Solved

Powershell to list all machine with Bitlocker Enabled

Posted on 2013-10-23
5
1,448 Views
Last Modified: 2013-10-24
I'm try to get a list of full list of machines that also identifies if bitlocker ins enabled.

The following is a script that I was hoping to work however line 53
"if ($computer.name -match ('(' + [string]::Join(')|(', $bitlockerenabled) + ')'))"
 throws:

"Exception calling "Join" with "2" argument(s): "Value cannot be null.
Parameter name: value"
At C:\Users\big.bob\Documents\New Users Scripts\Test4\BitLocker_Data.ps1:5
3 char:49
+     if ($computer.name -match ('(' + [string]::Join <<<< (')|(', $bitlockeren
abled) + ')'))
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : DotNetMethodException"
#
#
# NAME: Get-BitlockerComputerReport.ps1
#
# AUTHOR: Jan Egil Ring
# EMAIL: jan.egil.ring@crayon.com
#
# COMMENT: Script to retrieve BitLocker-information for all computer objects with Windows 7 or Windows Vista in the current domain.
#
#          The information will be exported to a CSV-file containing the following information:
#          -Computername
#          -OperatingSystem
#          -HasBitlockerRecoveryKey
#          -HasTPM-OwnerInformation
#          
#          Required version: Windows PowerShell 1.0 or 2.0
#          Required snapins: Quest.ActiveRoles.ADManagement
#          Requried privileges: Read-permission on msFVE-RecoveryInformation objects and Read-permissions on msTPM-OwnerInformation on computer-objects (e.g. Domain Admins)
#          
#          For more information, see the following blog-post: http://blog.powershell.no/2010/10/24/export-bitlocker-information-using-windows-powershell 
#      
# You have a royalty-free right to use, modify, reproduce, and
# distribute this script file in any way you find useful, provided that
# you agree that the creator, owner above has no warranty, obligations,
# or liability for such use.
#
# VERSION HISTORY:
# 1.0 24.10.2010 - Initial release
#  
#
 
#Custom variables
$CsvFilePath = "C:\BitLockerComputerReport.csv"
 
#Export computers not Bitlocker-enabled to a CSV-file
$BitLockerEnabled = Get-QADObject -SizeLimit 0 -IncludedProperties Name,ParentContainer | Where-Object {$_.type -eq "msFVE-RecoveryInformation"} | Foreach-Object {Split-Path -Path $_.ParentContainer -Leaf} | Select-Object -Unique
$computers = Get-QADComputer -SizeLimit 0 -IncludedProperties Name,OperatingSystem,msTPM-OwnerInformation | Where-Object {$_.operatingsystem -like "Windows 7*" -or $_.operatingsystem -like "Windows Vista*"} | Sort-Object Name
 
#Create array to hold computer information
$export = @()
 
 
foreach ($computer in $computers)
  {
    #Create custom object for each computer
    $computerobj = New-Object -TypeName psobject
     
    #Add name and operatingsystem to custom object
    $computerobj | Add-Member -MemberType NoteProperty -Name Name -Value $computer.Name
    $computerobj | Add-Member -MemberType NoteProperty -Name OperatingSystem -Value $computer.operatingsystem
     
    #Set HasBitlockerRecoveryKey to true or false, based on matching against the computer-collection with BitLocker recovery information
      if ($computer.name -match ('(' + [string]::Join(')|(', $bitlockerenabled) + ')'))
    {
    $computerobj | Add-Member -MemberType NoteProperty -Name HasBitlockerRecoveryKey -Value $true
    }
    else
    {
    $computerobj | Add-Member -MemberType NoteProperty -Name HasBitlockerRecoveryKey -Value $false
    }
     
    #Set HasTPM-OwnerInformation to true or false, based on the msTPM-OwnerInformation on the computer object
     if ($computer."msTPM-OwnerInformation") {
    $computerobj | Add-Member -MemberType NoteProperty -Name HasTPM-OwnerInformation -Value $true
    }
    else
    {
    $computerobj | Add-Member -MemberType NoteProperty -Name HasTPM-OwnerInformation -Value $false
    }
     
#Add the computer object to the array with computer information
$export += $computerobj
 
  }
 
#Export the array with computerinformation to the user-specified path
$export | Export-Csv -Path $CsvFilePath -NoTypeInformation
$error[0]|format-list -force
0
Comment
Question by:kryanC
  • 3
  • 2
5 Comments
 
LVL 70

Expert Comment

by:Chris Dent
ID: 39596843
The script is a bit flawed. What it actually tells you is if recovery information is stored in AD, and if TPM information is stored in AD. That doesn't necessarily mean the machine does (or doesn't) have BitLocker.

The script above can be shortened a little bit to this:
$FullVolumeEncryptionRecovery = Get-QADObject -Type "msFVE-RecoveryInformation" | Select-Object -ExpandProperty ParentContainer -Unique

Get-QADComputer -IncludedProperties "msTPM-OwnerInformation" | Select-Object Name, OperatingSystem,
  @{n='FullVolumeRecovery';e={ $FullVolumeEncryptionRecovery -Contains $DN }},
  @{n='TPMOwnerInformation';e={ [Boolean]($_."msTPM-OwnerInformation") }}

Open in new window

To get a true picture you might use WMI instead. The trouble is, it'll be quite a bit slower (as it needs to talk to each PC directly). It's also dependent on the PC being available at the point in time you run the script.
$BLNamespace = 'root\CIMV2\Security\MicrosoftVolumeEncryption'

Get-QADComputer -OperatingSystem "Windows 7*" |
  Where-Object { Test-Connection $_.Name -Quiet -Count 2 } |
  Select-Object Name, DN, @{n='BitLocker';e={ 
    [Boolean](Get-WmiObject Win32_EncryptableVolume -Filter "DriveLetter='C:'" -Namespace $BLNamespace -ComputerName $_.Name) }}

Open in new window

Cheers,

Chris
0
 

Author Comment

by:kryanC
ID: 39596991
Chris,
Thanks for the help but where are the results for the WIM script? I tried exporting but it is blank. Sorry, but new to powershell.

Thanks

Kry
0
 
LVL 70

Accepted Solution

by:
Chris Dent earned 500 total points
ID: 39597024
It's based on the results of this command:

Get-QADComputer -OperatingSystem "Windows 7*"

If that returns nothing then neither does the WMI part of it.

Chris
0
 

Author Closing Comment

by:kryanC
ID: 39597116
Chris thanks I had a small size limit for testing and all the initial computers were Servers and thus no info. Changed the number and all seems to be running smoothly.  Will post back if I need more help, but again, thank you.

Ryan
0
 
LVL 70

Expert Comment

by:Chris Dent
ID: 39597149
No problem, I hope it's useful :)

Chris
0

Featured Post

Space-Age Communications Transitions to DevOps

ViaSat, a global provider of satellite and wireless communications, securely connects businesses, governments, and organizations to the Internet. Learn how ViaSat’s Network Solutions Engineer, drove the transition from a traditional network support to a DevOps-centric model.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to sign a powershell script so you can prevent tampering, and only allow users to run authorised Powershell scripts
Create and license users in Office 365 in bulk based on a CSV file. A step-by-step guide with PowerShell script examples.
Learn the basics of strings in Python: declaration, operations, indices, and slicing. Strings are declared with quotations; for example: s = "string": Strings are immutable.: Strings may be concatenated or multiplied using the addition and multiplic…
Learn the basics of if, else, and elif statements in Python 2.7. Use "if" statements to test a specified condition.: The structure of an if statement is as follows: (CODE) Use "else" statements to allow the execution of an alternative, if the …

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question