> For the complete documentation index, see [llms.txt](https://docs.lithnet.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lithnet.io/ams/v2.0/configuration/importing/importing-bitlocker-permissions.md). # Importing BitLocker permissions from Active Directory If you have delegated permissions to read BitLocker recovery passwords in your environment, you can search your directory for users and groups with existing permissions to read the BitLocker attributes, and convert those permissions to Access Manager authorization rules. ## Open the import wizard Using the Lithnet Access Manager Configuration Tool, navigate to the `Authorization rules/Computers` page, and click `Import authorization rules...` ![](https://2384577883-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGiL0iwWnyPOkaGqdhRTp%2Fuploads%2Fgit-blob-c44cf2f774f3d1e9b18bd0c49627d517e3db6847%2Fui-page-authorization-rules-computers.png?alt=media) ## Select the import type Select the BitLocker import type, and click `Next` ![](https://2384577883-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGiL0iwWnyPOkaGqdhRTp%2Fuploads%2Fgit-blob-ead7516119b81fc41ba63a31c5590f14b19ec9e0%2Fui-page-import-type-bitlocker.png?alt=media) ## Specify discovery settings ![](https://2384577883-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGiL0iwWnyPOkaGqdhRTp%2Fuploads%2Fgit-blob-feee7cfeda5fc43bc8806f3a0136ce28f9104d3f%2Fui-page-import-container.png?alt=media) First, select the container that holds the computers that you want to import the permissions from. Access Manager will evaluate the ACLs on each computer object found in this section of the directory tree, looking for users and groups that have `read` and `control access` permissions on the `msFVE-RecoveryPassword` attribute When Access Manager finds that a user or group has permission on all computers with an OU, it will create a single access rule at the OU level for that user or group. You can disable this behavior by checking the `Do not consolidate permissions at the OU level` check box. Access Manager will then make an individual authorization rule for every computer that is found. If there are users and groups that you do not want to import permissions for, add them to the list. The Access Manager service account is automatically pre-added to this list. You can also choose to ignore certain computers from the import process. For the purposes of permission consolidation, these computers will be treated as if they do not exist at all. ## Specify rule settings On this page, you can specify the settings for the newly created authorization rules. Choose the permissions you want to assign to the discovered users, and any notifications channels that should apply. ![](https://2384577883-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGiL0iwWnyPOkaGqdhRTp%2Fuploads%2Fgit-blob-b5afe4df5e700dbf9fa8d64ab35f843d25210d94%2Fui-page-import-rulesettings.png?alt=media) ## Review discovery results Once the discovery process has completed, you can review the proposed rules before committing them to the authorization store. ![](https://2384577883-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FGiL0iwWnyPOkaGqdhRTp%2Fuploads%2Fgit-blob-67767d2aa980e0ff2034299ef328340030e1aa81%2Fui-page-import-results.png?alt=media) ### Merge settings When a new rule is discovered for a target (computer, group or container) that matches the target of an existing rule, Access Manager will just add the new permissions to the existing rule, rather than create a new rule. You can control this behavior with by unselecting the corresponding checkbox. When merging rules, settings from the *existing rule* are retained when a conflict is found. For example, if an existing rule is configured to expire LAPS passwords after one hour, and the new rule is configured to expire them after two hours, then the settings from the existing rule are retained. You can alter this behavior by selecting the appropriate checkbox. ### Discovery issues If any issues are found during the discovery process, a `Discovery issues` section is shown. You can export this list to a CSV file and review the issues before proceeding with the import. ### Discovered rules The `discovered rules` section shows the proposed rules that Access Manager will create. You can add, edit and delete these rules before finalizing the import. The `effective access` tool can be used to test the proposed rules, and ensure the right users have access to the computers you expect. ### Complete the import When you have completed your review, and are happy with the proposed rules, click `Import` to merge them into the authorization store. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.lithnet.io/ams/v2.0/configuration/importing/importing-bitlocker-permissions.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.