1

Hi All,

Our computers are BitLocker enabled and the information is stored in AD computer objects. BitLocker viewer is enabled.

I would like to retrieve a report from a certain OU which shows which computer is BitLocker enabled. I don’t really need to retrieve the password information.

This report is for security audit purpose. It should show if all computers in the computers OU are encrypted.

I think best is to extract the information using Windows Powerhell.

Does anybody have such a script handy?

Thanks,

Edy

4 Spice ups
2

I believe Martin9700 posted a ncie script for exactly this a little while ago: Bitlocker status on all computers.

1 Spice up
3

LOL, yep, I was just about to post it again. Good memory!

4

Hi Martin,

Thanks - I’m trying this script. I guess that I need to amend this only

OU=YourOUforWorkstations,DC=Your,DC=Domain"

Could you please make an example for me?

OU=Europe/Computer,DC=domain,DC=com"

Thanks,

Edy

5

Could you clarify your question? You’ve already provided two examples of an FQDN in your question! Are you asking me what the FQDN for YOUR workstations is? Or how to get it?

6

You could try this to find the FQDN:

Get-ADOrganizationalUnit -Filter {name -like "*workstations*"} | Select distinguishedname

or

https://community.spiceworks.com/scripts/show/1635-copy-a-ou-s-fqdn-to-clipboard

7

Sorry please make me an example of a FQDN?

Our computer OU is grouped by regions. I’m getting a ADC Computer - directory not found error.

Thanks,

Edy

8

You supplied two examples of an FQDN. I am unfamiliar with your environment so cannot give you YOUR FQDN. Are you the only IT person? Is there an administrator you could talk to to give you the information?

9

Hi Martin,

I figured it out. It works great now. I already have the report.

Thank you very much for supplying this script to the community!

Edy

1 Spice up
10

Just remember that just because there is a recovery object present for the computer in AD, this doesn’t mean that the machine is encrypted. An admin could easily disable or pause Bitlocker after the recovery object was saved to the computer account.