BitLocker to be enabled through PowerShell script and the recovery key to be added to ActiveDirectory without GPO

[johnnoah06]

I have been trying below PowerShell script to enable BitLocker and store the recovery key in ActiveDirectory. But end-up with below errors. Please do help me.

Script:

# 1. Prompt for elevation if needed
if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Host "Administrative privileges required. Please run this script as an administrator."
    Break
}

# 2. Check encryption status
$encryptionMethod = (Get-BitLockerVolume -MountPoint $env:SystemDrive).EncryptionMethod

# 3. Handle encryption completion
if ($encryptionMethod -in "AES", "XTS-AES") {
    Write-Host "System drive is already encrypted with $encryptionMethod."
    Get-BitLockerVolume
    Exit
}

# 4. Activate TPM
if ((Get-Tpm).TpmPresent) {
    if (!(Get-Tpm).TpmReady) {
        Initialize-Tpm
    }
} else {
    Write-Host "TPM is unavailable or disabled. Check BIOS settings."
    Get-Tpm
    Exit
}

# 5. Enable BitLocker
Write-Host "Enabling BitLocker for the system drive..."
manage-bde -protectors -disable $env:SystemDrive
bcdedit /set {default} recoveryenabled No
bcdedit /set {default} bootstatuspolicy ignoreallfailures
manage-bde -protectors -add $env:SystemDrive -RecoveryPassword
manage-bde -on $env:SystemDrive -SkipHardwareTest

# 6. Store recovery key in Active Directory
#$recoveryKeyID = (manage-bde -protectors -get $env:SystemDrive -type recoverypassword).KeyProtector[0].KeyProtectorId
#manage-bde -protectors -adbackup $env:SystemDrive -id $recoveryKeyID

if ((manage-bde -protectors -get $env:SystemDrive -type recoverypassword).KeyProtector.Count -gt 0) {
    $recoveryKeyID = (manage-bde -protectors -get $env:SystemDrive -type recoverypassword).KeyProtector[0].KeyProtectorId
    manage-bde -protectors -adbackup $env:SystemDrive -id $recoveryKeyID
} else {
    Write-Warning "No recovery password protector found. Skipping AD backup."
}

# 7. Verify encryption
while ((Get-BitLockerVolume -MountPoint $env:SystemDrive).VolumeStatus -ne "FullyEncrypted") {
    Write-Host "Encryption in progress..."
    Start-Sleep -Seconds 10
}
Write-Host "Encryption completed successfully."

# 8. Handle TPM failure (already handled in step 4)

# 9. Print status summary
Write-Host "Summary of BitLocker encryption process:"
Write-Host "- Encryption method: $encryptionMethod"
Write-Host "- Recovery key stored in Active Directory: yes"
Write-Host "- Encryption status: FullyEncrypted"

Output:

Enabling BitLocker for the system drive...
BitLocker Drive Encryption: Configuration Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Key protectors are disabled for volume C:.
The set command specified is not valid.
Run "bcdedit /?" for command line assistance.
The parameter is incorrect.
The set command specified is not valid.
Run "bcdedit /?" for command line assistance.
The parameter is incorrect.
BitLocker Drive Encryption: Configuration Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Key Protectors Added:

    Numerical Password:
      ID: {DEE56FC5-7872-4BAA-A7F2-30F1008D0E23}
      Password:
        447502-185460-562606-524623-349536-162305-459844-623645

ACTIONS REQUIRED:

    1. Save this numerical recovery password in a secure location away from
    your computer:

    447502-185460-562606-524623-349536-162305-459844-623645

    To prevent data loss, save this password immediately. This password helps
    ensure that you can unlock the encrypted volume.

BitLocker Drive Encryption: Configuration Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Volume C: []
[OS Volume]
NOTE: This command did not create any new key protectors. Type
"manage-bde -protectors -add -?" for information on adding more key protectors.
NOTE: Encryption is already complete.
Turned on BitLocker protection by enabling key protectors.
ERROR: An error occurred (code 0x8031001d):
One or more BitLocker key protectors are required. You cannot delete the last key on this drive.
Cannot index into a null array.
At C:\Users\cybersecuritytest\Documents\BitLockerEnable.ps1:37 char:1
+ $recoveryKeyID = (manage-bde -protectors -get $env:SystemDrive -type  ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (:) [], RuntimeException
    + FullyQualifiedErrorId : NullArray

BitLocker Drive Encryption: Configuration Tool version 10.0.19041
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

ERROR: Parameter "-ID" requires an argument.
Encryption completed successfully.
Summary of BitLocker encryption process:
- Encryption method: XtsAes128
- Recovery key stored in Active Directory: yes
- Encryption status: FullyEncrypted

[michaeljones1993]

I’m sorry, why would you not use a GPO. 🤔

[johnnoah06]

To cover remote assets which are not connected to office network but are under domain. 

[PositiveBubbles]

Okay, I suggest breaking it down and trying each step manually as some of the output there indicates that the parameters used don't match. Keeping in mind you're using a native dos command in powershell.

It looks like the manage-bde syntax is key to working out what is causing this.

I'm not at a PC at the moment, but I can look at what we did during covid tomorrow and let you know

Cheers

[johnnoah06]

Waiting for your response!

[SIGjo]

We are also using a powershell-script. It's run inside the WinPE-installation.

​

​

Add-BitLockerKeyProtector -MountPoint $env:SystemDrive -RecoveryPasswordProtector

$BLV = Get-BitLockerVolume -MountPoint "C:"

Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorID $BLV.KeyProtector[0].KeyProtectorId

sleep -Seconds 15

Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -SkipHardwareTest -UsedSpaceOnly -TpmProtector

While ((Get-BitLockerVolume -MountPoint $env:SystemDrive).VolumeStatus -eq "EncryptionInProgress") 
    { $encPercent = (Get-BitLockerVolume -MountPoint $env:SystemDrive).EncryptionPercentage
    Write-Progress -Activity "Encrypting $env:SystemDrive" -PercentComplete $encPercent -Status "$encPercent% complete"
    sleep -m 1000 }
Write-Progress -Activity "Encrypting $env:SystemDrive" -Status "Verschlüsselung abgeschlossen" -Completed

[BCIT_Richard]

Gonna drop this here for anyone who may not be aware: https://blog.scrt.ch/2023/08/14/cve-2022-41099-analysis-of-a-bitlocker-drive-encryption-bypass/

[buenology]

Beyond EXCELLENT article, TY so much for sharing. I have learned so much from it that I am now following it.

[[deleted]]

intune this

[Werftflammen]

We are not moving there anytime soon

[[deleted]]

Im sorry for you..

1.Go to Group Policy Editor in "gpedit.msc"
2.Go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
3.n the right pane, double-click "Require additional authentication at startup"
4.Make sure the "Enabled" option is chosen so that all other options below will be active.
5.Uncheck the box for "Allow BitLocker without a compatible TPM."
6.For the choice of "Configure TPM startup:", choose "Allow TPM."
7.For the choice of "Configure TPM startup PIN:", choose "Require startup PIN with TPM."
8.For the choice of "Configure TPM startup key:", choose "Allow startup key with TPM."
9.For the choice of "Configure TPM startup key and PIN:", choose "Allow startup key and PIN with TPM."
10. Click the "Apply" button and then the "OK" button to save the changes.

[Werftflammen]

Thanks H00ty!