Windows · Windows PowerShell 5.1
BitLocker status of every volume on this PC
Is each volume on this Windows device encrypted, is protection on, and does it have a recovery password protector?
Script
#Requires -RunAsAdministrator
#Requires -Modules BitLocker
# BitLocker state and key protector types for every volume on this device. Read-only.
Get-BitLockerVolume |
Select-Object MountPoint, VolumeType, VolumeStatus, ProtectionStatus, LockStatus, EncryptionMethod, EncryptionPercentage,
@{ Name = 'KeyProtectors'; Expression = { ($_.KeyProtector | ForEach-Object { $_.KeyProtectorType }) -join ', ' } },
@{ Name = 'HasRecoveryPassword'; Expression = { @($_.KeyProtector | Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }).Count -gt 0 } }
Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.
Where to run it
The Windows device you want to check, in an elevated Windows PowerShell 5.1 session.
Reading the output
- KeyProtectors lists the KeyProtectorType of each protector (for example Tpm, RecoveryPassword).
- HasRecoveryPassword is False when the volume has no recovery password protector to escrow.
Sources
The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.