Bitlocker Status - Hardware Inventory

Version 1
    Share:|

    We recently had the need to gather the Bitlocker Status of the Windows machines in our environment.

     

    By that time, the BitLocker Status - Custom Inventory document created by @Steve Gibbs (thank you!) didn't exist yet, so we went ahead and gave it a try but by adding a new WMI class to our Hardware Inventory Filter, and it worked nicely and with very little caveats (which are listed below under the Notes and Caveats).

     

    The advantage of using the Hardware Inventory is it's automatically scanned on the machines (depending on your environment's configuration), vs the Custom Inventory which needs to be updated using an Operational Rule, which can be scheduled to run on a certain basis, but still, it would be an extra task added to the agent's workload and we try to avoid that as much as possible.

     

    Here are the steps to add the WMI Class to your Hardware Inventory:

     

    1. Navigate into Global Settings / Inventory Filters / Hardware Inventory.
    2. Open the "Managed WMI Classes" Tab on the right, and press the "Create a new WMI class" button.
      1. Enter "root/cimv2/security/MicrosoftVolumeEncryption" under "WMI Namespace".
      2. Enter "Win32_EncryptableVolume" under "Windows WMI Class".
      3. Enter whatever you want as the "Display Name", we used "Bitlocker". This name will be used to group the attributes in the Hardware Inventory.
      4. Click OK.
    3. This is how it should look like after it's been added:

      Screen Shot 2018-07-19 at 3.44.45 PM.png

    4. Navigate into Global Settings / Inventory Filters / Hardware Inventory / <Your Hardware Inventory Filter's Name> / WMI Filters.

    5. Press the "Add a new WMI class" button.
    6. Select the class' name you created on step 3 from the "Name" dropdown menu, "Bitlocker" in our case, select "Accept" under "Action", and click OK.
    7. Press the "Save the modifications in the XML file" button.
    8. All set!

     

    The next step would be to re-assign the Hardware Inventory filter to all your Windows devices, which is done from your Hardware Inventory Filter's Assigned Objects node.

     

    This is how it looks like once the Hardware Inventory is collecting the Bitlocker Status - you'll use the "ProtectionStatus" attribute to tell if the drive has been encrypted with Bitlocker or not  (the description of each "ProtectionStatus" value is available in the following Microsoft document):

     

        Screen Shot 2018-07-19 at 4.02.27 PM.png

     

    Notes and Caveats

    1. The Hardware Inventory filter must be up-to-date in the device to capture the Bitlocker status in the next Hardware Inventory scan, which is usually done on the device start-up (depending on your environment's configuration), or can also be launched through an Operational Rule.
    2. The WMI Class object will collect the status of all the drives in the system, not only the main OS drive, so be wary of this when creating queries/reports.
    3. Sometimes when machines go through Windows 10 Feature Updates, the ProtectionStatus will change from 1 to 0 after the first reboot. This is "normal", and it should return to 1 after a subsequent reboot.

     

    Hope this helps someone!

    Eduardo