Unlock Bitlocked data drive as standard user on the command line

I have a Windows 10 Pro PC, no domain, I don't use BitLocker on the system drive but have encrypted some fixed data drives using BitLocker and a password (no TPM).

When I like to unlock these drives I can select them in File Explorer and choose Unlock Drive..., after entering my password the drive is decrypted and I can use it.

Because I have a few of these drives with the same password I wrote a script to unlock all them at the same time.

Unlock-BitLocker -MountPoint X: -Password $myPassword

This works fine when executed as an elevated administrator, but when I run the script as my normal standard user it fails:

Get-CimInstance : Access denied

WBEM_E_ACCESS_DENIED (0x80041003) Current user does not have permission to perform the action.

I assume both File Explorer and the PowerShell BitLocker module use the same Win32 API, why does one work as a standard user and the other one doesn't?

When using:

manage-bde –unlock E: -rp password

I get:

BitLocker Drive Encryption: Configuration Tool version 10.0.14393
ERROR: An attempt to access a required resource was denied.
Check that you have administrative rights on the computer.

Using Process Monitor, I can see access is denied to the following registry key:

HKLM\Software\Microsoft\WBEM\CIMOM

I also found out the File Explorer content menu calls the executable:

%systemroot%\System32\bdeunlock.exe

which displays the little popup window to enter the password.

When using bdeunlock.exe no access to HKLM\Software\Microsoft\WBEM\CIMOM is shown in Process Monitor. So it seems it unlocks the drive without accessing that key.

It looks that both the PowerShell cmdlets and manage-bde.exe use WMI:

Get-CimInstance
-Namespace "root\cimv2\Security\MicrosoftVolumeEncryption"
-ClassName Win32_EncryptableVolume

and a standard user does not have access to this.

But bdeunlock.exe may use the function FveOpenVolumeW in FVEAPI.dll (Bitlocker API file) directly without using WMI first.

Is there a way to unlock a Bitlocked fixed data drive on the command line as a standard user?

Continuing my research I explained in the question itself, I further looked into this.

Using the PowerShell cmdlet Unlock-Bitlocker because its code is available in clear-text on every Windows machine.

The first error during the execution of the cmdlet happens while calling:

Get-CimInstance 
 -Namespace "root\cimv2\Security\MicrosoftVolumeEncryption" `
 -ClassName Win32_EncryptableVolume

I get an Access Denied

@Homey_D_Clown_IT suggested to change the security on the WIM object in question, to do that, open wmimgmt.msc, right click on the WMI Control (Local) node on the left and click Properties. Select the Security tab and then find the object Root\CIMV2\Security\MicrosoftVolumeEncryption, click the Security button. Add a group or user you want to allow unlocking the bitlocked drives. Check the Allow Execute Methods permission.

After this has been done, the standard user can use the manage-bde.exe tool to unlock the drive:

manage-bde -unlock X: -pw

the problem is, this prompts the user for the password and I have four drives to unlock at this time and I would prefer to enter the password only once.

Using the Unlock-Bitlocker cmdlet in PowerShell now gets passed the previous error, but displays another one:

Access Denied in Get-BitLockerVolumeInternal...

Looking into the code of the PowerShell module it breaks at a time where the code tries to access the recovery password which can only be done by an administrator. If I change the code to ignore that error and just continue rather than breaking, it works fine.

But this is a bad hack, because I had to take ownership of the module file, change permissions and then edit the code. All things I should not do with a Windows System file, plus the next time Microsoft updates that PowerShell module, my change will be overwritten.

One solution is to copy the relevant code pieces into my own PowerShell module and use that one instead. That may not even be legal.

Another solution is to remove the recoverypassword:

manage-bde -protectors -delete X: -type recoverypassword

This only leaves me with a single protector for the Bitlocked drive, the normal password.

Why it is a good idea to remove the recovery-password from a fixed data drive encrypted with BitLocker?

Any administrator can see the recovery password and use it to decrypt the drive, WFT!

My whole point was to protect the data on the drives from other people. Someone could steal my PC, boot into a live-CD linux and get access to an administrator account on my Windows installation.

After I removed the recovery passwords, I can use the original Unlock-Bitlocker cmdlet as a standard user to unlock my drives. I still needed to change the permissions on the WMI object as described above.

Edit: After a Windows 10 update, in this case to 14939.222 the permission on the root\cimv2\Security\MicrosoftVolumeEncryption were reset and I had to change them again. So this doesn't seem to be a permanent solution after all.

Because of this resetting by Windows Update, I decided to script the change for the WMI permission. I'm using Set-WmiNamespaceSecurity.ps1 which is available in this Microsoft Blog Post, then I can use:

.\Set-WmiNamespaceSecurity.ps1 -namespace "root/cimv2/Security/MicrosoftVolumeEncryption" -operation add -account MyUserName -permissions  MethodExecute,Enable