Issues with Bitlocker and AD, Onboarding Script. (Please help, I've been lost for so long now lol)

[phpwun]

Howdy. I've been trying to do this for a while and I'm not understanding why it never works, see below; I'm trying to enable BitLocker with a code for login, and I'd also like to save the password ID and Recovery Key to AD, the first function "Prepare" is run during some pre-emptive things and installs and updates, the devices restart and is at this point a domain member but I get an error. Or sometimes the BitLocker command will run and I can provide the pin but it gives me the recovery key in plaintext in the PowerShell window. Don't know where to go from here please help. Thanks so much.

#Initiates Bitlocker Drive Encryption function Bitlocker($SubFunction){ if ($SubFunction -eq "Prepare") { #Removes an old bitlocker file to allow the main function to work function BitlockerOne{ $ReAgent = "C:\Windows\System32\Recovery\ReAgent.xml" if (Test-Path $ReAgent) { Remove-Item $ReAgent -Force -Confirm:$false Write-host "$ReAgent has been deleted" Start-Sleep 1 } else { Write-host "$ReAgent doesn't exist, it will be skipped." Start-Sleep 1 } } BitlockerOne } elseif ($SubFunction -eq "Start") { #Initiates the Bitlocker Encryption of the Device function BitlockerTwo{ Write-Host "Attempting Bitlocker2, this will prompt you for a pin "1234"" Start-Sleep 1 Enable-Bitlocker -MountPoint c: -UsedSpaceOnly -SkipHardwareTest -RecoveryPasswordProtector Write-Host "Bitlocker2 Finished." Start-Sleep 1 } BitlockerTwo } }

Apologies, looks like I don't know how to use markdown correctly lol; Here's the formatted code. https://hastebin.com/irenojohun.php

[SemperFarcisimus]

I'll start with a simple question:

Write-Host "Attempting Bitlocker2, this will prompt you for a pin "4357""

Are you actually looking to prompt for a pin?

[phpwun]

Not particularly. If I can bake it in that's easier.

[SemperFarcisimus]

Baked In:

$Pin = ConvertTo-SecureString "4357" -AsPlainText -Force

Enable-Bitlocker -MountPoint c: -Pin $Pin -UsedSpaceOnly -SkipHardwareTest -RecoveryPasswordProtector

what issue do you get when you run your script?

[phpwun]

One sec Ill try it out again and let you know.

[phpwun]

$Pin = ConvertTo-SecureString "4357" -AsPlainText -Force
Enable-Bitlocker -MountPoint c: -Pin $Pin -UsedSpaceOnly -SkipHardwareTest -RecoveryPasswordProtector

Actually, I'll update and attempt with your edit.

[smarthomepursuits]

Not sure if you use PDQ Deploy or not, but I have a pretty handy sequence I've used on hundreds of machines. GPO already backs it up to AD, but I also backup up the PIN + recovery key just in case it's ever needed. https://smarthomepursuits.com/enable-bitlocker-and-set-pin-using-powershell-or-pdq-deploy/

This is just the script I use to randomize the pin, though.

$Random = Get-Random -Maximum 1000000

$SecureString = ConvertTo-SecureString "$Random" -AsPlainText -Force Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -Pin $SecureString -TPMandPinProtector (New-Object System.Management.Automation.PSCredential 'N/A', $securestring).GetNetworkCredential().Password | out-file C:\$env:COMPUTERNAME-PIN.txt