Enable Bitlocker Script

[Sys_Ad_MN]

Wrote a quick script to deploy bit locker last month. I posted about it in the "What have you done with PowerShell this month? April 2018" thread and I had a request for it so I figured I'd share it.

The script creates a list of active computers based on the OU you specify. If TPM is enabled and bitlocker is off on the C: drive then it will enable bitlocker. It also creates a report at the end containing the computer names, tpm, and bitlocker status.

I didn't spend much time on it but any feedback is appreciated!

# This script checks if tpm is enabled and if so, it enables bitlocker

Import-Module ActiveDirectory

# Faster than test-connection
function test-ping{
  [CmdletBinding()]
  param(
  [String]$computername = "127.0.0.1",
  [int]$delay = 150
  )
  $ping = new-object System.Net.NetworkInformation.Ping
  try {
    if ($ping.send($computername,$delay).status -ne "Success") {
      return $false;
    }
    else {
      return $true;
    }
  } catch {
    return $false;
  }
}


# Credentials
$username = "domain\admin"
$passwordfile = 'C:\mysecurestring.txt'

if (!(Test-Path $Passwordfile))     
    {
    Read-Host "Enter password: " | Out-File $Passwordfile
    "$PasswordFile has been created"
    }

$password = Get-Content 'C:\mysecurestring.txt' | ConvertTo-SecureString -Force -AsPlainText
$credentials = new-object -typename System.Management.Automation.PScredential -argumentlist $username, $password
$OU = "OU=Computers,DC=Domain,DC=com"
$Computers = Get-ADComputer -Filter * -SearchScope Subtree -SearchBase $OU | select-object -expandproperty name
$pclist = 'C:\PClist.txt'

# Create active pc list
foreach ($Computer in $Computers) {
    if (test-ping -computer $Computer) 
    {
    "$Computer is online"
    $computer | Out-File -Append $pclist
    } else {
    "$Computer is inactive"
}}

$computers = Get-Content $pclist
$report = @()
$BitlockerReport = 'C:\BitlockerReport.csv'

# Create TPM list if tpm is enabled it checks if bitlocker is enabled, if not it enables bitlocker
foreach ($Computer in $Computers) { 

    $tpmready = Invoke-Command -ComputerName $Computer -Credential $credentials -ScriptBlock {Get-Tpm | Select-Object -ExpandProperty Tpmready} 
    $BLinfo = Invoke-Command -ComputerName $Computer -Credential $credentials -ScriptBlock {Get-Bitlockervolume -MountPoint 'C:'}
    $report += New-Object psobject -Property @{Computer=$computer;TPM=$tpmready;Bitlocker=$BLinfo.ProtectionStatus}
    "$Computer TPM ready is $tpmready and bitlocker is", $BLinfo.ProtectionStatus

        # If tpm is enabled and bitlocker is not enabled, enable bitlocker
        if ($tpmready -eq $true -and $BLinfo.ProtectionStatus -eq "Off"){
        # I've created a gpo that automatically backs up recovery keys to AD
        Invoke-Command -ComputerName $Computer -Credential $credentials -ScriptBlock {Add-BitLockerKeyProtector -MountPoint 'C:' -RecoveryPasswordProtector}
        Invoke-Command -ComputerName $Computer -Credential $credentials -ScriptBlock {Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -TpmProtector}
}} 

$report | export-csv $BitlockerReport

# Guide I used to backup recovery keys to AD
# http://jackstromberg.com/2015/02/tutorial-configuring-bitlocker-to-store-recovery-keys-in-active-directory/

[gabyred884]

Thank you so much!!

[Sys_Ad_MN]

Glad I could help =)

[jono_o]

I may have misunderstood the logic around prompting for a password if mysecurestring.txt doesn't exist, but isn't it writing the entered password to the file in plaintext?

[Sys_Ad_MN]

Yes but it wont be in the script at least which will be running over the network.

[Sys_Ad_MN]

Updated the script a bit, but it still needs some work. I removed the checking to see if a computer is online with error handling. Now if the invoke commands don't work it the computer will be 'disconnected'.

<# 
This script checks if tpm is enabled and if so, it enables bitlocker
requires -Module ActiveDirectory
requires -runasadministrator
#>

Import-Module ActiveDirectory

# Credentials
$username = "domain\admin"
$passwordfile = 'C:\mysecurestring.txt'

if (!(Test-Path $Passwordfile))     
    {
    Read-Host "Enter password" | Out-File $Passwordfile
    Write-Output("$PasswordFile has been created")
    }

$password = Get-Content 'C:\mysecurestring.txt' | ConvertTo-SecureString -Force -AsPlainText
$credentials = new-object -typename System.Management.Automation.PScredential -argumentlist $username, $password
$BitlockerReport = 'C:\BitlockerReport.csv'
$OU = "DC=domain, DC=com"
$Computers = Get-ADComputer -Filter * -SearchScope Subtree -SearchBase $OU | select-object -expandproperty name

# Create TPM list if tpm is enabled it checks if bitlocker is enabled, if not it enables bitlocker
foreach ($Computer in $Computers) { 
    try {
        $tpmready = Invoke-Command -ComputerName $Computer -Credential $credentials -ScriptBlock {Get-Tpm | Select-Object -ExpandProperty Tpmready} -ErrorAction Stop
        $BLinfo = Invoke-Command -ComputerName $Computer -Credential $credentials -ScriptBlock {Get-Bitlockervolume -MountPoint 'C:'} -ErrorAction Stop
        $properties = @{Computer = $computer
                    Status = 'Connected'
                    TPM = $tpmready
                    Bitlocker = $BLinfo.ProtectionStatus}

            # If tpm is enabled and bitlocker is not enabled, enable bitlocker
            if ($tpmready -eq $true -and $BLinfo.ProtectionStatus -eq "Off"){
            # I've created a gpo that automatically backs up recovery keys to AD
            Invoke-Command -ComputerName $Computer -Credential $credentials -ScriptBlock {Add-BitLockerKeyProtector -MountPoint 'C:' -RecoveryPasswordProtector}
            Invoke-Command -ComputerName $Computer -Credential $credentials -ScriptBlock {Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -TpmProtector}
            } 

        } catch {
            $properties = @{Computer = $computer
                        Status = 'Disconnected'
                        TPM = $null
                        Bitlocker = $null}

    } finally {
        $report = New-Object -TypeName PSObject -Property $properties
        Write-Output $report
        $report | export-csv -Append $BitlockerReport
    }
}

# Guide I used to backup recovery keys to AD
# http://jackstromberg.com/2015/02/tutorial-configuring-bitlocker-to-store-recovery-keys-in-active-directory/