You are using an ad blocker that is interfering with our web typography and internal javascript. Please whitelist our domain to live in a more beautiful world. No ads here, just really great software!

Nexthink CEO Pedro Bados appears on CNBC View Coverage

cookie alert

We use cookies to offer you a better browsing experience, analyze site traffic, personalize content, and serve targeted advertisements. If you continue to use this site, you consent to our use of cookies.

Nexthink Library

Disk Encryption

Improve the security of your devices by managing data encryption with Microsoft BitLocker.

Enable BitLocker Encryption Get BitLocker Information Test BitLocker Readiness

Content

Remote actions - 3

Required Modules

Nexthink Act

Platforms

Windows

Compatibility

V6.14 and later
Install
  • 2.0.1.0 - 19 Dec 2019 - Fixed documentation
  • 2.0.0.0 - Added "Test BitLocker Readiness" Remote Action
  • 1.1.0.0 - Added "Get BitLocker Information" Remote Action
  • 1.0.1.0 - Fixed documentation in "Enable BitLocker Encryption" Remote Action
  • 1.0.0.0 - Initial release

Description

Use Microsoft BitLocker to encrypt critical data and enhance the security on your corporate devices.

Enable BitLocker Encryption

Script Description

Enables BitLocker encryption in the drive where the OS is installed. By using an input parameter, you can choose to encrypt the entire disk or only the used space.Take a look at the official Microsoft documentation to get more information about BitLocker capabilities.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Used Space Only Defines encryption method used by BitLocker. To encrypt entire drive set to 'false'. Acceptable values are 'true' or 'false'. For more information, please visit this link

Outputs

None.

Restrictions

Further Information

The TPM key protector is added automatically to the BitLocker volume once the encryption is enabled.
Furthermore, the script adds a random 48-digit recovery password which can be backed up and used for recovery data purposes in case of issues.
More information about key protectors at the official Microsoft page.
The encryption starts after device's reboot.

Test Scenarios

TpmIsProperlyConfigured
Test Case The TPM is properly configured and with expected values to allow encryption
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - TPM validation is passed
TpmIsNotPresent
Test Case The TPM is not present
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Failure - It fails due to TPM is not present
TpmIsNotConfigured
Test Case TPM doesn't have the expected values
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Failure - It fails due to TPM invalid values
DriveIsNTFS
Test Case The partition where OS is installed has NTFS filesystem
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - File system validation is passed
UsedSpaceOnlyIsTrue
Test Case 'true' is provided to encrypt only used space
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - Input parameter validation passed
UsedSpaceOnlyIsFalse
Test Case 'false' is provided to encrypt the entire OS partition
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - Input parameter validation passed
UsedSpaceOnlyHasInvalidValue
Test Case Provided a different value than 'true' or 'false'
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Failure - UsedSpaceOnly allows either 'true' or 'false'
SystemDriveEncryptionEnabled
Test Case BitLocker encryption is enabled for only used space
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - KeyProtectors added and a message about rebooting is shown in Finder.
After rebooting, the encryption is started.

Get BitLocker Information

Script Description

Returns basic information of BitLocker protection status, including whether volume and key are secured, encryption percentage level, used encryption algorithm, and the protectors used to secure the key.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Disk Drive Volume for which the BitLocker information should be returned. Accepted values are capital letters (A-Z)

Outputs

Label Type Description
Protection Status String Indicates whether the volume and its encryption key (if any) are secured
Conversion Status String The status of the encryption or decryption on the volume
Percentage Encrypted Ratio The percentage of volume that is currently encrypted
Encryption Method String The encryption algorithm and key size used on the volume
Key Protectors StringList Lists of protectors used to secure the volume's encryption key

Further Information

Remote Action is compatible with Windows 10 only.
In case of target device not having volumes that could be handled by BitLocker, output will be empty.

Test Scenarios

EncryptedDevice
Test Case Information correctly retrieved
Environment Windows 10 x64 (1809,1903) on Dell Latitude E7470, Lenovo T480s
Results Success - results retrieved match data verified locally
UnencryptedDevice
Test Case Information correctly retrieved
Environment VM Windows 10 x64 multi-language (1809,1903)
Results Success - results retrieved match data verified locally
DeviceWithNoCompatibleVolume
Test Case Information correctly retrieved
Environment VM Windows 10 x86 (1803)
Results Success - results are empty

Test BitLocker Readiness

Script Description

Retrieves the TPM status and the file system used by the system drive to check if the device is ready to be encrypted with BitLocker.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
TPM Is Enabled Bool If the device has a Trusted Platform Module enabled
TPM Is Active Bool If the device has a Trusted Platform Module activated
TPM Is Owned Bool If the device has a Trusted Platform Module owned
System Drive Ready Bool If the device has the system drive on a NTFS file system

Restrictions

Further Information

More information about preparing your organization's devices for BitLocker is available here.
To know more about TPMs go to this page.

Test Scenarios

ThereIsATPM
Test Case The device has a TPM.
Environment Physical Windows 10 x64 English (1809)
Results Success - TPM configuration is correctly shown in the outputs.
ThereIsATPM
Test Case The device does not have a TPM.
Environment VM Windows 10 x86/x64 (Multi-language) (1803/1809/1903)
Results Success - All TPM configuration fields display 'no'. 'Execution Status Details' shows 'TPM info not found. '.
SystemDriveFileSystemIsNTFS
Test Case System drive file system is NTFS.
Environment Physical Windows 10 x64 English (1809)
Results Success - 'SystemDriveReady' displays 'yes'.
Windows7Check
Test Case The device OS is Windows 7.
Environment VM Windows 7 x64 (Multi-language)
Results Failed - 'Execution Status Details' field shows 'This script is compatible with Windows 10 only. '.
Thank you!