocker Recovery key for WIN10 created on 07/27/2024 00:36:52

验证Active Directory用户和计算机计算机对象上只有最新的Bitlocker恢复密码，并且较旧的密码被成功删除。

就是这样！

结论

您学会了如何使用PowerShell删除旧的Bitlocker恢复密码。将旧的恢复密码保留在Active Directory中是可以的，因为它们不会给您任何问题。但是，如果您希望一切在环境中尽可能整洁，请运行脚本。这将仅保留每台机器的最新Bitlocker恢复密码。

您喜欢这篇文章吗？您可能还喜欢导出Windows Laps密码报告。不要忘记关注我们并分享这篇文章。

Related articles