Bitlocker-Management

# Path configuration
$MonitoringPath = "\\file.share\SystemData\BitlockerMonitoring\"  
$RecoveryPath = "\\file.share\SystemData\BitlockerRecovery\"  

# Functions
function Get-TimeStamp{
	return "[{0:dd/MM/yyyy} {0:HH:mm:ss}]" -f (Get-Date)  
}
function EncryptDrive{
	# Collect TPM information
	$CheckTPM = Get-Tpm
	# Set up Bitlocker on a machine with TPM
	if ($CheckTPM.TpmPresent -eq $true){
		# Enable Bitlocker with the default protector settings and initiate encryption
		manage-bde C: -on -SkipHardwareTest -UsedSpaceOnly -EncryptionMethod XTS_AES256 -ForceEncryptionType Software -TPMAndPIN 12345678
		# Add numeric and key file recovery protectors and save them to the server
		Write-Output "$(Get-TimeStamp) New Recovery Password has been created:" | Out-file $RecoveryPath$env:computername\$env:computername-NumericRecoveryKeys.txt -append  
		manage-bde C: -protectors -add -RecoveryPassword | Out-file $RecoveryPath$env:computername\$env:computername-NumericRecoveryKeys.txt -append
		manage-bde C: -protectors -add -RecoveryKey $RecoveryPath$env:computername 
		# Retrieve protector status and save summary log file to the server
		Write-Output "$(Get-TimeStamp) The current Bitlocker protectors are:" | Out-file $RecoveryPath$env:computername\$env:computername-BitlockerSummary.txt -append  
		manage-bde C: -protectors -get | Out-file $RecoveryPath$env:computername\$env:computername-BitlockerSummary.txt -append
	}
	# Set up Bitlocker on a machine without TPM
	else{
		# Create Startup Key destination
		New-Item -ItemType Directory -Force -Path $RecoveryPath$env:computername\StartupKeys
		# Enable Bitlocker with the default protector settings and initiate encryption
		manage-bde C: -on -SkipHardwareTest -UsedSpaceOnly -EncryptionMethod XTS_AES256 -ForceEncryptionType Software -StartupKey $RecoveryPath$env:computername\StartupKeys
		# Add numeric and key file recovery protectors and save them to the server
		Write-Output "$(Get-TimeStamp) New Recovery Password has been created:" | Out-file $RecoveryPath$env:computername\$env:computername-NumericRecoveryKeys.txt -append  
		manage-bde C: -protectors -add -RecoveryPassword | Out-file $RecoveryPath$env:computername\$env:computername-NumericRecoveryKeys.txt -append
		manage-bde C: -protectors -add -RecoveryKey $RecoveryPath$env:computername 
		# Retrieve protector status and save summary log file to the server
		Write-Output "$(Get-TimeStamp) The current Bitlocker protectors are:" | Out-file $RecoveryPath$env:computername\$env:computername-BitlockerSummary.txt -append  
		manage-bde C: -protectors -get | Out-file $RecoveryPath$env:computername\$env:computername-BitlockerSummary.txt -append
	}
    # Unhide key files
    $HiddenKeys = Get-ChildItem -Recurse -path $RecoveryPath$env:computername -Force | where { $_.Attributes -match "Hidden"}  
    foreach ($KeyFile in $HiddenKeys){
        $KeyFile.Attributes = $KeyFile.Attributes -bxor [System.IO.FileAttributes]::Hidden
    } 
}

# Check Bitlocker state
$CheckBitlocker = Get-BitLockerVolume C:

# Prepare computer files destination
New-Item -ItemType Directory -Force -Path $RecoveryPath$env:computername

# Write log
if ($CheckBitlocker.ProtectionStatus -eq 'On' -AND $CheckBitlocker.EncryptionPercentage -eq 100){  
	Write-Output "$(Get-TimeStamp) Bitlocker is active." | Out-file $MonitoringPath$env:computername-BLlog.txt -append  
}
elseif ($CheckBitlocker.ProtectionStatus -eq 'Off' -AND $CheckBitlocker.EncryptionPercentage -eq 100){  
	Write-Output "$(Get-TimeStamp) Bitlocker is suspended." | Out-file $MonitoringPath$env:computername-BLlog.txt -append  
}
elseif ($CheckBitlocker.ProtectionStatus -eq 'On' -AND $CheckBitlocker.EncryptionPercentage -ne 100){  
	Write-Output "$(Get-TimeStamp) Bitlocker encryption is in progress." | Out-file $MonitoringPath$env:computername-BLlog.txt -append  
}
elseif ($CheckBitlocker.ProtectionStatus -eq 'Off' -AND $CheckBitlocker.EncryptionPercentage -eq 0){  
	EncryptDrive
	Write-Output "$(Get-TimeStamp) Bitlocker is turned off. Encryption has been initiated." | Out-file $MonitoringPath$env:computername-BLlog.txt -append  
}