BitLocker can report as encrypted while its recovery password never made it to Entra ID (Azure AD), leaving the device unrecoverable. This script confirms whether a successful escrow was logged recently, and if not, forces the backup for every RecoveryPassword protector on the target volumes. Detection signal: event ID 845 in the Microsoft-Windows... More info

Lists every BitLocker recovery key that was viewed in Entra ID: who read it, when, from which IP, for which device, and whether the key has been rotated since. A key that was read and never rotated still unlocks the drive, so those come first. Also flags anyone who read keys for several devices in the period. Never reads a key itself: it only lists... More info