从 Active Directory 中删除旧的 BitLocker 恢复密码

Jacki

2024-10-06

当您为计算机生成新的 BitLocker 恢复密码时，旧的 BitLocker 恢复密码将不再有效。但是，这些密码保留在 Active Directory 中。你可以把它们留在那里，因为它不会造成伤害。但为了一个看起来干净的环境，把它们去掉是很好的。在本文中，您将了解如何使用 PowerShell 删除旧的 BitLocker 恢复密码。

开始Active Directory 用户和计算机并搜索计算机。双击计算机对象以打开计算机属性。单击BitLocker 恢复选项卡。

如果计算机对象上存在多个 BitLocker 恢复密码，则会出现以下情况。

如果要从所有计算机的 Active Directory 导出当前的 BitLocker 恢复密钥，请阅读文章使用 PowerShell 从 Active Directory 导出 BitLocker 恢复密钥。

删除旧的 BitLocker 恢复密码 PowerShell 脚本

下载Remove-BitLockerPass.ps1 PowerShell脚本并将其放置在C：脚本文件夹。

确保文件未被阻止，以防止运行脚本时出现错误。请阅读文章运行 PowerShell 脚本时出现未数字签名错误来了解更多信息。

另一种选择是将以下代码复制并粘贴到记事本中。给它起个名字删除-BitLockerPass.ps1并将其放置在C：脚本文件夹。

<#
    .SYNOPSIS
    Remove-BitLockerPass.ps1

    .DESCRIPTION
    Remove old BitLocker Recovery Passwords from Active Directory for all computers.

    .LINK
    www.alitajran.com/remove-old-bitlocker-recovery-passwords/

    .NOTES
    Written by: ALI TAJRAN
    Website:    alitajran.com
    X:          x.com/alitajran
    LinkedIn:   linkedin.com/in/alitajran

    .CHANGELOG
    V1.00, 10/06/2024 - Initial version
#>

# Fetching computers from Active Directory
$Computers = Get-ADComputer -Filter 'ObjectClass -eq "computer"' -Property Name, DistinguishedName, OperatingSystem | Sort-Object Name

foreach ($computer in $Computers) {
    $params = @{
        Filter     = 'objectclass -eq "msFVE-RecoveryInformation"'
        SearchBase = $computer.DistinguishedName
        Properties = 'msFVE-RecoveryPassword', 'whencreated'
    }

    # Get BitLocker recovery information
    $bitlockerInfos = Get-ADObject @params | Sort-Object -Property WhenCreated -Descending

    if ($bitlockerInfos) {
        # Keep only the latest recovery password
        $latestRecoveryInfo = $bitlockerInfos[0]
        Write-Host "BitLocker Recovery information found for $($computer.Name)" -ForegroundColor Cyan

        # Check if there are more than one recovery keys to process
        if ($bitlockerInfos.Count -gt 1) {
            # Remove all but the latest recovery information
            foreach ($info in $bitlockerInfos[1..($bitlockerInfos.Count - 1)]) {
                try {
                    Remove-ADObject -Identity $info.DistinguishedName -Confirm:$false
                    Write-Host "Removed old BitLocker Recovery key for $($computer.Name) created on $($info.whencreated)" -ForegroundColor Green
                }
                catch {
                    Write-Host "Failed to remove old BitLocker Recovery key for $($computer.Name): $_" -ForegroundColor Red
                }
            }
        }
        else {
            Write-Host "Only one BitLocker Recovery key found for $($computer.Name). No action required." -ForegroundColor Cyan
        }
    }
    else {
        Write-Host "No BitLocker Recovery information found for $($computer.Name)" -ForegroundColor Cyan
    }
}

以管理员身份运行 PowerShell 并运行 Remove-BitLockerPass.ps1 脚本。

C:scripts.Remove-BitLockerPass.ps1

将出现以下输出。

No BitLocker Recovery information found for DC01-2022
No BitLocker Recovery information found for DC02-2022
No BitLocker Recovery information found for EX01-2019
No BitLocker Recovery information found for EX02-2019
No BitLocker Recovery information found for EX03-2019
No BitLocker Recovery information found for FS01-2019
BitLocker Recovery information found for WIN10
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 01:19:12
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 01:18:45
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 01:15:43
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 00:59:41
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 00:56:39
Removed old BitLocker Recovery key for WIN10 created on 10/06/2024 00:51:52
Removed old BitLocker Recovery key for WIN10 created on 09/24/2024 08:41:52
Removed old BitLocker Recovery key for WIN10 created on 07/27/2024 00:36:52

验证于Active Directory 用户和计算机计算机对象上仅存在最新的 BitLocker 恢复密码，并且旧的密码已成功删除。