PowerShell automations · 2026-08-01

PowerShell: check BitLocker status on every drive

The script

Run Get-BitLockerVolume from an elevated prompt and read three columns: VolumeStatus (encrypted or not), ProtectionStatus (whether the key protectors are active) and EncryptionPercentage. A drive can be fully encrypted with protection off, which still counts as unprotected.

Get-BitLockerVolume |
  Select-Object MountPoint, VolumeStatus, ProtectionStatus,
    EncryptionPercentage, @{n='KeyProtectors';
      e={($_.KeyProtector | ForEach-Object KeyProtectorType) -join ', '}} |
  Format-Table -AutoSize

Notes before you run it

Requires an elevated prompt; without admin rights the cmdlet returns nothing useful.
ProtectionStatus Off on a fully encrypted drive means the protectors are suspended (common after firmware updates); the data is not protected until it is resumed with Resume-BitLocker.
On systems without the BitLocker module (Home editions), manage-bde -status gives the same picture.
Escrow the recovery key before enabling anything: (Get-BitLockerVolume -MountPoint C:).KeyProtector shows it.

Only alert when something is wrong

$bad = Get-BitLockerVolume |
  Where-Object { $_.VolumeStatus -ne 'FullyEncrypted' -or $_.ProtectionStatus -ne 'On' }
if ($bad) { $bad | Format-Table MountPoint, VolumeStatus, ProtectionStatus; exit 1 }
"All drives encrypted and protected."

Run it on every machine, not one at a time.

Save any of these as a command in Moorfox and run it on a machine in one click, output and exit code captured, with no PSRemoting or WinRM setup. The agent runs it locally and reports back, even over the internet.

Request an invite