0

I am trying to determine the accuracy of reporting from 2 seemingly difference sources (using powershell on Windows devices):

Method1

manage-bde.exe -computername $hostname -status

Returns something like 100% encrypted and partition size

Method 2

if($encryption_check_all = Get-WMIObject -ComputerName $hostname -Namespace "root/CIMV2/Security/MicrosoftVolumeEncryption" -query "SELECT * FROM Win32_EncryptableVolume WHERE DriveLetter='C:'" | Select-Object *){
    $encryption_check = $encryption_check_all.ProtectionStatus
    if ($encryption_check -eq "1"){$encryption_status = "Encrypted" ; $encryption_value = 200 }
    if ($encryption_check -eq "0"){$encryption_status = "No Encryption Found" ; $encryption_value = 200 }
else{}

Returns a value of "1" or "0". 0 meaning partition not encrypted, partially encrypted, or keys in plain text. BOTH snippets "work" as far as the code goes, BUT they return conflicting results. Does anyone have experience or validation for either method? Im having a device return with method 1 as a "0" but bde.exe says it is 100% encrypted. Does this for sure mean that keys are present in plain text or is there other nuances im unaware of? Any clarity is greatly appreciated.

Also if anyone is aware of data source from bde.exe. Is this just an exe to regurgitate AD bitlocker key recovery? I believe the WMI namespace call actually checks on device on partition- more accurate? THANKS!

Charles
  • 305
  • 1
  • 3
  • 15
  • This _might_ be a better fit on ServerFault. – Matt Feb 04 '16 at 19:13
  • Method 2 should always fail the `If` statement since you assign the output to a variable and do not output anything to the `If` statement it should always evaluate to `$false`. – TheMadTechnician Feb 04 '16 at 21:37
  • Have you considered just using `Get-BitLockerVolume`? Or do you need to run it against a remote machine? – TheMadTechnician Feb 04 '16 at 21:40
  • The logic works for my use case. The return is a value string not boolean. So as long as it returns a string 1 or 0 then I want to proceed. If it doesn't (I.e platforms like wall mounts in my environment) I don't want to continue the logic. The logic is not the issue, the question is about validation or community experience with either method. This of course is my understanding- and I've been wrong before. ;) – Charles Feb 04 '16 at 21:45
  • Has to be remote- and scalable. 15k+ devices and no winRM. :( – Charles Feb 04 '16 at 21:46

0 Answers0