Windows 10 Enable Bitlocker by using a script

[KasparDanielsen]

Hi Everyone,


My first post in here, hopefully you can help me out with this simple question.


I've been able to create a GPO to deploy a script on all user machines and execute with a Scheduled Task with the use of SYSTEM permissions. (Not a logon script etc.)


It works perfectly fine.. the Bitlocker encryption keys just ends up in the AD multiple times. It's due to gpupdate that makes the script run again and my statement might just ignore that the drive already is encrypted at that point.. by running over and over again.


I've taken it from a Intune Bitlocker script and removed the unnecessary parts, but I believe it just ignore the part that the state is not in "FullyDecrypted" after the first run and just run the "Enable-BitLocker -MountPoint "C:" -RecoveryPasswordProtector" command over and over again.


Why won't it skip when the volumestatus isn't -eq "FullyDecrypted"?


Script:

Get-BitLockerVolume "C:"

$bdeStartingStatus = Get-BitLockerVolume "C:"



$bdeProtect = Get-BitLockerVolume "C:" | Select-Object -Property VolumeStatus



if ($bdeProtect.VolumeStatus -eq "FullyDecrypted") {



# Enable Bitlocker

Enable-BitLocker -MountPoint "C:" -RecoveryPasswordProtector

}


Kind Regards,

Kaspar Danielsen

Continue reading...