{"id":392,"date":"2022-07-06T11:37:00","date_gmt":"2022-07-06T09:37:00","guid":{"rendered":"https:\/\/blog.koeckeis-fresel.net\/?p=392"},"modified":"2022-07-27T13:43:29","modified_gmt":"2022-07-27T11:43:29","slug":"bitlocker-encrypt-systemdrive","status":"publish","type":"post","link":"https:\/\/blog.koeckeis-fresel.net\/?p=392","title":{"rendered":"Bitlocker &#8211; encrypt systemdrive (english localization)"},"content":{"rendered":"\n<p>You need to <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>adapt the DC (Domain-Controller) IP-address<\/li><li>create the hidden share on the DC (%dc%\\<strong>bitlocker_keys$<\/strong>)<\/li><li>create a GPO with the needed defaults and name it <strong>Bitlocker_01_defaults<\/strong><\/li><\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>@echo off\nsetlocal ENABLEDELAYEDEXPANSION\n@echo Start: %date% %time% %computername%\necho %computername%\nset dc=192.168.0.1\n\nmanage-bde -status %systemdrive% -p\nIf errorlevel 0 goto error0\nIf errorlevel -1 goto error-1\n\nGoto end\n\n:error0\necho %systemdrive% is encrypted\neventcreate \/L APPLICATION \/T INFORMATION \/SO %~n0%~x0 \/ID 200 \/D \"%~0 -- %systemdrive% is encrypted\"\nping %dc% -n 1 -w 1000 -4 | find \/i \"TTL\" >nul 2>&amp;1\nset ping_ad=%errorlevel%\nif %ping_ad% == 0 (\necho DC is reachable\neventcreate \/L APPLICATION \/T INFORMATION \/SO %~n0%~x0 \/ID 200 \/D \"%~0 -- %dc% is reachable\"\nmkdir \\\\%dc%\\bitlocker_keys$\\status\necho %computername% > \\%dc%\\bitlocker_keys$\\status\\status_%computername%.txt\necho Start: %date% %time% >> \\%dc%\\bitlocker_keys$\\status\\status_%computername%.txt\nmanage-bde -status %systemdrive% >> \\%dc%\\bitlocker_keys$\\status\\status_%computername%.txt\necho End: %date% %time% >> \\%dc%\\bitlocker_keys$\\status\\status_%computername%.txt\n)\nif %ping_ad% == 1 (\necho DC is NOT reachable\neventcreate \/L APPLICATION \/T INFORMATION \/SO %~n0%~x0 \/ID 404 \/D \"%~0 -- %dc% is NOT reachable\"\ngoto end\n)\nGoto end\n\n:error-1\necho %systemdrive% is not encrypted\neventcreate \/L APPLICATION \/T INFORMATION \/SO %~n0%~x0 \/ID 404 \/D \"%~0 -- %systemdrive% is NOT encrypted\"\nmanage-bde -status %systemdrive% | findstr \/L \/C:\"Conversion\"|findstr \/L \/C:\"Decrypted\"\nset conv_stat_full=%errorlevel%\necho conv_stat_full %conv_stat_full%\n\nmanage-bde -status %systemdrive% | findstr \/L \/C:\"Conversion\"|findstr \/L \/C:\"Decryption\" \nset conv_decrypting=%errorlevel%\necho conv_decrypting %conv_decrypting%\n\nmanage-bde -status %systemdrive% | findstr \/L \/C:\"Conversion\"|findstr \/L \/C:\"Encryption\" \nset conv_encrypting=%errorlevel%\necho conv_encrypting %conv_encrypting%\n\nping %dc% -n 1 -w 1000 -4 | find \/i \"TTL\" >nul 2>&amp;1\nset ping_ad=%errorlevel%\nif %ping_ad%==1 (\necho DC is NOT reachable\ngoto end\n)\n\ngpresult \/Scope Computer \/R|findstr Bitlocker_01_defaults\nset gpupdate_status=%errorlevel%\nif %gpupdate_status%==0 (\necho GPO is up to date\neventcreate \/L APPLICATION \/T INFORMATION \/SO %~n0%~x0 \/ID 200 \/D \"%~0 -- GPO is existing\"\n)\nif %gpupdate_status%==1 (\necho GPO was not updated\neventcreate \/L APPLICATION \/T INFORMATION \/SO %~n0%~x0 \/ID 404 \/D \"%~0 -- GPO is NOT existing. Updating GPOs now.\"\nstart \/wait \/b gpupdate \/Target:Computer \/force\n)\ngpresult \/Scope Computer \/R|findstr Bitlocker_01_defaults\nset gpupdate_status=%errorlevel%\nif %gpupdate_status%==1 (\necho GPO is NOT up to date\neventcreate \/L APPLICATION \/T INFORMATION \/SO %~n0%~x0 \/ID 404 \/D \"%~0 -- GPO is NOT existing. Please move the computer to the correct OU\"\ngoto end\n)\n\nif %ping_ad%==0 (\necho DC is reachable\necho %computername% > \\%dc%\\bitlocker_keys$\\status\\status_%computername%.txt\necho Start: %date% %time% >> \\%dc%\\bitlocker_keys$\\status\\status_%computername%.txt\nREM start \/wait \/b gpupdate \/Target:Computer \/force\n\nif %conv_stat_full% == 0 (\n            echo Disk is Decrypted \n            powershell Enable-BitLocker -MountPoint \"C:\" -RecoveryPasswordProtector -SkipHardwareTest\n            manage-bde -protectors -get %systemdrive% > \\\\%dc%\\bitlocker_keys$\\Key_%computername%.txt\n            )\nif %conv_decrypting% == 0 (\n            echo Disk is decrypting\n            eventcreate \/L APPLICATION \/T INFORMATION  \/SO %~n0%~x0  \/ID 200 \/D \"%~0 -- disk is DEcrypting\" \n            )\nif %conv_encrypting% == 0 (\n            echo Disk is encrypting \n            eventcreate \/L APPLICATION \/T INFORMATION  \/SO %~n0%~x0  \/ID 200 \/D \"%~0 -- disk is ENcrypting\" \n            )\n    manage-bde -status %systemdrive% >> \\\\%dc%\\bitlocker_keys$\\status\\status_%computername%.txt\n    echo End: %date% %time% >> \\\\%dc%\\bitlocker_keys$\\status\\status_%computername%.txt\n    )\n\nGoto end\n\n:end\n@echo End: %date% %time%\nexit<\/code><\/pre>\n\n\n\n<div class=\"wp-block-group is-vertical is-layout-flex wp-container-core-group-is-layout-8cf370e7 wp-block-group-is-layout-flex\"><\/div>\n","protected":false},"excerpt":{"rendered":"<p>You need to adapt the DC (Domain-Controller) IP-address create the hidden share on the DC (%dc%\\bitlocker_keys$) create a GPO with the needed defaults and name it Bitlocker_01_defaults<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[15,28,1,9],"tags":[29],"class_list":["post-392","post","type-post","status-publish","format-standard","hentry","category-bat","category-bitlocker","category-general","category-windows","tag-encryption"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/blog.koeckeis-fresel.net\/index.php?rest_route=\/wp\/v2\/posts\/392","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.koeckeis-fresel.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.koeckeis-fresel.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.koeckeis-fresel.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.koeckeis-fresel.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=392"}],"version-history":[{"count":0,"href":"https:\/\/blog.koeckeis-fresel.net\/index.php?rest_route=\/wp\/v2\/posts\/392\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.koeckeis-fresel.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=392"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.koeckeis-fresel.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=392"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.koeckeis-fresel.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=392"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}