TPM / Bitlocker Report

[angus]

Hi All,

Need some assistance, have a requirement for a SW report that will do the following

1. Detect if machine has bitlocker enabled or not
2. Detect if machine has built in TPM chip (regardless if enabled or disabled in bios)

and report the following

Bitlocker enabled and ok
Bitlocker capable but not enabled
TPM available but disabled in bios
No TPM

many thanks

[peterblosser (Pedz)]

I haven’t looked into this before, but I did have a powershell script that we ran for inventory that would grab the bitlocker status via WMI. Pretty sure I copied it from some other website when I put it together. This is the relevant part that you would need to check bitlocker status.

$ProtectionState = Get-WmiObject -ComputerName $computer.Name -Namespace ROOT\CIMV2\Security\Microsoftvolumeencryption -Class Win32_encryptablevolume -Filter “DriveLetter = ‘c:’” -ErrorAction Stop -Authentication PacketPrivacy

switch ($ProtectionState.GetProtectionStatus().protectionStatus)
{
(“0”){$protectans = “Unprotected”}
(“1”){$protectans = “Protected”}
(“2”){$protectans = “Unknown”}
default {$protectans = “NoReturn”}
}

[tomaszczyz (Cuboctahedron)]

Get-WmiObject -class Win32_Tpm -namespace root\CIMV2\Security\MicrosoftTpm -Authentication PacketPrivacy

This will give you information about TPM.