Powershell and TPM how to manage bitlocker?

Question

I am trying to script a powershell function manage-bde.exe (bitlocker) to add a key protector to systems without TPM. For some reason GPO is not working. I have not had any luck getting powershell to add the protector remotely. I can log on to the endpoint and use the built in wizard to encrypt and save the key to our repository but for some reason remote automated scripting eludes me. My question is really more of guidance. Can powershell only be used, to remotely manage systems with TPM? I have bitlocker enabled and encrypted on systems without but I have had to do it manually.

Start-Transcript -Path ".\bitlockertranscript.txt" -Force  
foreach ($Computer in $List) {   
   
        if (test-Connection -ComputerName $Computer -Count 1 -Quiet ) {    
           
            Get-ADComputer -Identity $Computer -Property * | Select Name,OperatingSystem 
            Get-WmiObject -class Win32_Tpm -namespace root\CIMV2\Security\MicrosoftTpm  -computername $Computer | fl IsActivated_InitialValue, IsEnabled_InitialValue, IsOwned_InitialValue   
            $BitLocker = Get-WmiObject -ComputerName $Computer -Namespace Root\cimv2\Security\MicrosoftVolumeEncryption -Class Win32_EncryptableVolume 
            $id = $BitLocker.GetKeyProtectors(3).volumekeyprotectorid | Select -First 1 
            manage-bde.exe -cn $Computer -protectors -adbackup c: 
            manage-bde.exe -on C: -cn $Computer 
            Invoke-GPUpdate -Target $computer
                    } else   
                       
                    {"No Connection to $Computer"   
               
                    }       
           
} 
Stop-Transcript

Powershell and TPM how to manage bitlocker?

0 Answers0