Restore deleted computer object including BitLocker recovery information

Posted by on Aug 10, 2012 in Active Directory, BitLocker, Powershell | 6 comments

Recovery of Active Directory objects became much easier with the introduction of AD recycle bin feature in Windows Server 2008 R2. Simply use the restore-adobject PowerShell cmdlet and you’re done. But what if you are using BitLocker with its keys stored in AD? You can still restore the computer object once it got deleted. But the attached msFVE-RecoveryInformation objects will not get restored automatically.

This small PowerShell cmdlet will do the work for you:

import-module ActiveDirectory

function RestoreComputer($computername)
{
  If ($computername.substring($computername.length - 1, 1) -ne '$')
  {
    $computername += '$'
  }

  $existing = Get-ADObject -Filter {sAMAccountName -eq $computername}
  If (!$existing)
  {
    "No existing computer object found, searching for deleted objects."
    $deleted = Get-ADObject -IncludeDeletedObjects -Filter {sAMAccountName -eq $computername -and Deleted -eq $True}
    If ($deleted)
    {
      "Deleted object found, trying to restore..."
      $deleted | Restore-ADObject
      Start-Sleep -s 5
      $restoredobject = Get-ADObject -Filter {sAMAccountName -eq $computername}
      If ($restoredobject)
      {
        "Computer object successfully restored. Trying to find recovery information..."
        $recoveryinfos = Get-ADObject -IncludeDeletedObjects -Filter {lastKnownParent -eq $restoredobject.DistinguishedName -and Deleted -eq $True -and objectClass -eq 'msFVE-RecoveryInformation'}
        ForEach($recoveryinfo in $recoveryinfos)  
        {
          If ($recoveryinfo)
          {
            "Recovery information found, trying to restore..."
            $recoveryinfo | Restore-ADObject
            Start-Sleep -s 5
            $restoredinfo = Get-ADObject -Filter {ObjectGUID -eq $recoveryinfo.ObjectGUID}
            If ($restoredinfo)
            {
              "Recovery information successfully restored."
            }
            Else
            {
              "Could not restore recovery information, aborting script."
              return $false
            }
          }
          Else
          {
            "No recovery information found for computer object, aborting script."
            return $true
          }
        }
      }
      Else
      {
        "Something went wrong. Could not find restored object, aborting script."
        return $false
      }
    }
    Else
    {
      "No deleted computer found, aborting script"
      return $false;
    }
  }
  Else
  {
    "Computer already existing, aborting script"
    return $false
  }
  "Restore of computer object succeeded."
  "Finished."
  return $true
}

$cn = Read-Host "Computername to restore?"

RestoreComputer($cn)

The script will first search for any existing computer objects with the same name. If there are none, it will try to restore a deleted object. Be careful if you have multiple deleted objects with the same name, you may need to change some parts of the script for this scenario.
After that it searches for BitLocker recovery information and tries to restore this as well – no matter how many objects the computer object contained.

6 Comments

  1. Thanks for the script! Exactly what I needed.

  2. Hi,
    Wheni try this script, i am getting the below error message

    PS D:\AD> .\computerobjectrestore.ps1
    You must provide a value expression on the right-hand side of the ‘-and’ operator.
    At D:\AD\computerobjectrestore.ps1:25 char:39
    + $restoredobject.DistinguishedName -and <<<< Deleted -eq $True -and objectClass -eq 'msFVE-RecoveryInformation'}
    + CategoryInfo : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : ExpectedValueExpression

  3. Could you please replace “Deleted” with “IsDeleted” and try again?

  4. Nice script, was going to write script, but your logic is organized and nice.

    im redirecting people from http://ammarhasayen.com/2013/10/29/recover-bitlocker-keys-from-recycle-bin/ to this page if you do not mind

  5. Sure… feel free to do so ūüôā

  6. This is aweseome. I have a unique problem though and very very limited pwershell writing skills. All of my Bitlocker Child objects seem to have be disassociated with there parent. What needs to be modified in order to go through AD and reassociate the child objects with the computer objects?

Trackbacks/Pingbacks

  1. Recover BitLocker keys from Recycle Bin ! | Ammar Hasayen - Blog - […] have no single credit writing this script. You can find the script here¬†written by (Norman Bauer). I copied the…
  2. Recover BitLocker keys from Recycle Bin ! – Azure Mechanics - […] have no single credit writing this script. You can find the script here¬†written by (Norman Bauer). I copied the…
  3. BitLocker tips and tricks | Ammar Hasayen - […] The script is written by Norman Bauer and you can download it from his blog post. […]

Leave a Reply

Your email address will not be published. Required fields are marked *

Captcha: * Time limit is exhausted. Please reload CAPTCHA.