cookie alert

We use cookies to offer you a better browsing experience, analyze site traffic, personalize content, and serve targeted advertisements. If you continue to use this site, you consent to our use of cookies.

Nexthink Library

Disk Encryption

Back

Disk Encryption

Latest Version: 2.6.1.0
|
Updated on April 15, 2024
Install

Description

Use Microsoft BitLocker to encrypt critical data and enhance the security on your corporate devices.

Versions

  • 2.6.1.0 - 15 Apr 2024 - Updated OS requirements
  • 2.6.0.1 - 22 Jul 2022 - Fixed typo in "Get BitLocker Information" Remote Action
  • 2.6.0.0 - 19 Apr 2022 - Implemented usage of improved functions to retrieve OS management information on "Get BitLocker Information" Remote Action
  • 2.5.0.0 - 22 Mar 2022 - Updated "Get BitLocker Information" Remote Action
  • 2.4.0.0 - 20 Sep 2021 - Added input 'EncryptionMethod' to "Enable BitLocker Encryption" Remote Action
  • 2.3.0.0 - 13 Sep 2021 - Added output 'TPMVersion' to "Get BitLocker Information" Remote Action
  • 2.2.0.0 - 30 Sep 2020 - Updated "Get BitLocker Information" Remote Action
  • 2.1.0.0 - 13 Feb 2020 - Removed "Test BitLocker Readiness" Remote Action and updated "Get BitLocker Info" to cover its functionality. Updated "Enable BitLocker Encryption" Remote Action
  • 2.0.1.0 - 19 Dec 2019 - Fixed documentation
  • 2.0.0.0 - Added "Test BitLocker Readiness" Remote Action
  • 1.1.0.0 - Added "Get BitLocker Information" Remote Action
  • 1.0.1.0 - Fixed documentation in "Enable BitLocker Encryption" Remote Action
  • 1.0.0.0 - Initial release

Required Products

Nexthink Act

Platforms

Windows 10 and newer

Compatibility

V6.14 and later

This Might Interest You

Driver compliance
New

Retrieve and take action on pending driver updates across your device landscape.

Released on May 7, 2024
View Library Pack

Workflow: Windows 11 migration
New

Orchestrate the Windows 11 migration process with automated compatibility checks and pre-to-post migration user engagement.

Released on April 11, 2024
View Library Pack

Enable BitLocker Encryption

Script Description

Enables BitLocker encryption in the drive where the OS is installed. By using inputs parameters, you can choose the drive encryption type and the encryption method.Take a look at the official Microsoft documentation to get more information about BitLocker capabilities.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Enforce AD Backup If set to 'true' it will not trigger the encryption unless Active Directory backup GPO is enabled. If set to false it will always trigger the encryption and it will display a warning in case the GPO is disabled. Acceptable values are 'true' or 'false'
Used Space Only Defines drive encryption type used by BitLocker. To encrypt entire drive set to 'false'. Acceptable values are 'true' or 'false'. For more information, please visit this link
Encryption Method Defines encryption method used by BitLocker. Acceptable values are 'Aes128', 'Aes256', 'XtsAes128' or 'XtsAes256'

Outputs

None.

Restrictions

Further Information

The TPM key protector is added automatically to the BitLocker volume once the encryption is enabled.
Furthermore, the script adds a random 48-digit recovery password which can be backed up and used for recovery data purposes in case of issues.
More information about key protectors at the official Microsoft page.
The encryption starts after device's reboot.

Test Scenarios

TpmIsProperlyConfigured
Test Case The TPM is properly configured and with expected values to allow encryption
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - TPM validation is passed
TpmIsNotPresent
Test Case The TPM is not present
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Failure - It fails due to TPM is not present
TpmIsNotConfigured
Test Case TPM doesn't have the expected values
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Failure - It fails due to TPM invalid values
DriveIsNTFS
Test Case The partition where OS is installed has NTFS filesystem
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - File system validation is passed
UsedSpaceOnlyIsTrue
Test Case 'true' is provided to encrypt only used space
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - Input parameter validation passed
UsedSpaceOnlyIsFalse
Test Case 'false' is provided to encrypt the entire OS partition
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - Input parameter validation passed
UsedSpaceOnlyHasInvalidValue
Test Case Provided a different value than 'true' or 'false'
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Failure - UsedSpaceOnly allows either 'true' or 'false'
SystemDriveEncryptionEnabled
Test Case BitLocker encryption is enabled for only used space
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - KeyProtectors added and a message about rebooting is shown in Finder.
After rebooting, the encryption is started.

Get BitLocker Information

Script Description

Returns basic information of BitLocker protection status, including whether volume and key are secured, encryption percentage level, used encryption algorithm, and the protectors used to secure the key.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
TPM Version String Indicates the TPM version
TPM Present Bool If the TPM chip is present on the device
Protection Status String Indicates whether the volume and its encryption key (if any) are secured
Conversion Status String The status of the encryption or decryption on the volume
Encryption Method String The encryption algorithm and key size used on the volume
Key Protectors StringList Lists of protectors used to secure the volume's encryption key
TPM Is Enabled Bool If the device has a TPM enabled
TPM Is Active Bool If the device has a TPM activated
TPM Is Owned Bool If the device has a TPM owned
AD GPO Enabled Bool If the device has the GPO for AD backup enabled
System Drive Ready Bool If the device has the system drive on a NTFS file system

Further Information

Remote Action is compatible with Windows 10 only.
In case of target device not having volumes that could be handled by BitLocker, output will be empty.

Test Scenarios

EncryptedDevice
Test Case Information correctly retrieved
Environment Windows 10 x64 (1809,1903) on Dell Latitude E7470, Lenovo T480s
Results Success - results retrieved match data verified locally
UnencryptedDevice
Test Case Information correctly retrieved
Environment VM Windows 10 x64 multi-language (1809,1903)
Results Success - results retrieved match data verified locally
DeviceWithNoCompatibleVolume
Test Case Information correctly retrieved
Environment VM Windows 10 x86 (1803)
Results Success - results are empty
ThereIsATPM
Test Case The device has a TPM.
Environment Physical Windows 10 x64 English (1809)
Results Success - TPM configuration is correctly shown in the outputs.
ThereIsNoTPM
Test Case The device does not have a TPM.
Environment VM Windows 10 x86/x64 (Multi-language) (1803/1809/1903)
Results Success - 'TPMPresent' shows 'False'. All TPM configuration fields display 'no' or '-'.
SystemDriveFileSystemIsNTFS
Test Case System drive file system is NTFS.
Environment Physical Windows 10 x64 English (1809)
Results Success - 'SystemDriveReady' displays 'yes'.
Windows7Check
Test Case The device OS is Windows 7.
Environment VM Windows 7 x64 (Multi-language)
Results Failed - 'Execution Status Details' field shows 'This script is compatible with Windows 10 only. '.