Powershell to pull BitLocker Encryption status

ginger6412 · 2015-07-21T17:20:55.000Z

I found two scripts to get BitLocker Encryption status but my challenging are

enable PSremoting on all laptops --best way is via GPO or any other way to do it?
I want to run this on a few hundreds laptops so I don’t want to manually enter my credentials

Function Get-OSCBitlockerStatus
{	
	param
	(
	[Parameter(Mandatory = $False, Position = 0)]
	[String[]]$ComputerName,
	[Parameter(Mandatory = $False, Position = 1)]
	[String]$FilePath,
	[Parameter(Mandatory = $False, Position = 2)]
	[system.Management.Automation.PSCredential]$Credential
	)
	
	If($ComputerName)
	{
		Foreach($CN in $ComputerName)
		{
				GetStatus -ComputerName $CN
		}
	}
	ElseIf($FilePath)
	{
		#Get content from the file 
		If(Test-Path -Path $FilePath)
		{
			$CNCol = Get-Content -Path $FilePath
			Foreach($CN in $CNCol)
			{
					GetStatus -ComputerName $CN
			}
		}
		Else
		{
			Write-Error "Find the specified file.please try again."
		}
	}
	Else
	{	
		
		Try
		{
			manage-bde -cn $Env:COMPUTERNAME -status  | select -Skip 2
		}
		Catch
		{
			Write-Error "Check if Bitlocker Drive Encryption is enabled."
		}
	}
	
}

Function GetStatus($ComputerName)
{
	#Script block
	$Scope = { manage-bde -cn $Env:COMPUTERNAME -status }
	Try
	{
		#Invoke command to remoted computer
		$Obj = Invoke-Command -ComputerName $ComputerName -Credential $Credential dc1\tester -ScriptBlock $Scope
		$Obj | select -First ($Obj.length-1) | select -Skip 3
	}
	Catch 
	{
	 Write-Error $_ 
	}
	Write-Host 
}

then I run this in powershell console:

Get-OSCBitlockerStatus -FilePath “C:\computers.txt” -Credential $cre

mattmcnabb · 2015-07-21T17:41:09.000Z

enable PSremoting on all laptops --best way is via GPO or any other way to do it?

If you are dealing with domain computer, then yes, GPO is the way to go

I want to run this on a few hundreds laptops so I don’t want to manually enter my credentials

Change this:

[system.Management.Automation.PSCredential]$Credential

to this:

[system.Management.Automation.CredentialAttribute()]$Credential

Also, your invoke-command line has a typo:

$Obj = Invoke-Command -ComputerName $ComputerName -Credential $Credential -ScriptBlock $Scope

So all that aside, manage-bde has a -cn parameter for remote computers, so Invoke-Command may not be necessary.

ginger6412 · 2015-07-21T19:08:27.000Z

thank you for the reply. Actually I found this two scripts . I have to run twice of these two scripts.

I want to export the result to a spread sheet.

I will try the changes.

ginger6412 · 2015-07-23T20:57:37.000Z

Hi, All:

Is it possible to have powershell to show the Bitlocker Recovery detail?

Mgmt would like is to have a weekly/monthly report on all the laptops and their bitlocker recovery detail sent to our help desk. That way we can make sure which laptop is missing the bitlocker or recovery password information in AD.

I found this script , looks working but only for one PC, not for multiple remote PCs.

[cmdletBinding()]
Param(
    [Parameter(Mandatory=$false,ValueFromPipeLine=$false)]
    [ValidateSet("Alltypes","TPM","ExternalKey","NumericPassword","TPMAndPin","TPMAndStartUpdKey","TPMAndPinAndStartUpKey","PublicKey","PassPhrase","TpmCertificate","SID")]
    $KeyProtectorType
)
     
    $BitLocker = Get-WmiObject -Namespace "Root\cimv2\Security\MicrosoftVolumeEncryption" -Class "Win32_EncryptableVolume"
 
     
 
 switch ($KeyProtectorType){
    ("Alltypes") {$Value = "0"}
    ("TPM") {$Value = "1"}
    ("ExternalKey") {$Value = "2"}
    ("NumericPassword") {$Value = "3"}
    ("TPMAndPin") {$Value = "4"}
    ("TPMAndStartUpdKey") {$Value = "5"}
    ("TPMAndPinAndStartUpKey") {$Value = "6"}
    ("PublicKey") {$Value = "7"}
    ("PassPhrase") {$Value = "8"}
    ("TpmCertificate") {$Value = "9"}
    ("SID") {$Value = "10"}
    default {$Value = "0"}
 
}
    $Ids = $BitLocker.GetKeyProtectors($Value).volumekeyprotectorID
    return $ids
  }