PowerShell script to query Bitlocker Status not Working
I have a powerShell script that runs perfectly locally but when I launch it from the SMA it fails. The script adds a registry key named Bitlocker and then queries protection status. When run locally the key is created and the protection status is populated. When run through Kace the key is created but the protection status is NOT populated.
I am running the script as System but have tried Logged-in user and Credentials (Domain Admin)
PowerShell Script used:
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Bitlocker" New-Item -Path $regPath -ErrorAction SilentlyContinue | Out-Null New-ItemProperty -Path $regPath -Name "Bitlocker" -Value "$ProtectionStatus" -PropertyType String -Force | Out-Null if(@((manage-bde -status -cn localhost) -like '*Protection On').Count -gt 0){ $ProtectionStatus = "Protection On"} else {$ProtectionStatus = "Protection Off"}
I have modified the parameters field in task 1 a few times but each fails:
-executionpolicy remotesigned -File $(KACE_DEPENDENCY_DIR)\Bitlocker_Registry.ps1
-nologo -executionpolicy bypass -WindowStyle hidden -noprofile -file "Bitlocker_Registry.ps1"
IS the Kace SMA unable to execute the manage-bde -status command? What am I doing wrong?
Answers (2)
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Bitlocker"
You need to look for the 64bits Hive. (if it's a 64bits O.S.)
See:
https://support.quest.com/kb/319755/kace-agent-redirected-to-32-bit-applications-registry-paths
Or better yet, use a Custom Inventory Rule to display the Bitlocker status from the Device Details page:
https://www.itninja.com/blog/view/kace-sma-bitlocker
^^Things like these, is where KACE SMA shines
Comments:
-
The 64bits hive does not seem to be an issue as it creates the "Bitlocker" key in both 32 and 64 bit locations.
Unfortunately the Custom Inventory Rule will not apply in this case. I am trying to deploy BIOS updates with this script. The goal with this script is to suspend bitlocker, run the PowerShell script mentioned above to verify that Bitlocker protection is off, then deploy BIOS update.exe file. - rsickmen 4 years ago
Have you tried to run the powershell as a shellscript in SMA?
Comments:
-
@Timokirch Running the powershell as a shellscript in SMA failed.
I am able to exactly reproduce the results from the original Kace deployment when I open a command prompt locally and call PowerShell from within the command prompt. I guess the question is, how can I have the script run in the powershell app instead of being called in CMD? It runs perfectly in PowerShell but not when called in cmd? - rsickmen 4 years ago