I'm trying to create a script to see if the bitlocker works or not. If it works, then a file is posted in the c:\ folder We will call "yes" if the bitlocker does not work then add password recovery and activate the bitlocker. The script runs properly on computers but I need to run it from GPO as login, and not all users of mine are admin so I want to add to the script the fixed credentials so that the user doesn't have to do anything.
Until now I've tried to run the script in startup but it doesn't succeed because it's not admin (I know in startup he runs as a system and yet it doesn't work) I also tried to run the script in Task Scheduler But he's having trouble pulling the file from a shared folder.
I'm trying to run this script.
PS Microsoft.PowerShell.Core\FileSystem::\\domin.com\SysVol\domin.com\Policies\{873EBCF2-C88A-4557-AAAB-F01EA2574A5E}\Machine\Scripts\Startup> $userName = "domin\adminbitlocker"
$password = ConvertTo-SecureString "+Ab0p9o8i!" -AsPlainText -Force
$credentials = New-Object Management.Automation.PSCredential $username, $password
$BLinfo = Get-Bitlockervolume | Get-Credential -Credential $credentials
if ($BLinfo.mountpoint -eq 'c:' -and $BLinfo.ProtectionStatus -eq 'on' ) {
Out-File c:\yes.log
}
if ($BLinfo.mountpoint -eq 'c:' -and $BLinfo.ProtectionStatus -eq 'off' ) {
manage-bde.exe -protectors -add c: -rp
manage-bde.exe -on c:
Out-File c:\no.log
}
And i get
Get-CimInstance : Access denied
At C:\windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psm1:144 char:13
+ Get-CimInstance `
+ ~~~~~~~~~~~~~~~~~
+ CategoryInfo : PermissionDenied: (root\cimv2\Secu...cryptableVolume:String) [Get-CimInstance], CimException
+ FullyQualifiedErrorId : HRESULT 0x80041003,Microsoft.Management.Infrastructure.CimCmdlets.GetCimInstanceCommand
Get-Win32EncryptableVolumeInternal : does not have an associated BitLocker volume.
At C:\windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psm1:696 char:42
+ ... $AllWin32EncryptableVolume = Get-Win32EncryptableVolumeInternal
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Write-Error], COMException
+ FullyQualifiedErrorId : System.Runtime.InteropServices.COMException,Get-Win32EncryptableVolumeInternal.
Thank you so much, everyone. And please forgive my English, it's not the best.
I have written an article about Bitlocker deployment using scripts. See https://www.experts-exchange.com/articles/33771/We-have-bitlocker-so-we-need-MBAM-too.html?preview=hG26jVC1xow%3D My method is to create a random PIN, by the way, and display it to the user at the console, so it's not retrievable from the script.
User contributions licensed under CC BY-SA 3.0