Today is practically mandatory that the mobile devices we deploy have data-at-rest encryption. Microsoft’s Bitlocker is particularly useful for this purpose, assuming your endpoint has a TPM and Windows Professional. In a previous post, I have already posted a set of scripts (available here) to reset the TPM and now I’ll present a simple script that complements these.
Although it’s easy to enable the TPM manually in a post deployment stage, it’s also useful to collect and store the unlock key that Windows generates during Bitlocker activation. Typically, your deployment script (MDT or SCCM) would save this key in your Active Directory. However, if you are using MDT to deploy Windows in an environment without Active Directory, you still need to save this key if you decide to activate Bitlocker in your deployment script. This script, when executed, will activate Bitlocker and save it’s recovery key in a file. This file will be saved in your server, if you’re deploying with PXE. If you are deploying Windows using a USB drive, the script will store the file in your USB drive, in the same way as with the server option.
:: Enable BDE setlocal enableextensions enabledelayedexpansion cd /d "%~dp0" if "%ResourceDrive%"=="" goto FIND_DEPLOY set BACKVOL=%ResourceDrive% goto BDE_ENABLE :FIND_DEPLOY if exist %TEMP%\vol_str.txt del %TEMP%\vol_str.txt wmic logicaldisk get deviceid,volumename | findstr DEPLOY >%TEMP%\vol_str.txt set /p DEPLOY_VOL=<"%TEMP%\vol_str.txt" if not "%DEPLOY_VOL%"=="" set DEPLOY_VOL=%DEPLOY_VOL:~0,2% if "%DEPLOY_VOL%"=="" ( echo Could not locate DEPLOY volume! >>%SystemDrive%\tpm.log exit /b 1 ) set BACKVOL=%DEPLOY_VOL% :BDE_ENABLE if not exist %BACKVOL%\BDE\%COMPUTERNAME% md %BACKVOL%\BDE\%COMPUTERNAME% manage-bde -on %SystemDrive% -s -rp -rk %BACKVOL%\BDE\%COMPUTERNAME% > %BACKVOL%\BDE\%COMPUTERNAME%\RecoveryKey.txt attrib -s -h -r %BACKVOL%\BDE\%COMPUTERNAME%\*.bek if exist %SystemDrive%\tpm.log ( copy %SystemDrive%\tpm.log %BACKVOL%\BDE\%COMPUTERNAME%\ del %SystemDrive%\tpm.log /Q ) :END exit /b 0
One little caveat, from the source you’ll notice that in the case of a USB drive, the script will search for a “DEPLOY” volume as described in my previous article on MDT. Once the script finds the volume where the files should be stored, it creates a folder inside the root BDE folder with the given hostname and saves the relevant files. There’s also a command to save a “tpm.log”, which is a log generated during the TPM clear and TPM init stages, as I already mentioned.
Any question, feel free to contact.