Question

We disable computers when they haven’t been used after a certain amount of time and those computers are deleted out of Active Directory after a certain amount of time. I have been tasked with writing code to go through active directory and copying all of the bitlocker recovery passwords for the disabled machines before they are deleted (done manually if done at all right now). I started generic, just looping through Active Directory and have this:

DirectoryEntry adRoot = new DirectoryEntry("XXXX://" + domain, null, null, AuthenticationTypes.Secure);
DirectorySearcher searcher = new DirectorySearcher(adRoot);
searcher.SearchScope = SearchScope.Subtree;
searcher.ReferralChasing = ReferralChasingOption.All;
SearchResultCollection result = searcher.FindAll();
foreach (SearchResult res in result)
{
    DirectoryEntry directoryEntry = res.GetDirectoryEntry();
    foreach (DirectoryEntry de in directoryEntry.Children)
    {
    }
}

I see all of the disabled computers as children on the main search but looking through the properties on those children I am not seeing anything referring to bitlocker. I have changed my google search to bitlocker specific but am not finding anything along the lines of what I am needing. Does anyone know of a good way to do this?

Answer 1

The attributes are listed in this article – http://technet.microsoft.com/en-us/library/dd875529(WS.10).aspx under the ‘Storing BitLocker recovery information in AD DS’ section. You can access these properties with de.Properties["your-property-here"].Value.