WIN-006 · Script

BitLocker Status Check

Confirms the system drive is encrypted with BitLocker and has a recovery password.

What it does

Reports protection status, encryption percentage, encryption method, and which key protectors exist on the operating system drive. Flags drives that are unprotected, suspended, not fully encrypted, or missing a recovery password protector. Read-only; it never displays or exports recovery keys.

Requirements

Windows PowerShell 5.1+, Windows Pro/Enterprise/Education, run as SYSTEM or local admin

How to run it

• Run as: SYSTEM or a local administrator
• Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
• Script type: PowerShell, 64-bit
• User interaction: none; the script never prompts
• Timeout: 10 minutes (30 for Windows Update installs)

Settings

Exit codes

• 0 = protected, 1 = attention needed, 2 = script error

Testing steps

1. Run it on one test device and check the output and log.
2. Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
3. Roll out to a small group next, then everyone.

Rollback steps

Report only. Nothing is changed, so nothing needs to be rolled back.

Version and change log