You are using an ad blocker that is interfering with our web typography and internal javascript. Please whitelist our domain to live in a more beautiful world. No ads here, just really great software!

Nexthink helps you deliver a great experience to employees working from anywhere. Learn More

cookie alert

We use cookies to offer you a better browsing experience, analyze site traffic, personalize content, and serve targeted advertisements. If you continue to use this site, you consent to our use of cookies.

Nexthink Library

Disk Encryption

Latest Version: 2.2.0.0
Install

Required Products

Nexthink Act

Platforms

Windows 10

Compatibility

V6.14 and later

Description

Use Microsoft BitLocker to encrypt critical data and enhance the security on your corporate devices.

Versions

  • 2.2.0.0 - 13 Mar 2020 - Updated "Get BitLocker Information" Remote Action
  • 2.1.0.0 - 13 Feb 2020 - Removed "Test BitLocker Readiness" Remote Action and updated "Get BitLocker Info" to cover its functionality. Updated "Enable BitLocker Encryption" Remote Action
  • 2.0.1.0 - 19 Dec 2019 - Fixed documentation
  • 2.0.0.0 - Added "Test BitLocker Readiness" Remote Action
  • 1.1.0.0 - Added "Get BitLocker Information" Remote Action
  • 1.0.1.0 - Fixed documentation in "Enable BitLocker Encryption" Remote Action
  • 1.0.0.0 - Initial release

Enable BitLocker Encryption

Script Description

Enables BitLocker encryption in the drive where the OS is installed. By using an input parameter, you can choose to encrypt the entire disk or only the used space.Take a look at the official Microsoft documentation to get more information about BitLocker capabilities.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Enforce AD Backup If set to 'true' it will not trigger the encryption unless Active Directory backup GPO is enabled. If set to false it will always trigger the encryption and it will display a warning in case the GPO is disabled. Acceptable values are 'true' or 'false'
Used Space Only Defines encryption method used by BitLocker. To encrypt entire drive set to 'false'. Acceptable values are 'true' or 'false'. For more information, please visit this link

Outputs

None.

Restrictions

Further Information

The TPM key protector is added automatically to the BitLocker volume once the encryption is enabled.
Furthermore, the script adds a random 48-digit recovery password which can be backed up and used for recovery data purposes in case of issues.
More information about key protectors at the official Microsoft page.
The encryption starts after device's reboot.

Test Scenarios

TpmIsProperlyConfigured
Test Case The TPM is properly configured and with expected values to allow encryption
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - TPM validation is passed
TpmIsNotPresent
Test Case The TPM is not present
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Failure - It fails due to TPM is not present
TpmIsNotConfigured
Test Case TPM doesn't have the expected values
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Failure - It fails due to TPM invalid values
DriveIsNTFS
Test Case The partition where OS is installed has NTFS filesystem
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - File system validation is passed
UsedSpaceOnlyIsTrue
Test Case 'true' is provided to encrypt only used space
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - Input parameter validation passed
UsedSpaceOnlyIsFalse
Test Case 'false' is provided to encrypt the entire OS partition
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - Input parameter validation passed
UsedSpaceOnlyHasInvalidValue
Test Case Provided a different value than 'true' or 'false'
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Failure - UsedSpaceOnly allows either 'true' or 'false'
SystemDriveEncryptionEnabled
Test Case BitLocker encryption is enabled for only used space
Environment Windows 10 1903 EN, i7 6600U 2.60GHz 16GB RAM
Results Successful - KeyProtectors added and a message about rebooting is shown in Finder.
After rebooting, the encryption is started.

Get BitLocker Information

Script Description

Returns basic information of BitLocker protection status, including whether volume and key are secured, encryption percentage level, used encryption algorithm, and the protectors used to secure the key.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
TPM Present Bool If the TPM chip is present on the device
Protection Status String Indicates whether the volume and its encryption key (if any) are secured
Conversion Status String The status of the encryption or decryption on the volume
Encryption Method String The encryption algorithm and key size used on the volume
Key Protectors StringList Lists of protectors used to secure the volume's encryption key
TPM Is Enabled Bool If the device has a Trusted Platform Module enabled
TPM Is Active Bool If the device has a Trusted Platform Module activated
TPM Is Owned Bool If the device has a Trusted Platform Module owned
AD GPO Enabled Bool If the device has the GPO for AD backup enabled
System Drive Ready Bool If the device has the system drive on a NTFS file system

Further Information

Remote Action is compatible with Windows 10 only.
In case of target device not having volumes that could be handled by BitLocker, output will be empty.

Test Scenarios

EncryptedDevice
Test Case Information correctly retrieved
Environment Windows 10 x64 (1809,1903) on Dell Latitude E7470, Lenovo T480s
Results Success - results retrieved match data verified locally
UnencryptedDevice
Test Case Information correctly retrieved
Environment VM Windows 10 x64 multi-language (1809,1903)
Results Success - results retrieved match data verified locally
DeviceWithNoCompatibleVolume
Test Case Information correctly retrieved
Environment VM Windows 10 x86 (1803)
Results Success - results are empty
ThereIsATPM
Test Case The device has a TPM.
Environment Physical Windows 10 x64 English (1809)
Results Success - TPM configuration is correctly shown in the outputs.
ThereIsNoTPM
Test Case The device does not have a TPM.
Environment VM Windows 10 x86/x64 (Multi-language) (1803/1809/1903)
Results Success - 'TPMPresent' shows 'False'. All TPM configuration fields display 'no' or '-'.
SystemDriveFileSystemIsNTFS
Test Case System drive file system is NTFS.
Environment Physical Windows 10 x64 English (1809)
Results Success - 'SystemDriveReady' displays 'yes'.
Windows7Check
Test Case The device OS is Windows 7.
Environment VM Windows 7 x64 (Multi-language)
Results Failed - 'Execution Status Details' field shows 'This script is compatible with Windows 10 only. '.
Thank you!