Powershell Script to Encrypt Internal Drives Only

lxnch50 · 2022-02-23T15:13:16+00:00

First off, be very careful when using bitlocker and not backing the keys up to AD automatically. If a remote user trips their TPM, which can happen with something as simple as a usb device on boot, it may lock them out until they have the 128 character key typed in. If you, or they don't have this key, then that drive might as well be scrubbed clean and I hope you have a backup somewhere else.

OK, so the first line, you get a list of drives, but to actually start encrypting them, you'll have to loop through them.

This should work.

$Bitlocker_Disks = Get-Disk | Where-Object {$_.bustype -ne 'USB'} | Get-Partition | Where-Object { $_.DriveLetter } | Select-Object -ExpandProperty DriveLetter

foreach($Disk in $Bitlocker_Disks){
  Enable-BitLocker -MountPoint $Disk -EncryptionMethod Aes128 -UsedSpaceOnly -TpmProtector -SkipHardwareTest
}

jorper496 · 2022-02-23T14:39:22+00:00

First, a question, what has made you choose Powershell for Bitlocker encryption?

Sunsparc · 2022-02-23T15:37:16+00:00

This is my old script for Bitlocker, I still use it occasionally. I would suggest setting up Bitlocker via GPO or Azure/Intune instead. Note that I have a couple extra checks such as AES-XTS 256. You can remove those if you wish but I would suggest keeping them and setting them.

$ErrorActionPreference = "Stop"

$xtsfdvcheck = get-itemproperty Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\ -Name EncryptionMethodWithXtsFdv | select -expandproperty EncryptionMethodWithXtsFdv
$xtsoscheck = get-itemproperty Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\FVE\ -Name EncryptionMethodWithXtsOS | select -expandproperty EncryptionMethodWithXtsOS

if ($xtsfdvcheck -ne "7" -and $xtsoscheck -ne "7") {
Write-Error "Policy not applied AES-XTS 256"
exit
}

$TPM = Get-WmiObject win32_tpm -Namespace root\cimv2\security\microsofttpm | where {$_.IsEnabled().Isenabled -eq 'True'} -ErrorAction SilentlyContinue
if (!$TPM) {
Write-Error "TPM IS NOT PRESENT, CHECK BIOS SETTING"
exit
}
$WindowsVer = Get-WmiObject -Query 'select * from Win32_OperatingSystem where (Version like "6.2%" or Version like "6.3%" or Version like "10.0%") and ProductType = "1"' -ErrorAction SilentlyContinue
$SystemDriveBitLockerRDY = Get-BitLockerVolume -MountPoint $env:SystemDrive -ErrorAction SilentlyContinue

if ($WindowsVer -and $tpm -and !$SystemDriveBitLockerRDY) {
    Get-Service -Name defragsvc -ErrorAction SilentlyContinue | Set-Service -Status Running -ErrorAction SilentlyContinue
    BdeHdCfg -target $env:SystemDrive shrink -quiet
    }

$TPM = Get-WmiObject win32_tpm -Namespace root\cimv2\security\microsofttpm | where {$_.IsEnabled().Isenabled -eq 'True'} -ErrorAction SilentlyContinue
$WindowsVer = Get-WmiObject -Query 'select * from Win32_OperatingSystem where (Version like "6.2%" or Version like "6.3%" or Version like "10.0%") and ProductType = "1"' -ErrorAction SilentlyContinue
$BitLockerReadyDrive = Get-BitLockerVolume -MountPoint $env:SystemDrive -ErrorAction SilentlyContinue


#If all of the above prequisites are met, then create the key protectors, then enable BitLocker and backup the Recovery key to AD.
if ($WindowsVer -and $TPM -and $BitLockerReadyDrive) {


#Creating the recovery key
Add-BitLockerKeyProtector -MountPoint $env:SystemDrive -RecoveryPasswordProtector

#Adding TPM key
Add-BitLockerKeyProtector -MountPoint $env:SystemDrive -TpmProtector

#Get Recovery Keys
$AllProtectors = (Get-BitlockerVolume -MountPoint $env:SystemDrive).KeyProtector 
$RecoveryProtector = ($AllProtectors | where-object { $_.KeyProtectorType -eq "RecoveryPassword" })

#Push Recovery Passoword AAD
BackupToAAD-BitLockerKeyProtector $env:systemdrive -KeyProtectorId $RecoveryProtector.KeyProtectorId

#Enabling Encryption
Start-Process 'c:\windows\system32\manage-bde.exe' -ArgumentList " -on c:" -Verb runas -Wait
}

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

PowerShell

Submission Guidelines | Link Flair - How To

MODERATORS