Standard Domain Admins have access to all keys. However, you should use Delegation of Control to allow Help Desk staff to read BitLocker keys without giving them full Domain Admin rights.
: The BitLocker Drive Encryption feature must be installed on your domain controllers to enable the necessary schema extensions and management tools. bitlocker keys in active directory