# Restrict nonadministrator users from recovering the BitLocker keys for their owned devices
When non-administrator users can access their own BitLocker keys, threat actors who compromise user credentials can gain direct access to encryption keys…
Source: https://maester.dev/docs/tests/ZTA.21954
:::note[Maester checks this too]
[CIS.M365.5.1.4.6](/docs/tests/CIS.M365.5.1.4.6) (Ensure users are restricted from recovering BitLocker keys) checks the same setting. Running both reports it twice.
:::
## Overview
When non-administrator users can access their own BitLocker keys, threat actors who compromise user credentials can gain direct access to encryption keys without requiring privilege escalation. Once attackers obtain BitLocker keys, they can decrypt sensitive data stored on the device, including cached credentials, local databases, and confidential files.
Without proper restrictions, a single compromised user account provides immediate access to all encrypted data on that device, negating the primary security benefit of disk encryption and creating a pathway for lateral movement.
## Remediation
- [Restrict non-admin users from recovering the BitLocker key(s) for their owned devices](https://learn.microsoft.com/entra/identity/devices/manage-device-identities?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#configure-device-settings)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Low |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Identity |
| Category | Access control |
| Product | [Entra ID](/docs/tests/products/entra) |
| Feature | Device identity |
| Area | Access control |
| ATT&CK | [T1552](/docs/tests?mitre=T1552) Unsecured Credentials |
| Licence | Free |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.