How to Backup BitLocker Key to Azure AD Using PowerShell

BitLocker is a security feature built into Windows that provides encryption for entire volumes. It addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned devices. By encrypting the hard drive where Windows is installed, or the entire computer if it has multiple drives, BitLocker helps protect your data.

BitLocker is particularly useful as it provides protection against unauthorised changes to your system such as firmware-level malware. It also helps mitigate unauthorised data access by enhancing file and system protections. BitLocker is an essential tool for securing your data, especially when data breaches and information theft are common.

The Command

Here is the command that we’ll be using:

BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId ((Get-BitLockerVolume -MountPoint $env:SystemDrive ).KeyProtector | where {$_.KeyProtectorType -eq "RecoveryPassword" }).KeyProtectorId

This command backs up the BitLocker key protector of type “RecoveryPassword” for the system drive to AAD.

Outputting the Key Protector to the Screen

If you want to output the key protector to the screen, you can use the following command:

(Get-BitLockerVolume -MountPoint C).KeyProtector

This command retrieves the key protector for the C drive and outputs it to the screen.

Microsoft Azure AD Sync service stuck starting

Seen an issue with the Azure AD Sync service stuck starting,  If you check the event log > Application logs you may see an issue with Event ID:528 Source SQLLocalDB.

If you are seeing this it could be the Sync DB has become damaged.  Disable the "Microsoft Azure AD Sync" Server and kill of its pid or reboot the server.

Now depending who the server is running as the logs and DB could be in 1 of too places.

Running as System > C:\Windows\ServiceProfiles\ADSync\AppData\Local\Microsoft\Microsoft SQL Server Local DB\Instances
Running as AAD_<NUMBER> > C:\Users\AAD_<NUMBER>\AppData\Local\Microsoft\Microsoft SQL Server Local DB\Instances\

Step one would be to check the logs and look for the following error

‘model’ is not valid

If your getting this then its damaged and needs to be replaced.  the logs are located in:

ADSync2019/error.log

You need to take a copy of the following files from C:\Program Files\Microsoft SQL Server\150\LocalDB\Binn\Templates:

model.mdf
modellog.ldf

and place them in:

ADSync2019/

I would rename the old ones and copy in these once form there,  set the service back to automatic and start it back up, may take a min but should switching to running.

Then open AD Sync and confirm its doing the syncs again

Get Azure AD Users SID's

Powershell

On a computer run the following within PowerShell ISE

Import-Module -Name AzureAD
Connect-AzureAD

function Convert-ObjectIdToSid
{
    param([String] $ObjectId)
     $d=[UInt32[]]::new(4);[Buffer]::BlockCopy([Guid]::Parse($ObjectId).ToByteArray(),0,$d,0,16);"S-1-12-1-$d".Replace(' ','-')
}

Then

Get-AzureADUser | ForEach { [pscustomobject] @{ Name= $_.DisplayName; Sid=Convert-ObjectIdToSid($_.ObjectId)}}

You can do a search within the Get-AzureADUser by using the -SearchString "<USERNAME>"

As the user logged in to a device

Open CMD and type

whoami /user

M365 and Azure on-prem AD Sync Tool force a Delta update

1. Run PowerShell Elevated
2. Run the following "Import-Module –Name "C:\Program Files\Microsoft Azure AD Sync\Bin\ADSync" -Verbose"
3. Run "Start-ADSyncSyncCycle -PolicyType Delta"

This has to be done on the server that has the AD sync tool installed on.