Bitlocker Status into SCCM Task Sequence Variable

jasonross3971 · 2016-07-15T19:19:59.000Z

I have a PowerShell script that will create 3 SCCM 2012 Task Sequence variables to check if TPM is Owned, TPM isActive, and if Bitlocker is on. This is the script:

# create the SCCM tasksequence object
$tsenv = New-Object -COMObject Microsoft.SMS.TSEnvironment

############# Define variables ################

# Query the wmi of the computer for the status of the TPM chip
if ((Get-WmiObject -class Win32_Tpm -namespace "root\CIMV2\Security\MicrosoftTpm").IsOwned_InitialValue){
	$tsenv.Value("TPMIsOwned")="True"
}
if ((Get-WmiObject -class Win32_Tpm -namespace "root\CIMV2\Security\MicrosoftTpm").IsActivated_InitialValue){
	$tsenv.Value("TPMIsActive")="True"
}
if (((Get-WmiObject -Namespace "root\CIMV2\Security\MicrosoftVolumeEncryption" -Class Win32_EncryptableVolume).GetProtectionStatus().ProtectionStatus) = 1){
	$tsenv.Value("IsBitLockerOn")="True"
}

If BitLocker is enabled, the variable IsBitlocker on will return true. I tried to use this same script on a Task Sequence for Windows 10 and it did not work properly. When I looked at the smsts.log file. I saw this error message:

The property 'ProtectionStatus' cannot be found on this object. Verify that the property exists and can be set.	InstallSoftware	7/15/2016 10:55:09 AM	1524 (0x05F4)
At C:\_SMSTaskSequence\Packages\P01007DE\setTaskSequenceVariables.ps1:13 char:5	InstallSoftware	7/15/2016 10:55:09 AM	1524 (0x05F4)
+ if (((Get-WmiObject -Namespace "root\CIMV2\Security\MicrosoftVolumeEn ...	InstallSoftware	7/15/2016 10:55:09 AM	1524 (0x05F4)
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~	InstallSoftware	7/15/2016 10:55:09 AM	1524 (0x05F4)
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException	InstallSoftware	7/15/2016 10:55:09 AM	1524 (0x05F4)
    + FullyQualifiedErrorId : PropertyAssignmentException	InstallSoftware	7/15/2016 10:55:09 AM	1524 (0x05F4)

I cannot find anything syntax wise that seems to be wrong. Does anyone have any suggestions to fix this or is there another way to do this besides querying WMI for the BitLocker status. Thank You for your help.

Neally · 2016-07-15T19:26:41.000Z

I don’t know if others can, but I can not read that error at all.

Can you just post the error as text?

jasonross3971 · 2016-07-15T19:28:59.000Z

I saw that. I just reposted it as text.

Neally · 2016-07-15T19:39:17.000Z

Looks like you put a “GetProtectionStatus()” in?

Yours:

if(((Get-WmiObject -Namespace "root\CIMV2\Security\MicrosoftVolumeEncryption" 
-Class Win32_EncryptableVolume).**GetProtectionStatus()**.ProtectionStatus) = 1){
# something
}

Should be:

if((Get-WmiObject -Namespace "root\CIMV2\Security\MicrosoftVolumeEncryption" 
-Class Win32_EncryptableVolume).protectionstatus = 1){

# something

}

EDIT:
No hm never-mind it seems to work with both versions.
I’d get to the machine and investigate, run the stuff manually and try to ‘get-member’ and see if that property is there on that machine. ¯_(ツ)_/¯

Get-WmiObject -ComputerName $ComputerThatGivesYouTheError 
-Namespace "root\CIMV2\Security\MicrosoftVolumeEncryption" 
-Class Win32_EncryptableVolume | Get-Member

It could be that there is not even that namespace or object.

britv8 · 2016-07-15T22:05:08.000Z

this thread help?

Bitlocker status on all computers. Programming & Development

I am trying to write a Powershell script that will check all computers for Bitlocker and if it is enabled.

also

learn.microsoft.com

TrustedPlatformModule Module

Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.

jasonross3971 · 2016-07-22T10:29:10.000Z

I ended up putting an else statement in the script that would write false in the variable instead of not creating it. That seemed to make the script work better.

jijochacko · 2016-10-24T23:39:22.000Z

<#
.SYNOPSIS
Retrieves Bitlocker Encryption information during OSD Task sequence execution.
.DESCRIPTION
Retrieves Bitlocker Encryption information of C:\ and save it to SMS TS variable called BitlockerStatus.
.COMMAND LINE EXECUTION THROUGH SCCM :-
%SYSTEMROOT%\SYSTEM32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy ByPass -File BitlockerStatus.ps1
.CREATED BY
Jijo Chacko
#>
Try
{
$TSEnv = New-Object -ComObject Microsoft.SMS.TSEnvironment
$BitlockerStatus = Get-WmiObject -Namespace ROOT\CIMV2\Security\Microsoftvolumeencryption -Class Win32_encryptablevolume -Authentication PacketPrivacy -Filter “DriveLetter = ‘c:’”

switch ($BitlockerStatus.GetProtectionStatus().protectionStatus){

(“0”){$Status = “Unprotected”}

(“1”){$Status = “Protected”}

(“2”){$Status = “Uknown”}

default {$Status = “NoReturn”}
}
$TSEnv.Value(‘BitlockerStatus’) = $Status

}
Catch
{
Write-Output “Error: $($_.Exception.Message)”
}

ericchaigne · 2017-04-14T10:53:24.000Z

Hi,

if(((Get-WmiObject -Namespace “root\CIMV2\Security\MicrosoftVolumeEncryption”
-Class Win32_EncryptableVolume).GetProtectionStatus().ProtectionStatus) = 1){

something

}

should be

if(((Get-WmiObject -Namespace “root\CIMV2\Security\MicrosoftVolumeEncryption”
-Class Win32_EncryptableVolume).GetProtectionStatus().ProtectionStatus) -eq 1){

something

}