Bitlocker Status - Retired Computers
Summary
This dataview displays the Bitlocker information on all retired computers that have run the Script - Bitlocker - Audit. This Bitlocker information consists of the Bitlocker status of machine drives, information about key protectors, TPM status, and the backup status in Active Directory.
Dependencies
- SEC - Encryption - Custom Table - plugin_proval_bitlocker_audit
- CWM - Automate - Custom Table - plugin_proval_tpm_audit
- SEC - Encryption - Custom Table - plugin_proval_ad_bitlocker_keyprotectors
Columns
| Column | Explanation |
|---|---|
| Client | The name of the client of the audited agent. |
| ComputerID | The ID of the audited agent. |
| Computer | The name of the audited agent. |
| MountPoint | The drive letter of the audited volume. |
| EncryptionMethod | The encryption method used to encrypt the drive. |
| AutoUnlockEnabled | 1 or 0 depending on whether the drive will be auto-unlocked. |
| AutoUnlockKeyStored | 1 or 0 depending on whether any external keys or related information that may be used to automatically unlock data volumes exist in the currently running operating system volume. |
| MetadataVersion | The version of the Bitlocker metadata. |
| VolumeStatus | The current status that the audited volume is in. |
| ProtectionStatus | Whether Bitlocker protection is currently On or Off. |
| LockStatus | Whether the protected drive is currently locked. |
| EncryptionPercentage | The percentage that the audited drive is currently encrypted. If encryption is enabled and has completed, then this should be 100. |
| WipePercentage | The percentage of the volume that has been wiped after issuing a wipe command. |
| VolumeType | The type of the audited volume. |
| KeyProtectorId | The GUID of the key protector for the audited volume. |
| AutoUnlockProtector | 1 or 0 depending on whether this key protector is an auto-unlock protector. |
| KeyProtectorType | The type of key protector. |
| KeyFileName | The file name of the key protector (if applicable). |
| RecoveryPassword | The recovery password of the key protector (if applicable). |
| KeyCertificateType | The certificate type of the key protector (if applicable). |
| Thumbprint | The thumbprint of the key protector (if applicable). |
| LastUpdated | The last time the volume was audited. |
| ADBackupDetected | True or False if the key was detected as backed up to Active Directory. |
| ADBackupLastAudit | The last time any domain controller in the target domain has been audited for key protector backups. NULL if no audit has been performed. |
| MachineType | The type of target machine (workstation or server). |
| LastContact | The date/time of last contact with the target. |
| DaysSinceLastContact | The number of days between now and the target's last contact. |
| OperatingSystem | The operating system of the target. |
| LocationID | This was required to allow the data to populate in the dataview. |
| ClientID | This was required to allow the data to populate in the dataview. |
| TpmReady | The TPM Ready state of the target. |
| TpmEnabled | The TPM Enabled state of the target. |
| TPM Version | The TPM Version number. |
| TPMOwned | The TPM Owned state of the target. |
| TPMActivated | The activation state of the TPM on the target. |