Betriebshandbuch für die BitLocker-Laufwerkverschlüsselung: Wiederherstellen verschlüsselter Volumes mit AD DS

'To refer to other groups, change the group name (ex: change to "DOMAIN\Help Desk Staff")
strGroupName = "BitLocker Recoverers"  

' -------------------------------------------------------------------------------- 
' Access Control Entry (ACE) constants  
' --------------------------------------------------------------------------------

'- From the ADS_ACETYPE_ENUM enumeration 
Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT      = &H5   'Allows an object to do something

'- From the ADS_ACEFLAG_ENUM enumeration 
Const ADS_ACEFLAG_INHERIT_ACE                = &H2  'ACE applies to target and inherited child objects 
Const ADS_ACEFLAG_INHERIT_ONLY_ACE           = &H8  'ACE does NOT apply to target (parent) object

'- From the ADS_RIGHTS_ENUM enumeration 
Const ADS_RIGHT_DS_CONTROL_ACCESS      = &H100 'The right to view confidential attributes 
Const ADS_RIGHT_DS_READ_PROP                 = &H10  ' The right to read attribute values

'- From the ADS_FLAGTYPE_ENUM enumeration 
Const ADS_FLAG_OBJECT_TYPE_PRESENT           = &H1   'Target object type is present in the ACE 
Const ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT = &H2   'Target inherited object type is present in the ACE 

' -------------------------------------------------------------------------------- 
' BitLocker schema object GUID's  
' --------------------------------------------------------------------------------

'- ms-FVE-RecoveryInformation object: 
'  includes the BitLocker recovery password and key package attributes 
SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION = "{EA715D30-8F53-40D0-BD1E-6109186D782C}"

'- ms-FVE-RecoveryPassword attribute: 48-digit numerical password 
SCHEMA_GUID_MS_FVE_RECOVERYPASSWORD = "{43061AC1-C8AD-4CCC-B785-2BFAC20FC60A}"

'- ms-FVE-KeyPackage attribute: binary package for repairing damages 
SCHEMA_GUID_MS_FVE_KEYPACKAGE = "{1FD55EA8-88A7-47DC-8129-0DAA97186A54}"

'- Computer object 
SCHEMA_GUID_COMPUTER = "{BF967A86-0DE6-11D0-A285-00AA003049E2}"

'Reference: "Platform SDK: Active Directory Schema"

' -------------------------------------------------------------------------------- 
' Set up the ACE to allow reading of all BitLocker recovery information properties 
' --------------------------------------------------------------------------------

Set objAce1 = createObject("AccessControlEntry")

objAce1.AceFlags = ADS_ACEFLAG_INHERIT_ACE + ADS_ACEFLAG_INHERIT_ONLY_ACE 
objAce1.AceType = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT 
objAce1.Flags = ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT

objAce1.Trustee = strGroupName 
objAce1.AccessMask = ADS_RIGHT_DS_CONTROL_ACCESS + ADS_RIGHT_DS_READ_PROP 
objAce1.InheritedObjectType = SCHEMA_GUID_MS_FVE_RECOVERYINFORMATION

' Note: ObjectType is left blank above to allow reading of all properties

' -------------------------------------------------------------------------------- 
' Connect to Discretional ACL (DACL) for domain object 
' --------------------------------------------------------------------------------

Set objRootLDAP = GetObject("LDAP://rootDSE") 
strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com

Set objDomain = GetObject(strPathToDomain)

WScript.Echo "Accessing object: " + objDomain.Get("distinguishedName")

Set objDescriptor = objDomain.Get("ntSecurityDescriptor") 
Set objDacl = objDescriptor.DiscretionaryAcl
 
' -------------------------------------------------------------------------------- 
' Add the ACEs to the Discretionary ACL (DACL) and set the DACL 
' --------------------------------------------------------------------------------

objDacl.AddAce objAce1

objDescriptor.DiscretionaryAcl = objDacl 
objDomain.Put "ntSecurityDescriptor", Array(objDescriptor) 
objDomain.SetInfo

WScript.Echo "SUCCESS!"

'To refer to other groups, change the group name (ex: change to "DOMAIN\TPM Owners") 
strGroupName = "TPM Owners"

' -------------------------------------------------------------------------------- 
' Access Control Entry (ACE) constants 
' --------------------------------------------------------------------------------

'- From the ADS_ACETYPE_ENUM enumeration 
Const ADS_ACETYPE_ACCESS_ALLOWED_OBJECT      = &H5   'Allows an object to do something

'- From the ADS_ACEFLAG_ENUM enumeration 
Const ADS_ACEFLAG_INHERIT_ACE                = &H2  'ACE applies to target and inherited child objects 
Const ADS_ACEFLAG_INHERIT_ONLY_ACE           = &H8  'ACE does NOT apply to target (parent) object

'- From the ADS_RIGHTS_ENUM enumeration 
Const ADS_RIGHT_DS_CONTROL_ACCESS      = &H100 'The right to view confidential attributes 
Const ADS_RIGHT_DS_READ_PROP                 = &H10  ' The right to read attribute values

'- From the ADS_FLAGTYPE_ENUM enumeration 
Const ADS_FLAG_OBJECT_TYPE_PRESENT           = &H1   'Target object type is present in the ACE 
Const ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT = &H2   'Target inherited object type is present in the ACE 

' -------------------------------------------------------------------------------- 
' TPM and FVE schema object GUID's 
' --------------------------------------------------------------------------------

'- ms-TPM-OwnerInformation attribute: SHA-1 hash of the TPM owner password 
SCHEMA_GUID_MS_TPM_OWNERINFORMATION = "{AA4E1A6D-550D-4E05-8C35-4AFCB917A9FE}"

'- Computer object 
SCHEMA_GUID_COMPUTER = "{BF967A86-0DE6-11D0-A285-00AA003049E2}"

'Reference: "Platform SDK: Active Directory Schema"


' -------------------------------------------------------------------------------- 
' Set up the ACE to allow reading of TPM owner information 
' --------------------------------------------------------------------------------

Set objAce1 = createObject("AccessControlEntry")

objAce1.AceFlags = ADS_ACEFLAG_INHERIT_ACE + ADS_ACEFLAG_INHERIT_ONLY_ACE 
objAce1.AceType = ADS_ACETYPE_ACCESS_ALLOWED_OBJECT 
objAce1.Flags = ADS_FLAG_OBJECT_TYPE_PRESENT + ADS_FLAG_INHERITED_OBJECT_TYPE_PRESENT

objAce1.Trustee = strGroupName 
objAce1.AccessMask = ADS_RIGHT_DS_CONTROL_ACCESS + ADS_RIGHT_DS_READ_PROP 
objAce1.ObjectType = SCHEMA_GUID_MS_TPM_OWNERINFORMATION 
objAce1.InheritedObjectType = SCHEMA_GUID_COMPUTER


' -------------------------------------------------------------------------------- 
' Connect to Discretional ACL (DACL) for domain object 
' --------------------------------------------------------------------------------

Set objRootLDAP = GetObject("LDAP://rootDSE") 
strPathToDomain = "LDAP://" & objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com

Set objDomain = GetObject(strPathToDomain)

WScript.Echo "Accessing object: " + objDomain.Get("distinguishedName")

Set objDescriptor = objDomain.Get("ntSecurityDescriptor") 
Set objDacl = objDescriptor.DiscretionaryAcl

 
' -------------------------------------------------------------------------------- 
' Add the ACEs to the Discretionary ACL (DACL) and set the DACL 
' --------------------------------------------------------------------------------

objDacl.AddAce objAce1

objDescriptor.DiscretionaryAcl = objDacl 
objDomain.Put "ntSecurityDescriptor", Array(objDescriptor) 
objDomain.SetInfo

WScript.Echo "SUCCESS!"

' Target drive letter 
strDriveLetter = "c:"

' Target computer name 
' Use "." to connect to the local computer 
strComputerName = "." 


' -------------------------------------------------------------------------------- 
' Connect to the BitLocker WMI provider class 
' --------------------------------------------------------------------------------

strConnectionStr = "winmgmts:" _ 
                 & "{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" _ 
                 & strComputerName _ 
                 & "\root\cimv2\Security\MicrosoftVolumeEncryption"
                 
                 
On Error Resume Next 'handle permission errors

Set objWMIService = GetObject(strConnectionStr)


If Err.Number <> 0 Then 
     WScript.Echo "Failed to connect to the BitLocker interface (Error 0x" & Hex(Err.Number) & ")." 
     Wscript.Echo "Ensure that you are running with administrative privileges." 
     WScript.Quit -1 
End If

On Error GoTo 0

strQuery = "Select * from Win32_EncryptableVolume where DriveLetter='" & strDriveLetter & "'" 
Set colTargetVolumes = objWMIService.ExecQuery(strQuery)


If colTargetVolumes.Count = 0 Then 
    WScript.Echo "FAILURE: Unable to find BitLocker-capable drive " &  strDriveLetter & " on computer " & strComputerName & "." 
    WScript.Quit -1 
End If


' there should only be one volume found 
For Each objFoundVolume in colTargetVolumes 
    set objVolume = objFoundVolume 
Next


' objVolume is now our found BitLocker-capable disk volume


' -------------------------------------------------------------------------------- 
' Perform BitLocker WMI provider functionality 
' --------------------------------------------------------------------------------


' Add a new recovery password, keeping the ID around so it doesn't get deleted later 
' ----------------------------------------------------------------------------------

nRC = objVolume.ProtectKeyWithNumericalPassword("Recovery Password Refreshed By Script", , sNewKeyProtectorID)

If nRC <> 0 Then 
WScript.Echo "FAILURE: ProtectKeyWithNumericalPassword failed with return code 0x" & Hex(nRC) 
WScript.Quit -1 
End If

' Removes the other, "stale", recovery passwords 
' ----------------------------------------------------------------------------------

nKeyProtectorTypeIn = 3 ' type associated with "Numerical Password" protector

nRC = objVolume.GetKeyProtectors(nKeyProtectorTypeIn, aKeyProtectorIDs)

If nRC <> 0 Then 
WScript.Echo "FAILURE: GetKeyProtectors failed with return code 0x" & Hex(nRC) 
WScript.Quit -1 
End If

' Delete those key protectors other than the one we just added. 

For Each sKeyProtectorID In aKeyProtectorIDs

If sKeyProtectorID <> sNewKeyProtectorID Then 
nRC = objVolume.DeleteKeyProtector(sKeyProtectorID)

If nRC <> 0 Then 
WScript.Echo "FAILURE: DeleteKeyProtector on ID " & sKeyProtectorID & " failed with return code 0x" & Hex(nRC) 
WScript.Quit -1 
Else 
' no output 
'WScript.Echo "SUCCESS: Key protector with ID " & sKeyProtectorID & " deleted" 
End If 
End If

Next

WScript.Echo "A new recovery password has been added. Old passwords have been removed."

' - some advanced output (hidden) 
'WScript.Echo "" 
'WScript.Echo "Type ""manage-bde -protectors -get " & strDriveLetter & " -type recoverypassword"" to view existing passwords."

' -------------------------------------------------------------------------------- 
' Usage 
' --------------------------------------------------------------------------------

Sub ShowUsage 
   Wscript.Echo "USAGE: GetBitLockerKeyPackageAD [Path To Saved Key Package] [Optional Computer Name]" 
   Wscript.Echo "If no computer name is specified, the local computer is assumed." 
   Wscript.Echo 
   Wscript.Echo "Example: GetBitLockerKeyPackageAD E:\bitlocker-ad-key-package mycomputer" 
   WScript.Quit 
End Sub

' -------------------------------------------------------------------------------- 
' Parse Arguments 
' --------------------------------------------------------------------------------

Set args = WScript.Arguments

Select Case args.Count 
  Case 1 
    If args(0) = "/?" Or args(0) = "-?" Then 
    ShowUsage 
    Else 
      strFilePath = args(0) 
      ' Get the name of the local computer 
      Set objNetwork = CreateObject("WScript.Network") 
      strComputerName = objNetwork.ComputerName 
    End If    
      
  Case 2 
    If args(0) = "/?" Or args(0) = "-?" Then 
      ShowUsage 
    Else 
      strFilePath = args(0) 
      strComputerName = args(1) 
    End If 
  Case Else 
    ShowUsage

End Select



' -------------------------------------------------------------------------------- 
' Get path to Active Directory computer object associated with the computer name 
' --------------------------------------------------------------------------------

Function GetStrPathToComputer(strComputerName) 

    ' Uses the global catalog to find the computer in the forest 
    ' Search also includes deleted computers in the tombstone

    Set objRootLDAP = GetObject("LDAP://rootDSE") 
    namingContext = objRootLDAP.Get("defaultNamingContext") ' e.g. string dc=fabrikam,dc=com    

    strBase = "<GC://" & namingContext & ">"
 
    Set objConnection = CreateObject("ADODB.Connection") 
    Set objCommand = CreateObject("ADODB.Command") 
    objConnection.Provider = "ADsDSOOBject" 
    objConnection.Open "Active Directory Provider" 
    Set objCommand.ActiveConnection = objConnection 

    strFilter = "(&(objectCategory=Computer)(cn=" &  strComputerName & "))" 
    strQuery = strBase & ";" & strFilter  & ";distinguishedName;subtree" 

    objCommand.CommandText = strQuery 
    objCommand.Properties("Page Size") = 100 
    objCommand.Properties("Timeout") = 100 
    objCommand.Properties("Cache Results") = False 

    ' Enumerate all objects found. 

    Set objRecordSet = objCommand.Execute 
    If objRecordSet.EOF Then 
      WScript.echo "The computer name '" &  strComputerName & "' cannot be found." 
      WScript.Quit 1 
    End If

    ' Found object matching name

    Do Until objRecordSet.EOF 
      dnFound = objRecordSet.Fields("distinguishedName") 
      GetStrPathToComputer = "LDAP://" & dnFound 
      objRecordSet.MoveNext 
    Loop 


    ' Clean up. 
    Set objConnection = Nothing 
    Set objCommand = Nothing 
    Set objRecordSet = Nothing 

End Function


' -------------------------------------------------------------------------------- 
' Securely access the Active Directory computer object using Kerberos 
' --------------------------------------------------------------------------------


Set objDSO = GetObject("LDAP:") 
strPathToComputer = GetStrPathToComputer(strComputerName)

WScript.Echo "Accessing object: " + strPathToComputer

Const ADS_SECURE_AUTHENTICATION = 1 
Const ADS_USE_SEALING = 64 '0x40 
Const ADS_USE_SIGNING = 128 '0x80


' -------------------------------------------------------------------------------- 
' Get all BitLocker recovery information from the Active Directory computer object 
' --------------------------------------------------------------------------------

' Get all the recovery information child objects of the computer object

Set objFveInfos = objDSO.OpenDSObject(strPathToComputer, vbNullString, vbNullString, _ 
                                   ADS_SECURE_AUTHENTICATION + ADS_USE_SEALING + ADS_USE_SIGNING)

objFveInfos.Filter = Array("msFVE-RecoveryInformation")

' Iterate through each recovery information object and saves any existing key packages

nCount = 1 
strFilePathCurrent = strFilePath & nCount

For Each objFveInfo in objFveInfos

   strName = objFveInfo.Get("name")

   strRecoveryPassword = objFveInfo.Get("msFVE-RecoveryPassword") 
   strKeyPackage = objFveInfo.Get("msFVE-KeyPackage")

   WScript.echo 
   WScript.echo "Recovery Object Name: " + strName 
   WScript.echo "Recovery Password: " + strRecoveryPassword

   ' Validate file path 
   Set fso = CreateObject("Scripting.FileSystemObject")

   If (fso.FileExists(strFilePathCurrent)) Then 
 WScript.Echo "The file " & strFilePathCurrent & " already exists. Please use a different path." 
 WScript.Quit -1 
   End If

   ' Save binary data to the file 
   SaveBinaryDataText strFilePathCurrent, strKeyPackage
   
   WScript.echo "Related key package successfully saved to " + strFilePathCurrent


   ' Update next file path using base name 
   nCount = nCount + 1 
   strFilePathCurrent = strFilePath & nCount

Next


'---------------------------------------------------------------------------------------- 
' Utility functions to save binary data 
'----------------------------------------------------------------------------------------

Function SaveBinaryDataText(FileName, ByteArray) 
  'Create FileSystemObject object 
  Dim FS: Set FS = CreateObject("Scripting.FileSystemObject")
  
  'Create text stream object 
  Dim TextStream 
  Set TextStream = FS.CreateTextFile(FileName)
  
  'Convert binary data To text And write them To the file 
  TextStream.Write BinaryToString(ByteArray) 
End Function

Function BinaryToString(Binary) 
  Dim I, S 
  For I = 1 To LenB(Binary) 
    S = S & Chr(AscB(MidB(Binary, I, 1))) 
  Next 
  BinaryToString = S 
End Function

WScript.Quit

Mit dem folgenden Beispielskript wird ein neues Schlüsselpaket aus einem entsperrten, verschlüsselten Volume exportiert.

Sie können das Skript ausführen, indem Sie zunächst den Code in einer VBS-Datei speichern (ein Beispiel: GetBitLockerKeyPackage.vbs). Öffnen Sie dann eine Administratoreingabeaufforderung, und verwenden Sie "cscript" zum Ausführen der gespeicherten Datei (geben Sie z. B. Folgendes ein: "cscript GetBitLockerKeyPackage.vbs  -?").



' -------------------------------------------------------------------------------- 
' Usage 
' --------------------------------------------------------------------------------

Sub ShowUsage 
   Wscript.Echo "USAGE: GetBitLockerKeyPackage [VolumeLetter/DriveLetter:] [Path To Saved Key Package]" 
   Wscript.Echo 
   Wscript.Echo "Example: GetBitLockerKeyPackage C: E:\bitlocker-backup-key-package" 
   WScript.Quit 
End Sub

' -------------------------------------------------------------------------------- 
' Parse Arguments 
' --------------------------------------------------------------------------------

Set args = WScript.Arguments

Select Case args.Count 
  Case 2 
    If args(0) = "/?" Or args(0) = "-?" Then 
      ShowUsage 
    Else 
      strDriveLetter = args(0) 
      strFilePath = args(1) 
    End If 
  Case Else 
    ShowUsage

End Select

' -------------------------------------------------------------------------------- 
' Other Inputs 
' --------------------------------------------------------------------------------

' Target computer name 
' Use "." to connect to the local computer 
strComputerName = "." 

' Default key protector ID to use. Specify "" to let the script choose.

strDefaultKeyProtectorID = ""

' strDefaultKeyProtectorID = "{001298E0-870E-4BA0-A2FF-FC74758D5720}"  ' sample 


' -------------------------------------------------------------------------------- 
' Connect to the BitLocker WMI provider class 
' --------------------------------------------------------------------------------

strConnectionStr = "winmgmts:" _ 
                 & "{impersonationLevel=impersonate,authenticationLevel=pktPrivacy}!\\" _ 
                 & strComputerName _ 
                 & "\root\cimv2\Security\MicrosoftVolumeEncryption"
                 
                 
On Error Resume Next 'handle permission errors

Set objWMIService = GetObject(strConnectionStr)


If Err.Number <> 0 Then 
     WScript.Echo "Failed to connect to the BitLocker interface (Error 0x" & Hex(Err.Number) & ")." 
     Wscript.Echo "Ensure that you are running with administrative privileges." 
     WScript.Quit -1 
End If

On Error GoTo 0

strQuery = "Select * from Win32_EncryptableVolume where DriveLetter='" & strDriveLetter & "'" 
Set colTargetVolumes = objWMIService.ExecQuery(strQuery)


If colTargetVolumes.Count = 0 Then 
    WScript.Echo "FAILURE: Unable to find BitLocker-capable drive " &  strDriveLetter & " on computer " & strComputerName & "." 
    WScript.Quit -1 
End If


' there should only be one volume found 
For Each objFoundVolume in colTargetVolumes 
    set objVolume = objFoundVolume 
Next


' objVolume is now our found BitLocker-capable disk volume


' -------------------------------------------------------------------------------- 
' Perform BitLocker WMI provider functionality 
' --------------------------------------------------------------------------------


' Collect all possible valid key protector ID's that can be used to get the package 
' ----------------------------------------------------------------------------------

nNumericalKeyProtectorType = 3 ' type associated with "Numerical Password" protector

nRC = objVolume.GetKeyProtectors(nNumericalKeyProtectorType, aNumericalKeyProtectorIDs) 
If nRC <> 0 Then 
WScript.Echo "FAILURE: GetKeyProtectors failed with return code 0x" & Hex(nRC) 
WScript.Quit -1 
End If

nExternalKeyProtectorType = 2 ' type associated with "External Key" protector

nRC = objVolume.GetKeyProtectors(nExternalKeyProtectorType, aExternalKeyProtectorIDs) 
If nRC <> 0 Then 
WScript.Echo "FAILURE: GetKeyProtectors failed with return code 0x" & Hex(nRC) 
WScript.Quit -1 
End If


' Get first key protector of the type "Numerical Password" or "External Key", if any 
' ----------------------------------------------------------------------------------

if strDefaultKeyProtectorID = "" Then

' Save first numerical password, if exists 
If UBound(aNumericalKeyProtectorIDs) <> -1 Then 
strDefaultKeyProtectorID = aNumericalKeyProtectorIDs(0) 
End If

' No numerical passwords exist, save the first external key 
If strDefaultKeyProtectorID = "" and UBound(aExternalKeyProtectorIDs) <> -1 Then 
strDefaultKeyProtectorID = aExternalKeyProtectorIDs(0) 
End If 

' Fail case: no recovery key protectors exist. 
If strDefaultKeyProtectorID = "" Then 
WScript.Echo "FAILURE: Cannot create backup key package because no recovery passwords or recovery keys exist. Check that BitLocker protection is on for this drive." 
WScript.Echo "For help adding recovery passwords or recovery keys, type ""manage-bde -protectors -add -?""." 
WScript.Quit -1 
End If

End If

' Get some information about the chosen key protector ID 
' ----------------------------------------------------------------------------------

' is the type valid?

nRC = objVolume.GetKeyProtectorType(strDefaultKeyProtectorID, nDefaultKeyProtectorType)

If Hex(nRC) = "80070057" Then 
WScript.Echo "The key protector ID " & strDefaultKeyProtectorID & " is not valid." 
WScript.Echo "This ID value may have been provided by the script writer." 
ElseIf nRC <> 0 Then 
WScript.Echo "FAILURE: GetKeyProtectorType failed with return code 0x" & Hex(nRC) 
WScript.Quit -1 
End If

' what's a string that can be used to describe it?

strDefaultKeyProtectorType = ""

Select Case nDefaultKeyProtectorType 

  Case nNumericalKeyProtectorType 
      strDefaultKeyProtectorType = "recovery password"

  Case nExternalKeyProtectorType 
      strDefaultKeyProtectorType = "recovery key"

  Case Else 
      WScript.Echo "The key protector ID " & strDefaultKeyProtectorID & " does not refer to a valid recovery password or recovery key." 
      WScript.Echo "This ID value may have been provided by the script writer."

End Select


' Save the backup key package using the chosen key protector ID 
' ----------------------------------------------------------------------------------

nRC = objVolume.GetKeyPackage(strDefaultKeyProtectorID, oKeyPackage) 
If nRC <> 0 Then 
WScript.Echo "FAILURE: GetKeyPackage failed with return code 0x" & Hex(nRC) 
WScript.Quit -1 
End If

' Validate file path 
Set fso = CreateObject("Scripting.FileSystemObject") 
If (fso.FileExists(strFilePath)) Then 
WScript.Echo "The file " & strFilePath & " already exists. Please use a different path." 
WScript.Quit -1 
End If

Dim oKeyPackageByte, bKeyPackage 
For Each oKeyPackageByte in oKeyPackage 
  'WScript.echo "key package byte: " & oKeyPackageByte 
  bKeyPackage = bKeyPackage & ChrB(oKeyPackageByte) 
Next

' Save binary data to the file 
SaveBinaryDataText strFilePath, bKeyPackage

' Display helpful information 
' ----------------------------------------------------------------------------------

WScript.Echo "The backup key package has been saved to " & strFilePath & "."

WScript.Echo "IMPORTANT: To use this key package, the " & strDefaultKeyProtectorType & " must also be saved."

' Display the recovery password or a note about saving the recovery key file

If nDefaultKeyProtectorType = nNumericalKeyProtectorType Then

nRC = objVolume.GetKeyProtectorNumericalPassword(strDefaultKeyProtectorID, sNumericalPassword) 
If nRC <> 0 Then 
WScript.Echo "FAILURE: GetKeyProtectorNumericalPassword failed with return code 0x" & Hex(nRC) 
WScript.Quit -1 
End If 
WScript.Echo "Save this recovery password: " & sNumericalPassword

ElseIf nDefaultKeyProtectorType = nExternalKeyProtectorType Then 
WScript.Echo "The saved key file is named " & strDefaultKeyProtectorID & ".BEK" 
WScript.Echo "For help re-saving this external key file, type ""manage-bde -protectors -get -?""" 
End If


'---------------------------------------------------------------------------------------- 
' Utility functions to save binary data 
'----------------------------------------------------------------------------------------

Function SaveBinaryDataText(FileName, ByteArray) 
  'Create FileSystemObject object 
  Dim FS: Set FS = CreateObject("Scripting.FileSystemObject")
  
  'Create text stream object 
  Dim TextStream 
  Set TextStream = FS.CreateTextFile(FileName)
  
  'Convert binary data To text And write them To the file 
  TextStream.Write BinaryToString(ByteArray) 
End Function

Function BinaryToString(Binary) 
  Dim I, S 
  For I = 1 To LenB(Binary) 
    S = S & Chr(AscB(MidB(Binary, I, 1))) 
  Next 
  BinaryToString = S 
End Function

<?xml version="1.0" encoding="UTF-8"?> 
<!-- 
This page is a backup of TPM (Trusted Platform Module) owner 
authorization information. Upon request, use the authorization information to 
prove ownership of the computer's TPM. 
Please keep this file in a secure location away from your computer's local hard drive. 
--> 
<tpmOwnerData version="1.0" softwareAuthor="Microsoft Windows [Version 6.0.5461]" creationDate="2006-07-09T17:41:27-08:00" creationUser="DOMAIN\employee" machineName="EMPLOYEE-PC"> 
<tpmInfo manufacturerId="1112687437"/> 
<ownerAuth>FNVWzNOmxCtHeLWDYeRobK85VDg=</ownerAuth> 
</tpmOwnerData>