Use PATCH Graph API Command - Block Bitlocker Recovery Key Information from Users

👉Use PATCH Graph API Command - Block Bitlocker Recovery Key Information from Users #MSGraph #AzureAD #Bitlocker #msintune

➡️Use GET and PATCH Graph API commands to get the permission details of end users to view the Bitlocker recovery key of their own devices.

➡️allowedToReadBitlockerKeysForOwnedDevice: TRUE - Read Permission is granted to End-Users. Users can view Bitlocker Key.

➡️allowedToReadBitlockerKeysForOwnedDevice”: FALSE - Read Permission is NOT granted to End-Users. The BitLocker key is blocked or hidden from End-Users.

➡️Let’s see how to block or Hide Bitlocker Recovery Key from users. Microsoft recently added support to hide recovery keys from end-users.

➡️This helps to improve the security poster of the devices and restricts an attacker from getting Bitlocker encryption keys from Windows laptops.

➡️An attacker can abuse these recovery keys with access to the machine or end user since everyone has read permissions on icacls.

➡️A privilege escalation is possible by reconnecting the disk to another computer and changing files to achieve persistence and higher privileges.

======================================

More Blog posts related to SCCM/Intune/Windows 11/Cloud PC/AVD/Hyper-V/Cloud/IT Pro/Azure -

#CloudPC #Windows365 #W365

#SCCM #ConfigMgr #SCCMVideos #SCCMTutorials #SCCMStudyVideos #SCCMFreeTraining #SCCMTraining #HowtoManageDevices

#Intune #MicrosoftIntune #IntuneVideos #IntuneTutorials #IntuneGuide #IntuneStudy #MSIntune #IntuneTraining #HowtoManageDevices

[ChesterHunting]

Is there an method how you can remove the recovery key or disable it completly? Or maybe change it locally so it is not stored by microsoft? The only security problem I think in Bitlocker is this recovery key...