Censusby Steward IT

Documentation › Using Steward IT Census

Recovery keys

Security › Recovery keys keeps the recovery keys of encrypted disks: the BitLocker recovery passwords of your Windows computers, and FileVault or other keys you add by hand. When a user is stuck at the BitLocker recovery screen after a firmware update, a new motherboard or a forgotten PIN, you look the key up in Census instead of hunting through Active Directory, Entra ID or a spreadsheet.

Recovery keys open the whole disk, so Census treats them with care:

  • the keys are encrypted with your server's secret key, the same way as stored credentials, and stay on your Census server;
  • lists never show the keys themselves; a key is shown only when someone clicks Reveal, one key at a time;
  • only administrators and roles with the Recovery keys permission can see the list or reveal a key, and roles limited to some assets see only those assets' keys;
  • every reveal is recorded in the audit log (Configuration › Audit log) with who, when, the computer, the volume and the key ID;
  • a login can reveal at most 30 keys an hour, and keys can't be revealed with an API token.

Turning escrow on#

Automatic escrow is on from the start: keys arrive with the next inventories of your Windows computers. Only logins with the Recovery keys permission (and administrators) can see them. To stop collecting, an administrator unticks Collect BitLocker recovery keys from Windows computers under Security › Recovery keys.

From then on, each inventory of a Windows computer also reads the recovery password of every BitLocker volume:

  • through the Census agent (version 0.78 or later),
  • through WinRM network scans with an administrator credential,
  • through remote scanners at other sites (remote scanner version 0.78 or later).

Computers that report with older agents or scanners keep working; they just don't send keys until they are updated. Turning escrow off stops the collection; keys already escrowed stay until you delete them.

Census reads keys only: it never adds, changes or removes a BitLocker protector. A volume without a recovery password protector (for example one protected only by the TPM) has no key to escrow. Add one on the computer, for example with manage-bde -protectors -add C: -RecoveryPassword, and the next inventory picks it up.

Finding the right key#

The BitLocker recovery screen shows the start of the key's ID, for example Recovery key ID: 1A2B3C4D. Type those characters into the Key ID search on Security › Recovery keys, or open the computer's Recovery keys tab. Click Reveal to show the 48-digit key; Copy puts it on the clipboard, and the window closes by itself after a minute.

Retired keys#

When a recovery password is no longer on the computer (BitLocker was turned off, the key was rotated, the disk was replaced), Census keeps it as Retired for a year: older backups and disk images of that computer may still need it. Tick Include retired keys to search them too. Administrators can delete a key at any time; Census keeps no other copy.

FileVault and keys added by hand#

A Mac's FileVault personal recovery key is shown only once, when FileVault is turned on, and can't be read back from the Mac afterwards. To escrow it in Census, open the Mac's Recovery keys tab and add it under Add a key by hand with the type FileVault. If your Macs are managed by an MDM, the MDM can escrow FileVault keys for you instead.

The same form takes BitLocker keys of computers Census can't log in to (Census checks the 48 digits for typing mistakes) and Other keys, for example of an encrypted backup disk. Keys added by hand show who added them and stay until someone deletes them.

Report#

Encrypted computers without an escrowed recovery key (Reports › Security) lists computers with BitLocker or FileVault turned on for which Census holds no current key: the ones to fix before a user gets stuck at the recovery screen.