PowerShell automations · 2026-08-01

PowerShell: check BitLocker status on every drive

Get-BitLockerVolume |
  Select-Object MountPoint, VolumeStatus, ProtectionStatus,
    EncryptionPercentage, @{n='KeyProtectors';
      e={($_.KeyProtector | ForEach-Object KeyProtectorType) -join ', '}} |
  Format-Table -AutoSize

Notes before you run it

• Requires an elevated prompt; without admin rights the cmdlet returns nothing useful.
• ProtectionStatus Off on a fully encrypted drive means the protectors are suspended (common after firmware updates); the data is not protected until it is resumed with Resume-BitLocker.
• On systems without the BitLocker module (Home editions), manage-bde -status gives the same picture.
• Escrow the recovery key before enabling anything: (Get-BitLockerVolume -MountPoint C:).KeyProtector shows it.

Only alert when something is wrong

$bad = Get-BitLockerVolume |
  Where-Object { $_.VolumeStatus -ne 'FullyEncrypted' -or $_.ProtectionStatus -ne 'On' }
if ($bad) { $bad | Format-Table MountPoint, VolumeStatus, ProtectionStatus; exit 1 }
"All drives encrypted and protected."

What the VolumeStatus values mean

FullyDecrypted means the drive has no encryption. EncryptionInProgress and DecryptionInProgress mean the conversion is still running, and EncryptionPercentage is the progress figure. FullyEncrypted means the conversion finished, and on its own it does not mean the drive is protected.

The pairing that catches people out is FullyEncrypted with ProtectionStatus Off. The data is encrypted, but the key is available without any challenge, so a stolen machine gives the data up. For a compliance answer, both columns have to be right.

Why protection suspends itself

BitLocker suspends protection deliberately when something would otherwise break startup: a feature update, a firmware or BIOS update, or a TPM change. Suspension is meant to be temporary. Suspend-BitLocker takes a -RebootCount, and protection resumes automatically after that many restarts. A count of 0 suspends it indefinitely, which is how machines end up encrypted but unprotected for months.

Resume-BitLocker -MountPoint C: turns protection back on without re-encrypting anything, so it is quick and safe to run.

Checking the recovery key is actually escrowed

Encryption without an escrowed recovery key is a support incident waiting to happen. (Get-BitLockerVolume -MountPoint C:).KeyProtector lists the protectors and their types, such as Tpm, RecoveryPassword and ExternalKey. A volume with no RecoveryPassword protector has no recovery key to escrow at all.

Back an existing one up to Active Directory with Backup-BitLockerKeyProtector -MountPoint C: -KeyProtectorId <id>, or to Entra ID with BackupToAAD-BitLockerKeyProtector -MountPoint C: -KeyProtectorId <id>. The KeyProtectorId comes from the listing above, and the backup cmdlets confirm nothing on success, so verify in the directory rather than trusting a silent return.

Checking a fleet rather than a machine

Invoke-Command -ComputerName <names> -ScriptBlock { Get-BitLockerVolume -MountPoint C: } returns one row per machine tagged with PSComputerName. Report on the combination rather than either column alone: a machine is compliant only when VolumeStatus is FullyEncrypted and ProtectionStatus is On.

Fixed data drives are worth including. A laptop with an encrypted C: and a plain D: full of client files is a common finding and rarely deliberate.

Frequently asked questions

Does BitLocker need a TPM?

Not strictly. The standard configuration uses the TPM so the machine starts without a prompt, but BitLocker can run without one by requiring a startup PIN or a USB startup key, enabled through policy. Without a TPM and without one of those, the drive cannot be protected.

What is the difference between used space only and full encryption?

Used space only encrypts the space currently holding data and encrypts new data as it is written, which is much faster on a new machine. Full encryption also covers free space, which matters on a drive that previously held unencrypted data, because deleted files can still be recoverable there.

Where is the BitLocker recovery key stored?

Wherever it was escrowed when encryption was enabled: Active Directory, Entra ID, a Microsoft account for personal devices, a saved file, or paper. (Get-BitLockerVolume -MountPoint C:).KeyProtector shows whether a RecoveryPassword protector exists at all, which is the first thing to check when nobody can find a key.

How do I turn protection back on after it was suspended?

Run Resume-BitLocker -MountPoint C: from an elevated prompt. It re-enables the key protectors without re-encrypting the drive, so it completes immediately.