0

Im trying extract a report from AD of a list of devices that have BitLocker enabled.

We have a Win 2008 r2 Domain Controller and most of our devices are Win 10 with a few Win 8.1 in the mix.

I'm no expert in power shell but have used it in the past on an amateur level. I found the following command online and tried it but when viewing the .CSV all fields are populated except for the "BitlockerPasswordSet" field.

Does anyone have any ideas on how to fix this or better yet a solution they have used that works?

Thanks in advance!


Param (
    [string]$SearchBase = "OU=Office-UK,DC=MyDomainName,DC=local"
)

Try { Import-Module ActiveDirectory -ErrorAction Stop }
Catch { Write-Warning "Unable to load Active Directory module because $($Error[0])"; Exit }


Write-Verbose "Getting Workstations..." -Verbose
$Computers = Get-ADComputer -Filter * -SearchBase $SearchBase -Properties LastLogonDate
$Count = 1
$Results = ForEach ($Computer in $Computers)
{
    Write-Progress -Id 0 -Activity "Searching Computers for BitLocker" -Status "$Count of $($Computers.Count)" -PercentComplete (($Count / $Computers.Count) * 100)
    New-Object PSObject -Property @{
        ComputerName = $Computer.Name
        LastLogonDate = $Computer.LastLogonDate 
        BitLockerPasswordSet = Get-ADObject -Filter "objectClass -eq 'msFVE-RecoveryInformation'" -SearchBase $Computer.distinguishedName -Properties msFVE-RecoveryPassword,whenCreated | Sort whenCreated -Descending | Select -First 1 | Select -ExpandProperty whenCreated
    }
    $Count ++
}
Write-Progress -Id 0 -Activity " " -Status " " -Completed

$ReportPath = "C:\temp\BitLockerComputerReport.csv"
Write-Verbose "Building the report..." -Verbose
$Results | Select ComputerName,LastLogonDate,BitLockerPasswordSet | Sort ComputerName | Export-Csv $ReportPath -NoTypeInformation
Write-Verbose "Report saved at: $ReportPath" -Verbose
user11724406
  • 1
  • 1
  • 2
  • Looks like you need to change `-SearchBase $Computer.distinguishedName` into `-Identity $Computer.distinguishedName` on the `Get-ADObject` cmdlet – Theo Jul 01 '19 at 15:57
  • @Theo No, the `computer` object itself will be the parent of any `msFVE-RecoveryInformation` object, that part is correct. – Mathias R. Jessen Jul 01 '19 at 15:58
  • Are you sure the bitlocker policies are configured to save recovery information to AD? Because if not, this approach won't work – Mathias R. Jessen Jul 01 '19 at 15:59

0 Answers0