Carl T Posted April 16, 2021 Share Posted April 16, 2021 (edited) A number of folks have requested the ability to manage bitlocker with Pulseway, so I thought I would share how I am doing this with Powershell scripts and Pulseway's custom fields feature. First, you will need to create a custom fields in Pulseway (Automation Tab --> Custom Fields). This fields should be a text variable that has the system context. I personally have 3, BitlockerKey, Protection Status (On/Off), and BitLockerVolumeStatus. BitlockerKey is probably the one most people will care about. . After Configuring the Custom fields, you will then need to create your PowerShell script. Notice you have inputs and outputs. You will want to click New for output. Name it what you wish, ensure it is a text variable type, and then turn on "set Custom Field Value" Now we toggle the flag for it being a windows powershell script. You should see in the top that it has created a comment #outputs with your defined output variable assigned the default value you gave it. Now we have our script: Update as of 4/18/2021, script now tracks 3 custom fields and will account for if a drive is encrypted but protection is off and no protectors have been added yet. # Outputs $ProtectionStatus = "na" $recoveryKey = "na" $VolumeStatus = "na" #region functions function Start-BitlockerEnable { Enable-BitLocker -MountPoint c: -EncryptionMethod XtsAes128 -UsedSpaceOnly -TpmProtector $today = Get-Date $scheduledtime = $today.Date.AddHours(23) [int]$SecondsToMidnight = ($scheduledtime - $today).TotalSeconds shutdown /r /t $SecondsToMidnight msg.exe * "Bitlocker Encryption has been enabled. A reboot is needed before the encryption will apply and has been scheduled for $scheduledtime local time. You can reboot before this if you prefer." #start-sleep 90 #msg.exe * "This Computer will reboot in 30 seconds to bitlocker Encryption" #start-sleep 30 #Restart-computer -force } #endregion functions #region execution $BitLockerStatus = Get-BitLockerVolume -MountPoint c: if ((Get-Tpm).tpmpresent -eq $true) { #If Volume is in the process of encrypting or decrypting the Volume status will not say fully. Don't make changes when it changes if (($BitLockerStatus.ProtectionStatus -match 'off') -and ($bitlockerstatus.VolumeStatus -notmatch 'progress')) { #NoBitlocker is enabled so run it. if ($BitLockerStatus.VolumeStatus -eq 'FullyDecrypted') { $recoverykey = $BitLockerStatus.KeyProtector | Select-Object -ExpandProperty recoverypassword if(!($recoveryKey)){ Add-BitLockerKeyProtector -MountPoint c: -RecoveryPasswordProtector } $newStatus = Get-BitLockerVolume -MountPoint c: $recoverykey = $newStatus.KeyProtector | Select-Object -ExpandProperty recoverypassword Start-Process -FilePath "$env:PWY_HOME\CLI.exe" -ArgumentList ("setVariable recoverykey ""$recoverykey""") -Wait if ($newStatus.KeyProtector -match 'Recovery') { Start-BitlockerEnable } } #Bitlocker must be Partially enabled where drive is fully encrypted, but protection is off and no protectors exist. #Typically this is using xtsAES128 so you may wish to disable-bitlocker, then re-enable it with your protectors and prefered encryption level. else{ Disable-BitLocker -MountPoint 'c:' $decryptInProgress = $true While($decryptInProgress -eq $true){ $decryptstatus = Get-BitLockerVolume -MountPoint 'c:' if($decryptstatus.VolumeStatus -match 'progress'){ Start-Sleep 2 } else{ $decryptInProgress = $false } } Add-BitLockerKeyProtector -MountPoint c: -RecoveryPasswordProtector $newStatus = Get-BitLockerVolume -MountPoint c: $recoverykey = $newStatus.KeyProtector | Select-Object -ExpandProperty recoverypassword Start-Process -FilePath "$env:PWY_HOME\CLI.exe" -ArgumentList ("setVariable recoverykey ""$recoverykey""") -Wait if ($newStatus.KeyProtector -match 'Recovery') { Start-BitlockerEnable } } } #BitLocker should already be enabled so log keys, volume status etc. else { $recoverykey = $BitLockerStatus.KeyProtector | Select-Object -ExpandProperty recoverypassword $ProtectionStatus = $BitLockerStatus.ProtectionStatus $VolumeStatus = $BitLockerStatus.VolumeStatus Start-Process -FilePath "$env:PWY_HOME\CLI.exe" -ArgumentList ("setVariable recoverykey ""$recoverykey""") -Wait Start-Process -FilePath "$env:PWY_HOME\CLI.exe" -ArgumentList ("setVariable ProtectionStatus ""$ProtectionStatus""") -Wait Start-Process -FilePath "$env:PWY_HOME\CLI.exe" -ArgumentList ("setVariable VolumeStatus ""$VolumeStatus""") -Wait } } else { $recoverykey = 'NoTpm' Start-Process -FilePath "$env:PWY_HOME\CLI.exe" -ArgumentList ("setVariable recoveryKey ""$recoveryKey""") -Wait } #endregion execution You can modify the above script as you wish. I personally have gone with a bit of a cautious approach where it will not skip the hardware check which will reboot the pc, but for me I prefer this approach to having it encrypt the drive without checking tpm is all good which could then result in the drive being encrypted and locking out the end user.  At the end of all this, you now should be able to Both Enable bitlocker encryption as well as pull your recovery keys from pulseway like so :  Edited May 8, 2021 by Carl T Few word edits. Fred_BD 1 Link to comment Share on other sites More sharing options...
Fred_BD Posted July 20, 2021 Share Posted July 20, 2021 I really appreciate this Carl T. Tremendously helpful and I can't wait to try it out. Does anyone know why I'm not finding the ability to create custom fields under the Automation tab? I'm running the free license for 2 users (to try this out long term before we purchase this and push it company-wide) so I'm wondering if that's the reason. We're not quite ready for the timed trial, but if this is something to add to the list of things to do during the trial (along with remote access) then that's fine, I'm just looking for confirmation on that. I'm looking at both the browser version of Pulseway as well as the Android version and I'm just not seeing it. Carl T 1 Link to comment Share on other sites More sharing options...
Jamie Taylor Posted July 22, 2021 Share Posted July 22, 2021 Hey Fred, Custom field option is not available for our free version, please feel free to try our paid version to use the custom fields. Thank you! Carl T 1 Link to comment Share on other sites More sharing options...
Fred_BD Posted July 23, 2021 Share Posted July 23, 2021 Thanks Jamie, that makes sense then. We'll try this one out once we're prepared for the trial. Jamie Taylor 1 Link to comment Share on other sites More sharing options...
Janet Posted October 19, 2021 Share Posted October 19, 2021 Hi, Where I can add the variable? Link to comment Share on other sites More sharing options...
Fred_BD Posted December 30, 2021 Share Posted December 30, 2021 (edited) On 10/19/2021 at 3:04 PM, Janet said: Hi, Where I can add the variable? I believe there was a mistake in the guide which I think applies to you. In the guide, where it says: On 4/16/2021 at 11:21 AM, Carl T said: ... After Configuring the Custom fields, you will then need to create your PowerShell script. Notice you have inputs and outputs. You will want to click New for output. Name it what you wish, ensure it is a text variable type, and then turn on "set Custom Field Value" You actually don't want the Output name to be anything other than what matches the variable(s) in the script. For this guide, you would want to name the Output either ProtectionStatus, recoveryKey, or VolumeStatus. You'll notice after you create the Output, its name is a variable at the top of your script. I simply removed the already mentioned (same-named) variable from the top of Carl T's original script. The alternative to all of this is you can change the script's variable names to match your Output name but that's extra effort. I should note that the names of custom fields can be whatever you'd like, those don't have to match anything. Edited December 30, 2021 by Fred_BD Link to comment Share on other sites More sharing options...
Jason Hollinden Posted March 15, 2022 Share Posted March 15, 2022 (edited) I am having an issue where nothing is put into the custom variables. Through trial and error running the commands in Powershell, I see that the commands that run CLI.exe give an error "Missing Pulseway execution cookie". I'm assuming there's something I'm missing? I was able to produce this error by adding -NoNewWindow to the end of the CLI.exe statements, otherwise it wouldn't report the error. Ex. Start-Process -FilePath "C:\Program Files\Pulseway\CLI.exe" -ArgumentList ("setVariable recoverykey ""$recoverykey""") -Wait -NoNewWindow Edit: So I figured out what caused this error, I have the Powershell User Impersonation enabled to a domain account. When I unchecked that box, everything worked. Edited March 15, 2022 by Jason Hollinden Jamie Taylor 1 Link to comment Share on other sites More sharing options...
TonyC Posted August 15, 2022 Share Posted August 15, 2022 Thank you Carl for sharing a very useful script. I am only using the last section to start with just to log the Bitlocker status and backup the key. This saved me a lott of time! Â Jamie Taylor 1 Link to comment Share on other sites More sharing options...
Gregory Candido Posted February 14 Share Posted February 14 Is it possible to capture the Identifier for the BitLocker key? Maybe create a custom field for each? Can someone modify that script to include that? Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now