How to Automate BitLocker Encryption with a PowerShell Script

.\YourScriptName.ps1

.\YourScriptName.ps1 -run

.\YourScriptName.ps1 -run -force

param (
    [switch]$run,
    [switch]$force
)

if (!$run) {
    Write-Host "`nThe script is running in ""test"" mode. Use the -run argument to execute the script for real.`n To run the script without confirmation after checking for the presence of a TPM, use the -force argument."
}

# Checking for the presence of BitLocker
if (-not (Get-Command -Name "Get-BitLockerVolume" -ErrorAction SilentlyContinue)) {
    Write-Host "BitLocker is not installed on this system. Please ensure that BitLocker is available before proceeding."
    exit
}

write-host "`n"
write-host "#################################################"
write-host "#    Initial checks for BitLocker activation    #"
write-host "#################################################"
Write-Host "This checks if BitLocker is already activated and configured, if so, the BitLocker key will be uploaded to Azure as a precaution, and the script will exit`n"

$bitlockerStatus = Get-BitLockerVolume -MountPoint "C:"
$recoveryPasswordExists = $bitlockerStatus.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }
$tpmProtectorExists = $bitlockerStatus.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'Tpm' }
if ($bitlockerStatus.VolumeStatus -eq "FullyEncrypted" -and $bitlockerStatus.EncryptionPercentage -eq 100 -and $bitlockerStatus.ProtectionStatus -eq "on" -and $recoveryPasswordExists -and $tpmProtectorExists)
{
    Write-Host "BitLocker is active, the drive is fully encrypted, a ""RecoveryPassword"" exists, and the drive is protected by TPM. The script will abort. However, the password will still be backed up to Azure under the computer account as a precaution. The upload will not change anything if the key already exists on Azure"
    if (!$run)
    {
        Write-Host "The following command would be executed to back up the BitLocker key to Azure: BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $($keyProtectorId.KeyProtectorId)"
        pause
        exit
    }
    else
    {
        $keyProtectorId = (Get-BitLockerVolume -MountPoint $env:SystemDrive).KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } | Select-Object -First 1
        BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $($keyProtectorId.KeyProtectorId)
        pause
        exit
    }
    
}

write-host "`n"
write-host "#################################################"
write-host "#    Checking for the presence of a TPM chip    #"
write-host "#################################################"

# Checking for the presence of a TPM chip on the PC
try {
    $tpm = Get-Tpm
    if ($tpm.TpmPresent -eq $false) {
        throw "No TPM chip found. Please ensure the PC has a TPM chip before proceeding. It might also be disabled in the BIOS, refer to your computer/motherboard manufacturer"
    } elseif ($tpm.TpmReady -eq $false -or $tpm.TpmEnabled -eq $false) {
        throw "The TPM chip is not ready or not enabled. Please ensure the TPM chip is ready and enabled before proceeding."
    } elseif ($tpm.TpmPresent -eq $true -and $tpm.TpmReady -eq $true -and $tpm.TpmEnabled -eq $true -and $force -eq $true){
        Write-Host "TPM found, ready, and active. Skipping confirmation since the ""-force"" argument was used.`nStarting BitLocker encryption."
    } else {
        Write-Host "TPM found, ready, and active. Do you want to proceed with enabling BitLocker? (Y/N)"
        $confirmation = Read-Host "Enter Y to continue or N to cancel"
        if ($confirmation -ne "Y") {
            throw "Operation canceled by the user."
        }
    }
} catch {
    Write-Host $_
    Read-Host "Press Enter to exit"
    exit
}

write-host "`n"
write-host "####################################################################"
write-host "#    Checking for the presence of a BitLocker recovery password    #"
write-host "####################################################################"
# Checking if a recovery key exists
Try {
if (-not $recoveryPasswordExists) {
    Write-Host "A Bitlocker recovery password was not found on this drive. Creating one..."
    if (!$run) {
        Write-Host "The following command would be executed: Add-BitLockerKeyProtector -MountPoint C: -RecoveryPasswordProtector"
    } else {
        Add-BitLockerKeyProtector -MountPoint C: -RecoveryPasswordProtector | Out-Null
        $recoveryPasswordExists = $true
        Write-Host "A BitLocker recovery password has been added."
    }
} else {
    Write-Host "A recovery password already exists. No need to add a new recovery key."
}
} catch {
    Write-Host "Failed to create the recovery password or confirm its existence: $_"
    exit
}

write-host "`n"
write-host "#################################################################"
write-host "#    Saving the BitLocker recovery password to AzureAD/Entra    #"
write-host "#################################################################"
# Backing up the key to Azure
try {
    $keyProtectorId = (Get-BitLockerVolume -MountPoint $env:SystemDrive).KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } | Select-Object -First 1
    Write-Host "Backing up Bitlocker recovery key to Microsoft Azure..."
    if (!$run) {
        Write-Host "The following command would be executed to back up the key to Azure as a precaution: BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $($keyProtectorId.KeyProtectorId)"
    } else {
        BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $($keyProtectorId.KeyProtectorId)
        Write-Host "The BitLocker recovery key has been backed up to Azure."
    }
} catch {
    Write-Host "Failed to back up the key to Azure: $_"
    exit
}


# Enabling BitLocker using the PC's TPM for the C:\ drive
try {
    write-host "`n"
    write-host "#################################################"
    write-host "#    Enabling BitLocker using the TPM module    #"
    write-host "#################################################"
    if ($bitlockerStatus.ProtectionStatus -eq "Off" -and -not $tpmProtectorExists -and $recoveryPasswordExists) {
        Write-Host "Since Bitlocker is disabled, no TPM protector exists and a recovery password was configured, we can now enable it"
        if (!$run) {
            Write-Host "The script is running in test mode, the following command would be executed: Enable-BitLocker -MountPoint C: -TpmProtector"
        } else {
            Enable-BitLocker -MountPoint C: -TpmProtector | Out-Null
            Write-Host "BitLocker protection has been enabled and will be managed by the TPM module."
            $tpmProtectorExists = $true
            $bitlockerEnabled = $True
        }
    } else {
        Write-Host "BitLocker is already enabled with TPM and recovery password protectors or there was an error and no password was created during the execution of this script."
    }
} catch {
    Write-Host "Error enabling BitLocker with TPM: $_"
}

# Running the manage-bde.exe command after enabling BitLocker
try {
    if ($bitlockerStatus.VolumeStatus -eq "FullyEncrypted" -and $bitlockerStatus.EncryptionPercentage -eq 100) {
        write-host "`n"
        write-host "############################"
        write-host "#    Enabling BitLocker    #"
        write-host "############################"
        Write-Host "This step is only necessary for PCs where the drive was already encrypted with BitLocker but not fully enabled, which is the case here"
        if (!$run) {
            Write-Host "The following command would be executed: manage-bde.exe -on C: | Out-Null"
        } else {
            manage-bde.exe -on C: | Out-Null
            Write-Host "Finalization of BitLocker activation completed."
        }
    }
} catch {
    Write-Host "Error executing the manage-bde.exe command: $_"
}

write-host "`n"
write-host "###########################"
write-host "#    BitLocker status     #"
write-host "###########################"
# Displaying restart message if BitLocker was enabled by the script
if ($bitlockerEnabled -eq $true -and $bitlockerStatus.VolumeStatus -eq "FullyEncrypted" -and $bitlockerStatus.EncryptionPercentage -eq 100 -and "(Get-BitLockerVolume).ProtectionStatus") {
    Write-Host "BitLocker has been enabled; a restart is not required."
}  elseif (!$run) {
    Write-host "The script is in test mode. A message would now indicate if a restart is required."
}  elseif ($bitlockerEnabled) {
    Write-host "A restart will be required for encryption to start. The system will verify the integrity of BitLocker decryption keys."
} else {
    Write-Host "BitLocker was already enabled or there was an issue, the recovery key was backed up to Azure as a precaution, and nothing else was done."
}

write-host "`nPlease run the following command ""Get-BitLockerVolume"" to get the current drive encryption status.`nPlease keep in mind that if ""Protection Status"" currently indicates ""Off"", a reboot might be required for encryption to start.`nIf an encrpyion is in progress, its status can be checked using ""(Get-BitLockerVolume).EncryptionPercentage"".`nIf ""Encryption Percentage"" is currently at 100 and ""Protection Status"" is set to ""On"", a reboot is not required."

pause

$keyProtectorId = (Get-BitLockerVolume -MountPoint $env:SystemDrive).KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' } | Select-Object -First 1
BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $($keyProtectorId.KeyProtectorId)