Unprotect-ShieldedVMRecoveryKey

Unprotect-ShieldedVMRecoveryKey
    -ShieldingDataFilePath <String>
    -EncryptedBitLockerKeyPath <String>
    -DecryptedBitLockerKeyPath <String>
    [-WhatIf]
    [-Confirm]

Unprotect-ShieldedVMRecoveryKey
    -ShieldingDataFileSearchPath <String[]>
    -EncryptedBitLockerKeyPath <String>
    -DecryptedBitLockerKeyPath <String>
    [-Recurse]
    [-WhatIf]
    [-Confirm]

The Unprotect-ShieldedVMRecoveryKey cmdlet decrypts an encrypted BitLocker recovery key file obtained from a Windows shielded VM. To run the cmdlet, you must have the shielding data file that was used to deploy the shielded VM and have the private key for the owner guardian installed on your computer.

The resulting recovery key can be provided to manage-bde.exe, Unlock-BitLocker, or the BitLocker Recovery pre-boot environment to access the contents of your shielded VM OS volume.

PS C:\> Unprotect-ShieldedVMRecoveryKey -ShieldingDataFilePath 'C:\temp\ShieldingDataFile.pdk' -EncryptedBitLockerKeyPath 'C:\temp\MyShieldedVMEncryptedRecoveryKey.ebek' -DecryptedBitLockerKeyPath 'C:\temp\DecryptedRecoveryKey.bek'

Decrypts the provided encrypted BitLocker recovery key using the shielding data file and owner guardian private keys, and saves it to the temp directory.

PS C:\> Unprotect-ShieldedVMRecoveryKey -ShieldingDataSearchPath 'C:\temp\AllShieldingDataFiles\' -Recurse -EncryptedBitLockerKeyPath 'C:\temp\MyShieldedVMEncryptedRecoveryKey.ebek' -DecryptedBitLockerKeyPath 'C:\temp\DecryptedRecoveryKey.bek'

Searches the 'AllShieldingDataFiles' directory and all subdirectories for shielding data files that can be used to decrypt the provided encrypted BitLocker recovery key. If a suitable shielding data file is found and the private key for its owner guardian is available on the local computer, the decrypted BitLocker encryption key will be saved to the temp directory.