How to add credentials to bitlocker script

-4

I'm trying to create a script to see if the bitlocker works or not. If it works, then a file is posted in the c:\ folder We will call "yes" if the bitlocker does not work then add password recovery and activate the bitlocker. The script runs properly on computers but I need to run it from GPO as login, and not all users of mine are admin so I want to add to the script the fixed credentials so that the user doesn't have to do anything.

Until now I've tried to run the script in startup but it doesn't succeed because it's not admin (I know in startup he runs as a system and yet it doesn't work) I also tried to run the script in Task Scheduler But he's having trouble pulling the file from a shared folder.

I'm trying to run this script.

PS Microsoft.PowerShell.Core\FileSystem::\\domin.com\SysVol\domin.com\Policies\{873EBCF2-C88A-4557-AAAB-F01EA2574A5E}\Machine\Scripts\Startup>  $userName = "domin\adminbitlocker"
$password = ConvertTo-SecureString "+Ab0p9o8i!" -AsPlainText -Force
$credentials = New-Object Management.Automation.PSCredential $username, $password


$BLinfo =  Get-Bitlockervolume | Get-Credential -Credential $credentials
if ($BLinfo.mountpoint -eq 'c:' -and $BLinfo.ProtectionStatus -eq 'on' ) {
    Out-File  c:\yes.log
}

if ($BLinfo.mountpoint -eq 'c:' -and $BLinfo.ProtectionStatus -eq 'off' ) { 

    manage-bde.exe -protectors -add c: -rp 

    manage-bde.exe -on c: 

    Out-File  c:\no.log
}

And i get

Get-CimInstance : Access denied 
At C:\windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psm1:144 char:13
+             Get-CimInstance `
+             ~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (root\cimv2\Secu...cryptableVolume:String) [Get-CimInstance], CimException
    + FullyQualifiedErrorId : HRESULT 0x80041003,Microsoft.Management.Infrastructure.CimCmdlets.GetCimInstanceCommand

Get-Win32EncryptableVolumeInternal :  does not have an associated BitLocker volume.
At C:\windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psm1:696 char:42
+ ...       $AllWin32EncryptableVolume = Get-Win32EncryptableVolumeInternal
+                                        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Write-Error], COMException
    + FullyQualifiedErrorId : System.Runtime.InteropServices.COMException,Get-Win32EncryptableVolumeInternal.

Thank you so much, everyone. And please forgive my English, it's not the best.

powershell
scripting
bitlocker
asked on Server Fault Sep 13, 2020 by Matrix • edited Sep 14, 2020 by Matrix

1 Answer

0

I have written an article about Bitlocker deployment using scripts. See https://www.experts-exchange.com/articles/33771/We-have-bitlocker-so-we-need-MBAM-too.html?preview=hG26jVC1xow%3D My method is to create a random PIN, by the way, and display it to the user at the console, so it's not retrievable from the script.

answered on Server Fault Sep 28, 2020 by Bernd Schwanenmeister

User contributions licensed under CC BY-SA 3.0