Skip to main content

BitLocker Status and Recovery Key Audit

Summary​

This script collects BitLocker encryption details for each drive on the system using the Get-BitLockerVolume cmdlet. It summarizes the protection status, key protector types, encryption percentage, and recovery password (if available). The output is formatted as a single string suitable for saving into the Endpoint-Level custom field BitLocker Status and Key. It is recommended to schedule this script to run once per day to keep the information up-to-date.

Output Format: | DriveLetter: KeyProtectorTypes; ProtectionStatus; EncryptionPercentage; RecoveryPassword |
Example: | C: RecoveryPassword, TPM; Enabled; 100%; <RecoveryPassword> | D: Not Enabled |

Notes: The BitLocker Drive Encryption feature must be enabled on servers to run this script against windows servers. Auditing will not work without enabling this feature.

Sample Run​

Image1

Dependencies​

Task Setup Path​

Tasks Path: AUTOMATION ➞ Tasks
Task Type: Script Editor

Task Creation​

Description​

  • Name: BitLocker Status and Recovery Key Audit
  • Description: This script collects BitLocker encryption details for each drive on the system using the Get-BitLockerVolume cmdlet. It summarizes the protection status, key protector types, encryption percentage, and recovery password (if available). The output is formatted as a single string suitable for saving into the Endpoint-Level custom field "BitLocker Status and Key".
  • Category: Data Collection

Image2

Script Editor​

Step 1: Row -> PowerShell script​

  • Use Generative AI Assist for script creation: False
  • Expected time of script execution in seconds: 300
  • Operating System: Windows
  • Continue on Failure: False
  • Run As: System
  • PowerShell Script Editor:

PowerShell Script

Image3

Step 2: Row -> Script Log​

  • Script Log Message: %Output%
  • Continue on Failure: False
  • Operating System: Windows

Image4

Step 3: Row -> Set Custom Field ( BitLocker Status and Key = %output% )​

  • Custom Field: BitLocker Status and Key
  • Value: %Output%
  • Continue on Failure: False
  • Operating System: Windows

Image5

Completed Task​

Image6

Output​

  • Script Log
  • Custom Field

Schedule Task​

Task Details​

  • Name: BitLocker Status and Recovery Key Audit
  • Description: This script collects BitLocker encryption details for each drive on the system using the Get-BitLockerVolume cmdlet. It summarizes the protection status, key protector types, encryption percentage, and recovery password (if available). The output is formatted as a single string suitable for saving into the Endpoint-Level custom field "BitLocker Status and Key".
  • Category: Data Collection

Image7

Schedule​

  • Schedule Type: Schedule
  • Timezone: Local Machine Time
  • Start: <Current Date>
  • Trigger: Time At <Current Time>
  • Recurrence: Every day

Image8

Targeted Resource​

Device Group: BitLocker Status Audit Enabled

Image9

Completed Scheduled Task​

Image10

Changelog​

2025-04-10​

  • Initial version of the document