0

I am trying to enable bitlocker in all domain joined user machines in my office. I have used a logon script to enable bitlocker in all machines. But this tool is enabling bitlocker in C drive alone. I need to enable this in all drive. How do i proceed. I have attached the script below

$TPM = Get-WmiObject win32_tpm -Namespace root\cimv2\security\microsofttpm | where {$_.IsEnabled().Isenabled -eq 'True'} -ErrorAction SilentlyContinue
$WindowsVer = Get-WmiObject -Query 'select * from Win32_OperatingSystem where (Version like "6.2%" or Version like "6.3%" or Version like "10.0%") and ProductType = "1"' -ErrorAction SilentlyContinue
$BitLockerReadyDrive = Get-BitLockerVolume -MountPoint $env:SystemDrive -ErrorAction SilentlyContinue


#If all of the above prequisites are met, then create the key protectors, then enable BitLocker and backup the Recovery key to AD.
if ($WindowsVer -and $TPM -and $BitLockerReadyDrive) {

#Creating the recovery key
Start-Process 'manage-bde.exe' -ArgumentList " -protectors -add $env:SystemDrive -recoverypassword" -Verb runas -Wait

#Adding TPM key
Start-Process 'manage-bde.exe' -ArgumentList " -protectors -add $env:SystemDrive  -tpm" -Verb runas -Wait
sleep -Seconds 15 #This is to give sufficient time for the protectors to fully take effect.

#Enabling Encryption
Start-Process 'manage-bde.exe' -ArgumentList " -on $env:SystemDrive -em aes256" -Verb runas -Wait

#Getting Recovery Key GUID
$RecoveryKeyGUID = (Get-BitLockerVolume -MountPoint $env:SystemDrive).keyprotector | where {$_.Keyprotectortype -eq 'RecoveryPassword'} | Select-Object -ExpandProperty KeyProtectorID

#Backing up the Recovery to AD.
manage-bde.exe  -protectors $env:SystemDrive -adbackup -id $RecoveryKeyGUID

#Restarting the computer, to begin the encryption process
Restart-Computer}

please help

alexander.polomodov
  • 1,060
  • 3
  • 10
  • 14
user284141
  • 1
  • 2
  • 4
  • 1
    Do you need to be doing this via Powershell? Why are you not using Group Policy to enact this powershell change if you have a domain? If you must use Powershell, can you use the Bitlocker cmdlets? https://docs.microsoft.com/en-us/powershell/module/bitlocker/?view=win10-ps - seems like that will be a much easier way of doing this. – Mark Henderson Jun 11 '18 at 12:04
  • Hello Mark, Thanks for the reply. We have domain but we are trying to automate the bitlocker encryption for domain users using a script. I have followed the link which you have mentioned above. but how does it send the recovery information to active directory – user284141 Jun 12 '18 at 10:36

0 Answers0